{ "@context": "https://openvex.dev/ns/v0.2.0", "author": "https://tuxcare.com", "role": "Document Creator", "timestamp": "2026-11-11T18:55:00.247817+00:00", "version": 1, "statements": [ { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zend-view@2.1.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zend-view@2.1.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-m7hr-j867-3f34 is fixed in version 2.1.6-p1+tuxcare of zendframework/zend-view.", "vulnerability": { "name": "GHSA-m7hr-j867-3f34" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/laravel-medialibrary@9.12.4-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/laravel-medialibrary@9.12.4-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10189 is fixed in version 9.12.4-p2+tuxcare of spatie/laravel-medialibrary.", "vulnerability": { "name": "AIKIDO-2024-10189" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/laravel-medialibrary@9.12.4-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/laravel-medialibrary@9.12.4-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48555 is fixed in version 9.12.4-p2+tuxcare of spatie/laravel-medialibrary.", "vulnerability": { "name": "CVE-2026-48555" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/laravel-medialibrary@9.12.4-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/laravel-medialibrary@9.12.4-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48557 is fixed in version 9.12.4-p2+tuxcare of spatie/laravel-medialibrary.", "vulnerability": { "name": "CVE-2026-48557" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/nategood/httpful@0.3.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/nategood/httpful@0.3.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-GCFG-HMWX-WQ5H is fixed in version 0.3.2-p1+tuxcare of nategood/httpful.", "vulnerability": { "name": "GHSA-GCFG-HMWX-WQ5H" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/nategood/httpful@0.3.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/nategood/httpful@0.3.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gcfg-hmwx-wq5h does not affect version 0.3.2-p1+tuxcare of nategood/httpful. already_fixed \u2014 The target repository (nategood/httpful v0.3.2-p1+tuxcare) already contains the security fix for GHSA-gcfg-hmwx-wq5h. The vulnerability was that SSL/TLS certificate validation was disabled by default (strict_ssl = false), allowing man-in-the-middle attacks. The fix changes the default to strict_ssl = true, enabling certificate validation. TuxCare backported this fix in commit 588532c on 2026-05...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-gcfg-hmwx-wq5h" }, "impact_statement": "already_fixed \u2014 The target repository (nategood/httpful v0.3.2-p1+tuxcare) already contains the security fix for GHSA-gcfg-hmwx-wq5h. The vulnerability was that SSL/TLS certificate validation was disabled by default (strict_ssl = false), allowing man-in-the-middle attacks. The fix changes the default to strict_ssl = true, enabling certificate validation. TuxCare backported this fix in commit 588532c on 2026-05..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phenx/php-svg-lib@0.3.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phenx/php-svg-lib@0.3.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50251 is fixed in version 0.3.4-p1+tuxcare of phenx/php-svg-lib.", "vulnerability": { "name": "CVE-2023-50251" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phenx/php-svg-lib@0.3.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phenx/php-svg-lib@0.3.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-25117 is fixed in version 0.3.4-p1+tuxcare of phenx/php-svg-lib.", "vulnerability": { "name": "CVE-2024-25117" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phenx/php-svg-lib@0.3.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phenx/php-svg-lib@0.3.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-97m3-52wr-xvv2 is fixed in version 0.3.4-p1+tuxcare of phenx/php-svg-lib.", "vulnerability": { "name": "GHSA-97m3-52wr-xvv2" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/spamspan@7.1.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/spamspan@7.1.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31687 is fixed in version 7.1.4-p1+tuxcare of drupal/spamspan.", "vulnerability": { "name": "CVE-2025-31687" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/access_code@7.1.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/access_code@7.1.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3129 is fixed in version 7.1.1-p1+tuxcare of drupal/access_code.", "vulnerability": { "name": "CVE-2025-3129" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/form_builder@7.1.22-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/form_builder@7.1.22-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0749 is fixed in version 7.1.22-p1+tuxcare of drupal/form_builder.", "vulnerability": { "name": "CVE-2026-0749" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3838 is fixed in version 1.2.2-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2021-3838" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3902 is fixed in version 1.2.2-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2021-3902" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-0085 is fixed in version 1.2.2-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-0085" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-2400 is fixed in version 1.2.2-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-2400" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28368 does not affect version 1.2.2-p2+tuxcare of dompdf/dompdf. already_fixed \u2014 The target repository already contains the exact fix for CVE-2022-28368. TuxCare applied this fix via commit 81f4dff (PHPELSCVE-193) on December 11, 2025, which implements the identical mitigation as the upstream vendor patch: determining the cached font file extension from the parsed font type rather than from the attacker-controlled URL.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28368" }, "impact_statement": "already_fixed \u2014 The target repository already contains the exact fix for CVE-2022-28368. TuxCare applied this fix via commit 81f4dff (PHPELSCVE-193) on December 11, 2025, which implements the identical mitigation as the upstream vendor patch: determining the cached font file extension from the parsed font type rather than from the attacker-controlled URL." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41343 is fixed in version 1.2.2-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-41343" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23924 is fixed in version 1.2.2-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2023-23924" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50262 is fixed in version 1.2.2-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2023-50262" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55554 is fixed in version 1.2.2-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-55554" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55555 is fixed in version 1.2.2-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-55555" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56722 is fixed in version 1.2.2-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-56722" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59941 is fixed in version 1.2.2-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-59941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59942 is fixed in version 1.2.2-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-59942" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59943 is fixed in version 1.2.2-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-59943" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/illuminate/database@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/illuminate/database@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.4.36-p1+tuxcare of illuminate/database.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/illuminate/database@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/illuminate/database@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 5.4.36-p1+tuxcare of illuminate/database, and is fixed in 5.4.36-p2+tuxcare.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 5.4.36-p1+tuxcare of illuminate/database, and is fixed in 5.4.36-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/spamspan@3.2.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/spamspan@3.2.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31687 is fixed in version 3.2.0-p1+tuxcare of drupal/spamspan.", "vulnerability": { "name": "CVE-2025-31687" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/filefield_paths@7.1.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/filefield_paths@7.1.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1556 is fixed in version 7.1.2-p1+tuxcare of drupal/filefield_paths.", "vulnerability": { "name": "CVE-2026-1556" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/nesbot/carbon@1.26.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/nesbot/carbon@1.26.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-22145 is fixed in version 1.26.6-p1+tuxcare of nesbot/carbon.", "vulnerability": { "name": "CVE-2025-22145" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/gdpr@7.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/gdpr@7.1.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31689 is fixed in version 7.1.0-p1+tuxcare of drupal/gdpr.", "vulnerability": { "name": "CVE-2025-31689" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3838 is fixed in version 1.2.2-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2021-3838" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3902 is fixed in version 1.2.2-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2021-3902" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-0085 is fixed in version 1.2.2-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-0085" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-2400 is fixed in version 1.2.2-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-2400" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28368 does not affect version 1.2.2-p1+tuxcare of dompdf/dompdf. already_fixed \u2014 The target repository already contains the exact fix for CVE-2022-28368. TuxCare applied this fix via commit 81f4dff (PHPELSCVE-193) on December 11, 2025, which implements the identical mitigation as the upstream vendor patch: determining the cached font file extension from the parsed font type rather than from the attacker-controlled URL.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28368" }, "impact_statement": "already_fixed \u2014 The target repository already contains the exact fix for CVE-2022-28368. TuxCare applied this fix via commit 81f4dff (PHPELSCVE-193) on December 11, 2025, which implements the identical mitigation as the upstream vendor patch: determining the cached font file extension from the parsed font type rather than from the attacker-controlled URL." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41343 is fixed in version 1.2.2-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-41343" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23924 is fixed in version 1.2.2-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2023-23924" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50262 is fixed in version 1.2.2-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2023-50262" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55554 affects version 1.2.2-p1+tuxcare of dompdf/dompdf, and is fixed in 1.2.2-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-55554" }, "action_statement": "Vulnerability CVE-2026-55554 affects version 1.2.2-p1+tuxcare of dompdf/dompdf, and is fixed in 1.2.2-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55555 affects version 1.2.2-p1+tuxcare of dompdf/dompdf, and is fixed in 1.2.2-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-55555" }, "action_statement": "Vulnerability CVE-2026-55555 affects version 1.2.2-p1+tuxcare of dompdf/dompdf, and is fixed in 1.2.2-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56722 affects version 1.2.2-p1+tuxcare of dompdf/dompdf, and is fixed in 1.2.2-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-56722" }, "action_statement": "Vulnerability CVE-2026-56722 affects version 1.2.2-p1+tuxcare of dompdf/dompdf, and is fixed in 1.2.2-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59941 affects version 1.2.2-p1+tuxcare of dompdf/dompdf, and is fixed in 1.2.2-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-59941" }, "action_statement": "Vulnerability CVE-2026-59941 affects version 1.2.2-p1+tuxcare of dompdf/dompdf, and is fixed in 1.2.2-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59942 affects version 1.2.2-p1+tuxcare of dompdf/dompdf, and is fixed in 1.2.2-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-59942" }, "action_statement": "Vulnerability CVE-2026-59942 affects version 1.2.2-p1+tuxcare of dompdf/dompdf, and is fixed in 1.2.2-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@1.2.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59943 affects version 1.2.2-p1+tuxcare of dompdf/dompdf, and is fixed in 1.2.2-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-59943" }, "action_statement": "Vulnerability CVE-2026-59943 affects version 1.2.2-p1+tuxcare of dompdf/dompdf, and is fixed in 1.2.2-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-51651 is fixed in version 3.263.4-p1+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "CVE-2023-51651" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14761 affects version 3.263.4-p1+tuxcare of aws/aws-sdk-php, and is fixed in 3.263.4-p3+tuxcare.", "vulnerability": { "name": "CVE-2025-14761" }, "action_statement": "Vulnerability CVE-2025-14761 affects version 3.263.4-p1+tuxcare of aws/aws-sdk-php, and is fixed in 3.263.4-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-27qh-8cxx-2cr5 affects version 3.263.4-p1+tuxcare of aws/aws-sdk-php, and is fixed in 3.263.4-p2+tuxcare.", "vulnerability": { "name": "GHSA-27qh-8cxx-2cr5" }, "action_statement": "Vulnerability GHSA-27qh-8cxx-2cr5 affects version 3.263.4-p1+tuxcare of aws/aws-sdk-php, and is fixed in 3.263.4-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/tfa_basic@7.1.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/tfa_basic@7.1.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6816 is fixed in version 7.1.2-p1+tuxcare of drupal/tfa_basic.", "vulnerability": { "name": "CVE-2026-6816" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/protected_pages@7.2.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/protected_pages@7.2.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-9551 is fixed in version 7.2.4-p1+tuxcare of drupal/protected_pages.", "vulnerability": { "name": "CVE-2025-9551" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.1.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.1.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-24775 is fixed in version 1.1.0-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2022-24775" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.1.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.1.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-29197 is fixed in version 1.1.0-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2023-29197" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.1.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.1.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48998 is fixed in version 1.1.0-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-48998" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.1.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.1.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49214 is fixed in version 1.1.0-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-49214" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.1.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.1.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55766 is fixed in version 1.1.0-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-55766" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.1.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.1.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59882 is fixed in version 1.1.0-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-59882" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2681 affects version 1.12.10-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.12.10-p2+tuxcare.", "vulnerability": { "name": "CVE-2014-2681" }, "action_statement": "Vulnerability CVE-2014-2681 affects version 1.12.10-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.12.10-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2682 affects version 1.12.10-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.12.10-p2+tuxcare.", "vulnerability": { "name": "CVE-2014-2682" }, "action_statement": "Vulnerability CVE-2014-2682 affects version 1.12.10-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.12.10-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2683 affects version 1.12.10-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.12.10-p2+tuxcare.", "vulnerability": { "name": "CVE-2014-2683" }, "action_statement": "Vulnerability CVE-2014-2683 affects version 1.12.10-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.12.10-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-3154 is fixed in version 1.12.10-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-3154" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5161 is fixed in version 1.12.10-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5161" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5723 is fixed in version 1.12.10-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5723" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-7695 is fixed in version 1.12.10-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-7695" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-4861 is fixed in version 1.12.10-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-4861" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-6233 is fixed in version 1.12.10-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-6233" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6fqw-j3vm-7f66 affects version 1.12.10-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.12.10-p2+tuxcare.", "vulnerability": { "name": "GHSA-6fqw-j3vm-7f66" }, "action_statement": "Vulnerability GHSA-6fqw-j3vm-7f66 affects version 1.12.10-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.12.10-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-848f-mph5-9pm9 affects version 1.12.10-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.12.10-p2+tuxcare.", "vulnerability": { "name": "GHSA-848f-mph5-9pm9" }, "action_statement": "Vulnerability GHSA-848f-mph5-9pm9 affects version 1.12.10-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.12.10-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8xhv-gqm4-3w99 affects version 1.12.10-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.12.10-p2+tuxcare.", "vulnerability": { "name": "GHSA-8xhv-gqm4-3w99" }, "action_statement": "Vulnerability GHSA-8xhv-gqm4-3w99 affects version 1.12.10-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.12.10-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gff2-p6vm-3p8g is fixed in version 1.12.10-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-gff2-p6vm-3p8g" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v42g-7q2x-cw32 affects version 1.12.10-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.12.10-p2+tuxcare.", "vulnerability": { "name": "GHSA-v42g-7q2x-cw32" }, "action_statement": "Vulnerability GHSA-v42g-7q2x-cw32 affects version 1.12.10-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.12.10-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/webonyx/graphql-php@v14.11.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/webonyx/graphql-php@v14.11.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40476 is fixed in version v14.11.10-p1+tuxcare of webonyx/graphql-php.", "vulnerability": { "name": "CVE-2026-40476" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/webonyx/graphql-php@v14.11.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/webonyx/graphql-php@v14.11.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-68jq-c3rv-pcrr is fixed in version v14.11.10-p1+tuxcare of webonyx/graphql-php.", "vulnerability": { "name": "GHSA-68jq-c3rv-pcrr" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/webonyx/graphql-php@v14.11.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/webonyx/graphql-php@v14.11.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-fc86-6rv6-2jpm is fixed in version v14.11.10-p1+tuxcare of webonyx/graphql-php.", "vulnerability": { "name": "GHSA-fc86-6rv6-2jpm" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/webonyx/graphql-php@v14.11.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/webonyx/graphql-php@v14.11.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-r7cg-qjjm-xhqq is fixed in version v14.11.10-p1+tuxcare of webonyx/graphql-php.", "vulnerability": { "name": "GHSA-r7cg-qjjm-xhqq" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/flag@7.3.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/flag@7.3.9-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14556 is fixed in version 7.3.9-p1+tuxcare of drupal/flag.", "vulnerability": { "name": "CVE-2025-14556" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/process@5.4.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/process@5.4.45-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51736 is fixed in version 5.4.45-p2+tuxcare of symfony/process.", "vulnerability": { "name": "CVE-2024-51736" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/process@5.4.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/process@5.4.45-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24739 is fixed in version 5.4.45-p2+tuxcare of symfony/process.", "vulnerability": { "name": "CVE-2026-24739" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/process@4.4.44-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/process@4.4.44-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51736 is fixed in version 4.4.44-p1+tuxcare of symfony/process.", "vulnerability": { "name": "CVE-2024-51736" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/process@4.4.44-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/process@4.4.44-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24739 is fixed in version 4.4.44-p1+tuxcare of symfony/process.", "vulnerability": { "name": "CVE-2026-24739" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zend-form@2.1.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zend-form@2.1.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gvpp-6jrj-5pqc is fixed in version 2.1.6-p1+tuxcare of zendframework/zend-form.", "vulnerability": { "name": "GHSA-gvpp-6jrj-5pqc" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zend-session@2.1.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zend-session@2.1.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-96c6-m98x-hxjx is fixed in version 2.1.6-p2+tuxcare of zendframework/zend-session.", "vulnerability": { "name": "GHSA-96c6-m98x-hxjx" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phenx/php-svg-lib@0.4.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phenx/php-svg-lib@0.4.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50251 is fixed in version 0.4.1-p1+tuxcare of phenx/php-svg-lib.", "vulnerability": { "name": "CVE-2023-50251" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phenx/php-svg-lib@0.4.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phenx/php-svg-lib@0.4.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-25117 is fixed in version 0.4.1-p1+tuxcare of phenx/php-svg-lib.", "vulnerability": { "name": "CVE-2024-25117" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phenx/php-svg-lib@0.4.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phenx/php-svg-lib@0.4.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-97m3-52wr-xvv2 is fixed in version 0.4.1-p1+tuxcare of phenx/php-svg-lib.", "vulnerability": { "name": "GHSA-97m3-52wr-xvv2" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3838 is fixed in version 0.8.6-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2021-3838" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3902 is fixed in version 0.8.6-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2021-3902" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-0085 is fixed in version 0.8.6-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-0085" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-2400 is fixed in version 0.8.6-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-2400" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28368 is fixed in version 0.8.6-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-28368" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41343 is fixed in version 0.8.6-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-41343" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23924 is fixed in version 0.8.6-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2023-23924" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50262 is fixed in version 0.8.6-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2023-50262" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55554 is fixed in version 0.8.6-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-55554" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55555 is fixed in version 0.8.6-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-55555" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56722 is fixed in version 0.8.6-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-56722" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59941 is fixed in version 0.8.6-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-59941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59942 is fixed in version 0.8.6-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-59942" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59943 is fixed in version 0.8.6-p2+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-59943" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/monolog/monolog@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/monolog/monolog@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f57v-q966-7fh6 is fixed in version 1.11.0-p1+tuxcare of monolog/monolog.", "vulnerability": { "name": "GHSA-f57v-q966-7fh6" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/doctrine/orm@2.8.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/doctrine/orm@2.8.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-vjrg-wpm8-rhrw is fixed in version 2.8.3-p1+tuxcare of doctrine/orm.", "vulnerability": { "name": "GHSA-vjrg-wpm8-rhrw" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3838 is fixed in version 0.8.6-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2021-3838" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3902 is fixed in version 0.8.6-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2021-3902" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-0085 is fixed in version 0.8.6-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-0085" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-2400 is fixed in version 0.8.6-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-2400" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28368 is fixed in version 0.8.6-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-28368" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41343 is fixed in version 0.8.6-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2022-41343" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23924 is fixed in version 0.8.6-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2023-23924" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50262 is fixed in version 0.8.6-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2023-50262" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55554 affects version 0.8.6-p1+tuxcare of dompdf/dompdf, and is fixed in 0.8.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-55554" }, "action_statement": "Vulnerability CVE-2026-55554 affects version 0.8.6-p1+tuxcare of dompdf/dompdf, and is fixed in 0.8.6-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55555 affects version 0.8.6-p1+tuxcare of dompdf/dompdf, and is fixed in 0.8.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-55555" }, "action_statement": "Vulnerability CVE-2026-55555 affects version 0.8.6-p1+tuxcare of dompdf/dompdf, and is fixed in 0.8.6-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56722 affects version 0.8.6-p1+tuxcare of dompdf/dompdf, and is fixed in 0.8.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-56722" }, "action_statement": "Vulnerability CVE-2026-56722 affects version 0.8.6-p1+tuxcare of dompdf/dompdf, and is fixed in 0.8.6-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59941 affects version 0.8.6-p1+tuxcare of dompdf/dompdf, and is fixed in 0.8.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-59941" }, "action_statement": "Vulnerability CVE-2026-59941 affects version 0.8.6-p1+tuxcare of dompdf/dompdf, and is fixed in 0.8.6-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59942 affects version 0.8.6-p1+tuxcare of dompdf/dompdf, and is fixed in 0.8.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-59942" }, "action_statement": "Vulnerability CVE-2026-59942 affects version 0.8.6-p1+tuxcare of dompdf/dompdf, and is fixed in 0.8.6-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@0.8.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59943 affects version 0.8.6-p1+tuxcare of dompdf/dompdf, and is fixed in 0.8.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-59943" }, "action_statement": "Vulnerability CVE-2026-59943 affects version 0.8.6-p1+tuxcare of dompdf/dompdf, and is fixed in 0.8.6-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/mime@v7.4.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/mime@v7.4.9-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45067 is fixed in version v7.4.9-p1+tuxcare of symfony/mime.", "vulnerability": { "name": "CVE-2026-45067" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/mime@v7.4.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/mime@v7.4.9-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45070 is fixed in version v7.4.9-p1+tuxcare of symfony/mime.", "vulnerability": { "name": "CVE-2026-45070" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.1.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-24775 is fixed in version 1.1.0-p1+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2022-24775" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.1.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-29197 affects version 1.1.0-p1+tuxcare of guzzlehttp/psr7, and is fixed in 1.1.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2023-29197" }, "action_statement": "Vulnerability CVE-2023-29197 affects version 1.1.0-p1+tuxcare of guzzlehttp/psr7, and is fixed in 1.1.0-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.1.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48998 is fixed in version 1.1.0-p1+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-48998" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.1.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49214 is fixed in version 1.1.0-p1+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-49214" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.1.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55766 is fixed in version 1.1.0-p1+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-55766" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.1.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59882 is fixed in version 1.1.0-p1+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-59882" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/swiftmailer/swiftmailer@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/swiftmailer/swiftmailer@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-10074 does not affect version 6.0.2-p1+tuxcare of swiftmailer/swiftmailer. already_fixed \u2014 The target repository (swiftmailer v6.0.2) is NOT vulnerable to CVE-2016-10074. The vulnerable Swift_Transport_MailTransport class was completely removed from the codebase in version 6.0.0, prior to the current version. The security fix was first applied in version 5.4.5 (December 2016), the mail transport was deprecated, and then the entire class was removed in version 6.0.0 (May 2017). The cu...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-10074" }, "impact_statement": "already_fixed \u2014 The target repository (swiftmailer v6.0.2) is NOT vulnerable to CVE-2016-10074. The vulnerable Swift_Transport_MailTransport class was completely removed from the codebase in version 6.0.0, prior to the current version. The security fix was first applied in version 5.4.5 (December 2016), the mail transport was deprecated, and then the entire class was removed in version 6.0.0 (May 2017). The cu..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/swiftmailer/swiftmailer@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/swiftmailer/swiftmailer@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-28859 is fixed in version 6.0.2-p1+tuxcare of swiftmailer/swiftmailer.", "vulnerability": { "name": "CVE-2024-28859" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/gdpr@3.0.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/gdpr@3.0.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-31689 is fixed in version 3.0.0-p1+tuxcare of drupal/gdpr.", "vulnerability": { "name": "CVE-2025-31689" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/mime@v5.4.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/mime@v5.4.45-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45067 is fixed in version v5.4.45-p1+tuxcare of symfony/mime.", "vulnerability": { "name": "CVE-2026-45067" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/mime@v5.4.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/mime@v5.4.45-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45070 is fixed in version v5.4.45-p1+tuxcare of symfony/mime.", "vulnerability": { "name": "CVE-2026-45070" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/i18n@7.1.35-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/i18n@7.1.35-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0748 is fixed in version 7.1.35-p1+tuxcare of drupal/i18n.", "vulnerability": { "name": "CVE-2026-0748" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/illuminate/database@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/illuminate/database@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.4.36-p2+tuxcare of illuminate/database.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/illuminate/database@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/illuminate/database@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.4.36-p2+tuxcare of illuminate/database.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p3+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-51651 is fixed in version 3.263.4-p3+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "CVE-2023-51651" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p3+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14761 is fixed in version 3.263.4-p3+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "CVE-2025-14761" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p3+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-27qh-8cxx-2cr5 is fixed in version 3.263.4-p3+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "GHSA-27qh-8cxx-2cr5" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/yajra/laravel-datatables-oracle@10.11.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/yajra/laravel-datatables-oracle@10.11.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10705 is fixed in version 10.11.4-p1+tuxcare of yajra/laravel-datatables-oracle.", "vulnerability": { "name": "AIKIDO-2025-10705" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2681 is fixed in version 1.12.10-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2681" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2682 is fixed in version 1.12.10-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2682" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2683 is fixed in version 1.12.10-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2683" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-3154 is fixed in version 1.12.10-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-3154" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5161 is fixed in version 1.12.10-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5161" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5723 is fixed in version 1.12.10-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5723" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-7695 is fixed in version 1.12.10-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-7695" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-4861 is fixed in version 1.12.10-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-4861" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-6233 is fixed in version 1.12.10-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-6233" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6fqw-j3vm-7f66 is fixed in version 1.12.10-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-6fqw-j3vm-7f66" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-848f-mph5-9pm9 is fixed in version 1.12.10-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-848f-mph5-9pm9" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8xhv-gqm4-3w99 is fixed in version 1.12.10-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-8xhv-gqm4-3w99" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gff2-p6vm-3p8g is fixed in version 1.12.10-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-gff2-p6vm-3p8g" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.12.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v42g-7q2x-cw32 is fixed in version 1.12.10-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-v42g-7q2x-cw32" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p2+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-51651 is fixed in version 3.263.4-p2+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "CVE-2023-51651" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p2+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14761 affects version 3.263.4-p2+tuxcare of aws/aws-sdk-php, and is fixed in 3.263.4-p3+tuxcare.", "vulnerability": { "name": "CVE-2025-14761" }, "action_statement": "Vulnerability CVE-2025-14761 affects version 3.263.4-p2+tuxcare of aws/aws-sdk-php, and is fixed in 3.263.4-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p2+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-27qh-8cxx-2cr5 is fixed in version 3.263.4-p2+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "GHSA-27qh-8cxx-2cr5" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/mailer@v7.4.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/mailer@v7.4.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45068 is fixed in version v7.4.8-p1+tuxcare of symfony/mailer.", "vulnerability": { "name": "CVE-2026-45068" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/laravel-medialibrary@9.12.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/laravel-medialibrary@9.12.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10189 is fixed in version 9.12.4-p1+tuxcare of spatie/laravel-medialibrary.", "vulnerability": { "name": "AIKIDO-2024-10189" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/spatie/laravel-medialibrary@9.12.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/laravel-medialibrary@9.12.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48555 affects version 9.12.4-p1+tuxcare of spatie/laravel-medialibrary, and is fixed in 9.12.4-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-48555" }, "action_statement": "Vulnerability CVE-2026-48555 affects version 9.12.4-p1+tuxcare of spatie/laravel-medialibrary, and is fixed in 9.12.4-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/spatie/laravel-medialibrary@9.12.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/laravel-medialibrary@9.12.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48557 affects version 9.12.4-p1+tuxcare of spatie/laravel-medialibrary, and is fixed in 9.12.4-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-48557" }, "action_statement": "Vulnerability CVE-2026-48557 affects version 9.12.4-p1+tuxcare of spatie/laravel-medialibrary, and is fixed in 9.12.4-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/process@5.4.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/process@5.4.45-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51736 is fixed in version 5.4.45-p1+tuxcare of symfony/process.", "vulnerability": { "name": "CVE-2024-51736" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/process@5.4.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/process@5.4.45-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24739 affects version 5.4.45-p1+tuxcare of symfony/process, and is fixed in 5.4.45-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-24739" }, "action_statement": "Vulnerability CVE-2026-24739 affects version 5.4.45-p1+tuxcare of symfony/process, and is fixed in 5.4.45-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-30130 is fixed in version 0.3.10-p2+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2021-30130" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-52892 is fixed in version 0.3.10-p2+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2023-52892" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27354 affects version 0.3.10-p2+tuxcare of phpseclib/phpseclib, and is fixed in 0.3.10-p3+tuxcare.", "vulnerability": { "name": "CVE-2024-27354" }, "action_statement": "Vulnerability CVE-2024-27354 affects version 0.3.10-p2+tuxcare of phpseclib/phpseclib, and is fixed in 0.3.10-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27355 does not affect version 0.3.10-p2+tuxcare of phpseclib/phpseclib. already_fixed \u2014 The target repository (phpseclib 0.3.10-p2+tuxcare) already contains a fix for CVE-2024-27355. TuxCare applied a backport in commit f47d51d that limits OID length to 128 bytes, which is stricter than the upstream fix (4096 bytes). This fix addresses both CVE-2024-27355 and its bypass vulnerability CVE-2026-44167.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27355" }, "impact_statement": "already_fixed \u2014 The target repository (phpseclib 0.3.10-p2+tuxcare) already contains a fix for CVE-2024-27355. TuxCare applied a backport in commit f47d51d that limits OID length to 128 bytes, which is stricter than the upstream fix (4096 bytes). This fix addresses both CVE-2024-27355 and its bypass vulnerability CVE-2026-44167." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32935 is fixed in version 0.3.10-p2+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2026-32935" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40194 is fixed in version 0.3.10-p2+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2026-40194" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44167 is fixed in version 0.3.10-p2+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2026-44167" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55599 does not affect version 0.3.10-p2+tuxcare of phpseclib/phpseclib. not_affected \u2014 CVE-2026-55599 (SSRF via AIA URL fetching) does not affect phpseclib version 0.3.10. The vulnerable AIA URL fetching feature (testForIntermediate() calling fetchURL() with fsockopen()) was introduced in later versions (3.x/4.x) and does not exist in this older codebase. While the target parses AIA extensions, it never acts on the URL data to make network connections.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55599" }, "impact_statement": "not_affected \u2014 CVE-2026-55599 (SSRF via AIA URL fetching) does not affect phpseclib version 0.3.10. The vulnerable AIA URL fetching feature (testForIntermediate() calling fetchURL() with fsockopen()) was introduced in later versions (3.x/4.x) and does not exist in this older codebase. While the target parses AIA extensions, it never acts on the URL data to make network connections." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84308 does not affect version 0.3.10-p2+tuxcare of phpseclib/phpseclib. not_affected \u2014 The target repository (phpseclib 0.3.10-p3+tuxcare) is not affected by CVE-2026-84308. This CVE targets a timing side-channel vulnerability in phpseclib 3.0.56's pure-PHP X25519/Curve25519 elliptic curve implementation. Version 0.3.10 predates elliptic curve cryptography support entirely and does not contain any of the vulnerable code paths, classes, or operations described in the CVE. Exhausti...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84308" }, "impact_statement": "not_affected \u2014 The target repository (phpseclib 0.3.10-p3+tuxcare) is not affected by CVE-2026-84308. This CVE targets a timing side-channel vulnerability in phpseclib 3.0.56's pure-PHP X25519/Curve25519 elliptic curve implementation. Version 0.3.10 predates elliptic curve cryptography support entirely and does not contain any of the vulnerable code paths, classes, or operations described in the CVE. Exhausti..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-m557-wrgg-6rp4 does not affect version 0.3.10-p2+tuxcare of phpseclib/phpseclib. not_affected \u2014 phpseclib version 0.3.10-p2+tuxcare is not affected by the SSRF vulnerability (GHSA-m557-wrgg-6rp4). The vulnerable URL fetching functionality introduced in later versions (3.0.x, 4.0.x) does not exist in this legacy 0.3.x branch. While the target can parse AIA extensions from certificates, no code path uses these extensions to make network connections during certificate validation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-m557-wrgg-6rp4" }, "impact_statement": "not_affected \u2014 phpseclib version 0.3.10-p2+tuxcare is not affected by the SSRF vulnerability (GHSA-m557-wrgg-6rp4). The vulnerable URL fetching functionality introduced in later versions (3.0.x, 4.0.x) does not exist in this legacy 0.3.x branch. While the target can parse AIA extensions from certificates, no code path uses these extensions to make network connections during certificate validation." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/webform_multifile@7.1.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/webform_multifile@7.1.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-12848 is fixed in version 7.1.6-p1+tuxcare of drupal/webform_multifile.", "vulnerability": { "name": "CVE-2025-12848" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/laravel-medialibrary@10.15.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/laravel-medialibrary@10.15.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10189 is fixed in version 10.15.0-p2+tuxcare of spatie/laravel-medialibrary.", "vulnerability": { "name": "AIKIDO-2024-10189" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/laravel-medialibrary@10.15.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/laravel-medialibrary@10.15.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48555 is fixed in version 10.15.0-p2+tuxcare of spatie/laravel-medialibrary.", "vulnerability": { "name": "CVE-2026-48555" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/laravel-medialibrary@10.15.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/laravel-medialibrary@10.15.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48557 is fixed in version 10.15.0-p2+tuxcare of spatie/laravel-medialibrary.", "vulnerability": { "name": "CVE-2026-48557" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/gdpr@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/gdpr@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31689 is fixed in version 3.1.0-p1+tuxcare of drupal/gdpr.", "vulnerability": { "name": "CVE-2025-31689" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-30130 is fixed in version 0.3.10-p3+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2021-30130" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-52892 is fixed in version 0.3.10-p3+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2023-52892" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27354 is fixed in version 0.3.10-p3+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2024-27354" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27355 does not affect version 0.3.10-p3+tuxcare of phpseclib/phpseclib. already_fixed \u2014 The target repository (phpseclib 0.3.10-p2+tuxcare) already contains a fix for CVE-2024-27355. TuxCare applied a backport in commit f47d51d that limits OID length to 128 bytes, which is stricter than the upstream fix (4096 bytes). This fix addresses both CVE-2024-27355 and its bypass vulnerability CVE-2026-44167.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27355" }, "impact_statement": "already_fixed \u2014 The target repository (phpseclib 0.3.10-p2+tuxcare) already contains a fix for CVE-2024-27355. TuxCare applied a backport in commit f47d51d that limits OID length to 128 bytes, which is stricter than the upstream fix (4096 bytes). This fix addresses both CVE-2024-27355 and its bypass vulnerability CVE-2026-44167." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32935 is fixed in version 0.3.10-p3+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2026-32935" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40194 is fixed in version 0.3.10-p3+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2026-40194" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44167 is fixed in version 0.3.10-p3+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2026-44167" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55599 does not affect version 0.3.10-p3+tuxcare of phpseclib/phpseclib. not_affected \u2014 CVE-2026-55599 (SSRF via AIA URL fetching) does not affect phpseclib version 0.3.10. The vulnerable AIA URL fetching feature (testForIntermediate() calling fetchURL() with fsockopen()) was introduced in later versions (3.x/4.x) and does not exist in this older codebase. While the target parses AIA extensions, it never acts on the URL data to make network connections.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55599" }, "impact_statement": "not_affected \u2014 CVE-2026-55599 (SSRF via AIA URL fetching) does not affect phpseclib version 0.3.10. The vulnerable AIA URL fetching feature (testForIntermediate() calling fetchURL() with fsockopen()) was introduced in later versions (3.x/4.x) and does not exist in this older codebase. While the target parses AIA extensions, it never acts on the URL data to make network connections." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84308 does not affect version 0.3.10-p3+tuxcare of phpseclib/phpseclib. not_affected \u2014 The target repository (phpseclib 0.3.10-p3+tuxcare) is not affected by CVE-2026-84308. This CVE targets a timing side-channel vulnerability in phpseclib 3.0.56's pure-PHP X25519/Curve25519 elliptic curve implementation. Version 0.3.10 predates elliptic curve cryptography support entirely and does not contain any of the vulnerable code paths, classes, or operations described in the CVE. Exhausti...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84308" }, "impact_statement": "not_affected \u2014 The target repository (phpseclib 0.3.10-p3+tuxcare) is not affected by CVE-2026-84308. This CVE targets a timing side-channel vulnerability in phpseclib 3.0.56's pure-PHP X25519/Curve25519 elliptic curve implementation. Version 0.3.10 predates elliptic curve cryptography support entirely and does not contain any of the vulnerable code paths, classes, or operations described in the CVE. Exhausti..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-m557-wrgg-6rp4 does not affect version 0.3.10-p3+tuxcare of phpseclib/phpseclib. not_affected \u2014 phpseclib version 0.3.10-p2+tuxcare is not affected by the SSRF vulnerability (GHSA-m557-wrgg-6rp4). The vulnerable URL fetching functionality introduced in later versions (3.0.x, 4.0.x) does not exist in this legacy 0.3.x branch. While the target can parse AIA extensions from certificates, no code path uses these extensions to make network connections during certificate validation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-m557-wrgg-6rp4" }, "impact_statement": "not_affected \u2014 phpseclib version 0.3.10-p2+tuxcare is not affected by the SSRF vulnerability (GHSA-m557-wrgg-6rp4). The vulnerable URL fetching functionality introduced in later versions (3.0.x, 4.0.x) does not exist in this legacy 0.3.x branch. While the target can parse AIA extensions from certificates, no code path uses these extensions to make network connections during certificate validation." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/illuminate/database@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/illuminate/database@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.4.36-p3+tuxcare of illuminate/database.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/illuminate/database@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/illuminate/database@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.4.36-p3+tuxcare of illuminate/database.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.4.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.4.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-24775 is fixed in version 1.4.2-p1+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2022-24775" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.4.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.4.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-29197 does not affect version 1.4.2-p1+tuxcare of guzzlehttp/psr7. Version 1.4.2 is not vulnerable. Summary: CVE-2023-29197 does NOT affect version 1.4.2. The vulnerable code (header validation regex without /D modifier) was introduced ~3 years AFTER this version (in commit 092dbc2 on 2020-01-09, first appearing in version 2.0.0). Version 1.4.2 predates the introduction of the assertHeader() and assertValue() validation methods entirely. Since the vulnerable code pattern was never present in this version, it is not vulnerable to this specific CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-29197" }, "impact_statement": "Version 1.4.2 is not vulnerable. Summary: CVE-2023-29197 does NOT affect version 1.4.2. The vulnerable code (header validation regex without /D modifier) was introduced ~3 years AFTER this version (in commit 092dbc2 on 2020-01-09, first appearing in version 2.0.0). Version 1.4.2 predates the introduction of the assertHeader() and assertValue() validation methods entirely. Since the vulnerable code pattern was never present in this version, it is not vulnerable to this specific CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.4.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.4.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48998 affects version 1.4.2-p1+tuxcare of guzzlehttp/psr7, and is fixed in 1.4.2-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-48998" }, "action_statement": "Vulnerability CVE-2026-48998 affects version 1.4.2-p1+tuxcare of guzzlehttp/psr7, and is fixed in 1.4.2-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.4.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.4.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49214 is fixed in version 1.4.2-p1+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-49214" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.4.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.4.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55766 is fixed in version 1.4.2-p1+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-55766" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.4.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.4.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59882 affects version 1.4.2-p1+tuxcare of guzzlehttp/psr7, and is fixed in 1.4.2-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-59882" }, "action_statement": "Vulnerability CVE-2026-59882 affects version 1.4.2-p1+tuxcare of guzzlehttp/psr7, and is fixed in 1.4.2-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-30130 is fixed in version 0.3.10-p1+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2021-30130" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-52892 is fixed in version 0.3.10-p1+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2023-52892" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27354 affects version 0.3.10-p1+tuxcare of phpseclib/phpseclib, and is fixed in 0.3.10-p3+tuxcare.", "vulnerability": { "name": "CVE-2024-27354" }, "action_statement": "Vulnerability CVE-2024-27354 affects version 0.3.10-p1+tuxcare of phpseclib/phpseclib, and is fixed in 0.3.10-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27355 does not affect version 0.3.10-p1+tuxcare of phpseclib/phpseclib. already_fixed \u2014 The target repository (phpseclib 0.3.10-p2+tuxcare) already contains a fix for CVE-2024-27355. TuxCare applied a backport in commit f47d51d that limits OID length to 128 bytes, which is stricter than the upstream fix (4096 bytes). This fix addresses both CVE-2024-27355 and its bypass vulnerability CVE-2026-44167.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27355" }, "impact_statement": "already_fixed \u2014 The target repository (phpseclib 0.3.10-p2+tuxcare) already contains a fix for CVE-2024-27355. TuxCare applied a backport in commit f47d51d that limits OID length to 128 bytes, which is stricter than the upstream fix (4096 bytes). This fix addresses both CVE-2024-27355 and its bypass vulnerability CVE-2026-44167." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32935 is fixed in version 0.3.10-p1+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2026-32935" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40194 affects version 0.3.10-p1+tuxcare of phpseclib/phpseclib, and is fixed in 0.3.10-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-40194" }, "action_statement": "Vulnerability CVE-2026-40194 affects version 0.3.10-p1+tuxcare of phpseclib/phpseclib, and is fixed in 0.3.10-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44167 is fixed in version 0.3.10-p1+tuxcare of phpseclib/phpseclib.", "vulnerability": { "name": "CVE-2026-44167" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55599 does not affect version 0.3.10-p1+tuxcare of phpseclib/phpseclib. not_affected \u2014 CVE-2026-55599 (SSRF via AIA URL fetching) does not affect phpseclib version 0.3.10. The vulnerable AIA URL fetching feature (testForIntermediate() calling fetchURL() with fsockopen()) was introduced in later versions (3.x/4.x) and does not exist in this older codebase. While the target parses AIA extensions, it never acts on the URL data to make network connections.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55599" }, "impact_statement": "not_affected \u2014 CVE-2026-55599 (SSRF via AIA URL fetching) does not affect phpseclib version 0.3.10. The vulnerable AIA URL fetching feature (testForIntermediate() calling fetchURL() with fsockopen()) was introduced in later versions (3.x/4.x) and does not exist in this older codebase. While the target parses AIA extensions, it never acts on the URL data to make network connections." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84308 does not affect version 0.3.10-p1+tuxcare of phpseclib/phpseclib. not_affected \u2014 The target repository (phpseclib 0.3.10-p3+tuxcare) is not affected by CVE-2026-84308. This CVE targets a timing side-channel vulnerability in phpseclib 3.0.56's pure-PHP X25519/Curve25519 elliptic curve implementation. Version 0.3.10 predates elliptic curve cryptography support entirely and does not contain any of the vulnerable code paths, classes, or operations described in the CVE. Exhausti...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-84308" }, "impact_statement": "not_affected \u2014 The target repository (phpseclib 0.3.10-p3+tuxcare) is not affected by CVE-2026-84308. This CVE targets a timing side-channel vulnerability in phpseclib 3.0.56's pure-PHP X25519/Curve25519 elliptic curve implementation. Version 0.3.10 predates elliptic curve cryptography support entirely and does not contain any of the vulnerable code paths, classes, or operations described in the CVE. Exhausti..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpseclib/phpseclib@0.3.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-m557-wrgg-6rp4 does not affect version 0.3.10-p1+tuxcare of phpseclib/phpseclib. not_affected \u2014 phpseclib version 0.3.10-p2+tuxcare is not affected by the SSRF vulnerability (GHSA-m557-wrgg-6rp4). The vulnerable URL fetching functionality introduced in later versions (3.0.x, 4.0.x) does not exist in this legacy 0.3.x branch. While the target can parse AIA extensions from certificates, no code path uses these extensions to make network connections during certificate validation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-m557-wrgg-6rp4" }, "impact_statement": "not_affected \u2014 phpseclib version 0.3.10-p2+tuxcare is not affected by the SSRF vulnerability (GHSA-m557-wrgg-6rp4). The vulnerable URL fetching functionality introduced in later versions (3.0.x, 4.0.x) does not exist in this legacy 0.3.x branch. While the target can parse AIA extensions from certificates, no code path uses these extensions to make network connections during certificate validation." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laminas/laminas-http@2.5.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laminas/laminas-http@2.5.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3007 is fixed in version 2.5.6-p1+tuxcare of laminas/laminas-http.", "vulnerability": { "name": "CVE-2021-3007" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.4.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.4.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-24775 is fixed in version 1.4.2-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2022-24775" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.4.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.4.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-29197 does not affect version 1.4.2-p2+tuxcare of guzzlehttp/psr7. Version 1.4.2 is not vulnerable. Summary: CVE-2023-29197 does NOT affect version 1.4.2. The vulnerable code (header validation regex without /D modifier) was introduced ~3 years AFTER this version (in commit 092dbc2 on 2020-01-09, first appearing in version 2.0.0). Version 1.4.2 predates the introduction of the assertHeader() and assertValue() validation methods entirely. Since the vulnerable code pattern was never present in this version, it is not vulnerable to this specific CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-29197" }, "impact_statement": "Version 1.4.2 is not vulnerable. Summary: CVE-2023-29197 does NOT affect version 1.4.2. The vulnerable code (header validation regex without /D modifier) was introduced ~3 years AFTER this version (in commit 092dbc2 on 2020-01-09, first appearing in version 2.0.0). Version 1.4.2 predates the introduction of the assertHeader() and assertValue() validation methods entirely. Since the vulnerable code pattern was never present in this version, it is not vulnerable to this specific CVE." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.4.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.4.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48998 is fixed in version 1.4.2-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-48998" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.4.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.4.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49214 is fixed in version 1.4.2-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-49214" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.4.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.4.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55766 is fixed in version 1.4.2-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-55766" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.4.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.4.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59882 is fixed in version 1.4.2-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-59882" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/shs@7.1.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/shs@7.1.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4929 is fixed in version 7.1.10-p1+tuxcare of drupal/shs.", "vulnerability": { "name": "CVE-2026-4929" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/coffee@7.2.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/coffee@7.2.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-13247 is fixed in version 7.2.3-p1+tuxcare of drupal/coffee.", "vulnerability": { "name": "CVE-2024-13247" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/swiftmailer/swiftmailer@5.4.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/swiftmailer/swiftmailer@5.4.12-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-10074 does not affect version 5.4.12-p1+tuxcare of swiftmailer/swiftmailer. already_fixed \u2014 CVE-2016-10074 has already been fixed in target version 5.4.12. The vulnerability allowed command injection via backslash double quote sequences in email addresses. The fix is explicitly present in Swift_Transport_MailTransport class with the _isShellSafe() validation method that blocks shell-unsafe characters including backslash and double quote before passing email addresses to the mail() com...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-10074" }, "impact_statement": "already_fixed \u2014 CVE-2016-10074 has already been fixed in target version 5.4.12. The vulnerability allowed command injection via backslash double quote sequences in email addresses. The fix is explicitly present in Swift_Transport_MailTransport class with the _isShellSafe() validation method that blocks shell-unsafe characters including backslash and double quote before passing email addresses to the mail() com..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/swiftmailer/swiftmailer@5.4.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/swiftmailer/swiftmailer@5.4.12-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-28859 is fixed in version 5.4.12-p1+tuxcare of swiftmailer/swiftmailer.", "vulnerability": { "name": "CVE-2024-28859" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/link@7.1.13-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/link@7.1.13-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 7.1.13-p1+tuxcare of drupal/link.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/process@3.4.47-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/process@3.4.47-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51736 is fixed in version 3.4.47-p1+tuxcare of symfony/process.", "vulnerability": { "name": "CVE-2024-51736" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/process@3.4.47-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/process@3.4.47-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24739 is fixed in version 3.4.47-p1+tuxcare of symfony/process.", "vulnerability": { "name": "CVE-2026-24739" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/colorbox@2.1.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/colorbox@2.1.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3900 is fixed in version 2.1.2-p1+tuxcare of drupal/colorbox.", "vulnerability": { "name": "CVE-2025-3900" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/mime@v6.4.37-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/mime@v6.4.37-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45067 is fixed in version v6.4.37-p1+tuxcare of symfony/mime.", "vulnerability": { "name": "CVE-2026-45067" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/mime@v6.4.37-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/mime@v6.4.37-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45070 affects version v6.4.37-p1+tuxcare of symfony/mime, and is fixed in v6.4.37-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-45070" }, "action_statement": "Vulnerability CVE-2026-45070 affects version v6.4.37-p1+tuxcare of symfony/mime, and is fixed in v6.4.37-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/mailer@v6.4.34-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/mailer@v6.4.34-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45068 is fixed in version v6.4.34-p1+tuxcare of symfony/mailer.", "vulnerability": { "name": "CVE-2026-45068" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/colorbox@7.2.19-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/colorbox@7.2.19-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3900 is fixed in version 7.2.19-p1+tuxcare of drupal/colorbox.", "vulnerability": { "name": "CVE-2025-3900" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/illuminate/view@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/illuminate/view@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.4.36-p1+tuxcare of illuminate/view.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/yajra/laravel-datatables-oracle@9.21.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/yajra/laravel-datatables-oracle@9.21.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10705 is fixed in version 9.21.2-p1+tuxcare of yajra/laravel-datatables-oracle.", "vulnerability": { "name": "AIKIDO-2025-10705" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/erusev/parsedown@1.6.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/erusev/parsedown@1.6.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2018-1000162 is fixed in version 1.6.4-p1+tuxcare of erusev/parsedown.", "vulnerability": { "name": "CVE-2018-1000162" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/erusev/parsedown@1.6.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/erusev/parsedown@1.6.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2019-10905 does not affect version 1.6.4-p1+tuxcare of erusev/parsedown. Version 1.6.x is NOT affected by CVE-2019-10905. The vulnerability exists only in versions 1.7.0\u20131.7.1 which used a permissive regex pattern ([^`]+)? that captures spaces in code fence infostrings. Version 1.6.x uses the restrictive pattern ([\\w-]+)? that rejects lines with spaces, preventing the attack chain from completing. The regex at line 399 fails to match infostrings like \"javascript extra\", so no code block is created and no class injection occurs. Python regex testing confirms this behavior. The patch commit message \"[1.7.x] Fix spaces in class names\" indicates the fix targets the 1.7.x branch specifically.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-10905" }, "impact_statement": "Version 1.6.x is NOT affected by CVE-2019-10905. The vulnerability exists only in versions 1.7.0\u20131.7.1 which used a permissive regex pattern ([^`]+)? that captures spaces in code fence infostrings. Version 1.6.x uses the restrictive pattern ([\\w-]+)? that rejects lines with spaces, preventing the attack chain from completing. The regex at line 399 fails to match infostrings like \"javascript extra\", so no code block is created and no class injection occurs. Python regex testing confirms this behavior. The patch commit message \"[1.7.x] Fix spaces in class names\" indicates the fix targets the 1.7.x branch specifically." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/polyfill-intl-idn@v1.30.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/polyfill-intl-idn@v1.30.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46644 is fixed in version v1.30.0-p1+tuxcare of symfony/polyfill-intl-idn.", "vulnerability": { "name": "CVE-2026-46644" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/process@6.4.13-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/process@6.4.13-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51736 is fixed in version 6.4.13-p2+tuxcare of symfony/process.", "vulnerability": { "name": "CVE-2024-51736" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/process@6.4.13-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/process@6.4.13-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24739 is fixed in version 6.4.13-p2+tuxcare of symfony/process.", "vulnerability": { "name": "CVE-2026-24739" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/bootstrap_site_alert@7.1.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/bootstrap_site_alert@7.1.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3901 is fixed in version 7.1.6-p1+tuxcare of drupal/bootstrap_site_alert.", "vulnerability": { "name": "CVE-2025-3901" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/openid_connect@7.1.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/openid_connect@7.1.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3530 is fixed in version 7.1.3-p1+tuxcare of drupal/openid_connect.", "vulnerability": { "name": "CVE-2026-3530" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/openid_connect@7.1.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/openid_connect@7.1.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3531 is fixed in version 7.1.3-p1+tuxcare of drupal/openid_connect.", "vulnerability": { "name": "CVE-2026-3531" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/openid_connect@7.1.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/openid_connect@7.1.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3532 is fixed in version 7.1.3-p1+tuxcare of drupal/openid_connect.", "vulnerability": { "name": "CVE-2026-3532" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/mime@v6.4.37-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/mime@v6.4.37-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45067 is fixed in version v6.4.37-p2+tuxcare of symfony/mime.", "vulnerability": { "name": "CVE-2026-45067" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/mime@v6.4.37-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/mime@v6.4.37-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45070 is fixed in version v6.4.37-p2+tuxcare of symfony/mime.", "vulnerability": { "name": "CVE-2026-45070" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laminas/laminas-diactoros@1.8.7p2-1+tuxcare", "identifiers": { "purl": "pkg:composer/laminas/laminas-diactoros@1.8.7p2-1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31109 is fixed in version 1.8.7p2-1+tuxcare of laminas/laminas-diactoros.", "vulnerability": { "name": "CVE-2022-31109" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laminas/laminas-diactoros@1.8.7p2-1+tuxcare", "identifiers": { "purl": "pkg:composer/laminas/laminas-diactoros@1.8.7p2-1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-29530 is fixed in version 1.8.7p2-1+tuxcare of laminas/laminas-diactoros.", "vulnerability": { "name": "CVE-2023-29530" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/facebook_pixel@7.1.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/facebook_pixel@7.1.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14557 is fixed in version 7.1.1-p1+tuxcare of drupal/facebook_pixel.", "vulnerability": { "name": "CVE-2025-14557" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/laravel-medialibrary@10.15.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/laravel-medialibrary@10.15.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10189 is fixed in version 10.15.0-p1+tuxcare of spatie/laravel-medialibrary.", "vulnerability": { "name": "AIKIDO-2024-10189" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/spatie/laravel-medialibrary@10.15.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/laravel-medialibrary@10.15.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48555 affects version 10.15.0-p1+tuxcare of spatie/laravel-medialibrary, and is fixed in 10.15.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-48555" }, "action_statement": "Vulnerability CVE-2026-48555 affects version 10.15.0-p1+tuxcare of spatie/laravel-medialibrary, and is fixed in 10.15.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/spatie/laravel-medialibrary@10.15.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/laravel-medialibrary@10.15.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48557 affects version 10.15.0-p1+tuxcare of spatie/laravel-medialibrary, and is fixed in 10.15.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-48557" }, "action_statement": "Vulnerability CVE-2026-48557 affects version 10.15.0-p1+tuxcare of spatie/laravel-medialibrary, and is fixed in 10.15.0-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/nesbot/carbon@1.39.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/nesbot/carbon@1.39.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-22145 is fixed in version 1.39.1-p1+tuxcare of nesbot/carbon.", "vulnerability": { "name": "CVE-2025-22145" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/saloonphp/saloon@3.15.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/saloonphp/saloon@3.15.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33182 is fixed in version 3.15.0-p1+tuxcare of saloonphp/saloon.", "vulnerability": { "name": "CVE-2026-33182" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/saloonphp/saloon@3.15.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/saloonphp/saloon@3.15.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33183 is fixed in version 3.15.0-p1+tuxcare of saloonphp/saloon.", "vulnerability": { "name": "CVE-2026-33183" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/saloonphp/saloon@3.15.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/saloonphp/saloon@3.15.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33942 is fixed in version 3.15.0-p1+tuxcare of saloonphp/saloon.", "vulnerability": { "name": "CVE-2026-33942" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/process@6.4.13-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/process@6.4.13-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51736 is fixed in version 6.4.13-p1+tuxcare of symfony/process.", "vulnerability": { "name": "CVE-2024-51736" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/process@6.4.13-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/process@6.4.13-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24739 affects version 6.4.13-p1+tuxcare of symfony/process, and is fixed in 6.4.13-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-24739" }, "action_statement": "Vulnerability CVE-2026-24739 affects version 6.4.13-p1+tuxcare of symfony/process, and is fixed in 6.4.13-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/term_reference_tree@7.1.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/term_reference_tree@7.1.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4093 is fixed in version 7.1.11-p1+tuxcare of drupal/term_reference_tree.", "vulnerability": { "name": "CVE-2026-4093" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpmailer/phpmailer@5.2.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpmailer/phpmailer@5.2.28-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-13625 is fixed in version 5.2.28-p1+tuxcare of phpmailer/phpmailer.", "vulnerability": { "name": "CVE-2020-13625" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpmailer/phpmailer@5.2.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpmailer/phpmailer@5.2.28-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-34551 is fixed in version 5.2.28-p1+tuxcare of phpmailer/phpmailer.", "vulnerability": { "name": "CVE-2021-34551" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpmailer/phpmailer@5.2.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpmailer/phpmailer@5.2.28-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3603 is fixed in version 5.2.28-p1+tuxcare of phpmailer/phpmailer.", "vulnerability": { "name": "CVE-2021-3603" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/commerce_paybox@7.1.5-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/commerce_paybox@7.1.5-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0750 is fixed in version 7.1.5-p1+tuxcare of drupal/commerce_paybox.", "vulnerability": { "name": "CVE-2026-0750" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework@2.4.13-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework@2.4.13-p2+tuxcare" } } ], "timestamp": "2026-10-01T16:30:35.351580+00:00", "status_notes": "Vulnerability CVE-2021-3007 is fixed in version 2.4.13-p2+tuxcare of zendframework/zendframework.", "vulnerability": { "name": "CVE-2021-3007" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework@2.4.13-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework@2.4.13-p2+tuxcare" } } ], "timestamp": "2026-10-01T16:30:35.351580+00:00", "status_notes": "Vulnerability GHSA-fh7r-58q4-6387 is fixed in version 2.4.13-p2+tuxcare of zendframework/zendframework.", "vulnerability": { "name": "GHSA-fh7r-58q4-6387" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework@2.4.13-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework@2.4.13-p2+tuxcare" } } ], "timestamp": "2026-10-01T16:30:35.351580+00:00", "status_notes": "Vulnerability GHSA-gff2-p6vm-3p8g does not affect version 2.4.13-p2+tuxcare of zendframework/zendframework. GHSA-gff2-p6vm-3p8g is fixed in 2.4.11 (per https://github.com/advisories/GHSA-gff2-p6vm-3p8g); this VPV targets 2.4.13 which already includes the fix \u2014 not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-gff2-p6vm-3p8g" }, "impact_statement": "GHSA-gff2-p6vm-3p8g is fixed in 2.4.11 (per https://github.com/advisories/GHSA-gff2-p6vm-3p8g); this VPV targets 2.4.13 which already includes the fix \u2014 not affected." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework@2.4.13-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework@2.4.13-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3007 is fixed in version 2.4.13-p1+tuxcare of zendframework/zendframework.", "vulnerability": { "name": "CVE-2021-3007" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework@2.4.13-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework@2.4.13-p1+tuxcare" } } ], "timestamp": "2026-10-01T16:30:35.351580+00:00", "status_notes": "Vulnerability GHSA-fh7r-58q4-6387 affects version 2.4.13-p1+tuxcare of zendframework/zendframework, and is fixed in 2.4.13-p2+tuxcare.", "vulnerability": { "name": "GHSA-fh7r-58q4-6387" }, "action_statement": "Vulnerability GHSA-fh7r-58q4-6387 affects version 2.4.13-p1+tuxcare of zendframework/zendframework, and is fixed in 2.4.13-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework@2.4.13-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework@2.4.13-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gff2-p6vm-3p8g does not affect version 2.4.13-p1+tuxcare of zendframework/zendframework. GHSA-gff2-p6vm-3p8g is fixed in 2.4.11 (per https://github.com/advisories/GHSA-gff2-p6vm-3p8g); this VPV targets 2.4.13 which already includes the fix \u2014 not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-gff2-p6vm-3p8g" }, "impact_statement": "GHSA-gff2-p6vm-3p8g is fixed in 2.4.11 (per https://github.com/advisories/GHSA-gff2-p6vm-3p8g); this VPV targets 2.4.13 which already includes the fix \u2014 not affected." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/mobiledetect/mobiledetectlib@2.8.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/mobiledetect/mobiledetectlib@2.8.12-p1+tuxcare" } } ], "timestamp": "2026-10-01T15:25:17.861384+00:00", "status_notes": "Vulnerability CVE-2018-25080 is fixed in version 2.8.12-p1+tuxcare of mobiledetect/mobiledetectlib.", "vulnerability": { "name": "CVE-2018-25080" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/livewire/livewire@3.6.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/livewire/livewire@3.6.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54068 is fixed in version 3.6.3-p1+tuxcare of livewire/livewire.", "vulnerability": { "name": "CVE-2025-54068" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/livewire/livewire@3.6.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/livewire/livewire@3.6.3-p1+tuxcare" } } ], "timestamp": "2026-10-01T15:25:17.861384+00:00", "status_notes": "Vulnerability CVE-2026-81887 affects version 3.6.3-p1+tuxcare of livewire/livewire, and is fixed in 3.6.3-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-81887" }, "action_statement": "Vulnerability CVE-2026-81887 affects version 3.6.3-p1+tuxcare of livewire/livewire, and is fixed in 3.6.3-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/livewire/livewire@3.6.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/livewire/livewire@3.6.3-p2+tuxcare" } } ], "timestamp": "2026-10-01T15:25:17.861384+00:00", "status_notes": "Vulnerability CVE-2025-54068 is fixed in version 3.6.3-p2+tuxcare of livewire/livewire.", "vulnerability": { "name": "CVE-2025-54068" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/livewire/livewire@3.6.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/livewire/livewire@3.6.3-p2+tuxcare" } } ], "timestamp": "2026-10-01T15:25:17.861384+00:00", "status_notes": "Vulnerability CVE-2026-81887 is fixed in version 3.6.3-p2+tuxcare of livewire/livewire.", "vulnerability": { "name": "CVE-2026-81887" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/flysystem@1.1.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/flysystem@1.1.10-p2+tuxcare" } } ], "timestamp": "2026-10-11T18:15:00.090336+00:00", "status_notes": "Vulnerability CVE-2021-32708 is fixed in version 1.1.10-p2+tuxcare of league/flysystem.", "vulnerability": { "name": "CVE-2021-32708" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/flysystem@1.1.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/flysystem@1.1.10-p2+tuxcare" } } ], "timestamp": "2026-10-11T18:15:00.090336+00:00", "status_notes": "Vulnerability CVE-2026-102601 is fixed in version 1.1.10-p2+tuxcare of league/flysystem.", "vulnerability": { "name": "CVE-2026-102601" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/flysystem@1.1.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/flysystem@1.1.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-32708 is fixed in version 1.1.10-p1+tuxcare of league/flysystem.", "vulnerability": { "name": "CVE-2021-32708" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/flysystem@1.1.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/flysystem@1.1.10-p1+tuxcare" } } ], "timestamp": "2026-10-11T18:15:00.090336+00:00", "status_notes": "Vulnerability CVE-2026-102601 affects version 1.1.10-p1+tuxcare of league/flysystem, and is fixed in 1.1.10-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-102601" }, "action_statement": "Vulnerability CVE-2026-102601 affects version 1.1.10-p1+tuxcare of league/flysystem, and is fixed in 1.1.10-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/flysystem@1.0.70-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/flysystem@1.0.70-p2+tuxcare" } } ], "timestamp": "2026-10-11T18:13:00.086979+00:00", "status_notes": "Vulnerability CVE-2021-32708 is fixed in version 1.0.70-p2+tuxcare of league/flysystem.", "vulnerability": { "name": "CVE-2021-32708" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/flysystem@1.0.70-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/flysystem@1.0.70-p2+tuxcare" } } ], "timestamp": "2026-10-11T18:13:00.086979+00:00", "status_notes": "Vulnerability CVE-2026-102601 is fixed in version 1.0.70-p2+tuxcare of league/flysystem.", "vulnerability": { "name": "CVE-2026-102601" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/flysystem@1.0.70-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/flysystem@1.0.70-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-32708 is fixed in version 1.0.70-p1+tuxcare of league/flysystem.", "vulnerability": { "name": "CVE-2021-32708" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/flysystem@1.0.70-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/flysystem@1.0.70-p1+tuxcare" } } ], "timestamp": "2026-10-11T18:13:00.086979+00:00", "status_notes": "Vulnerability CVE-2026-102601 affects version 1.0.70-p1+tuxcare of league/flysystem, and is fixed in 1.0.70-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-102601" }, "action_statement": "Vulnerability CVE-2026-102601 affects version 1.0.70-p1+tuxcare of league/flysystem, and is fixed in 1.0.70-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/livewire/livewire@v3.6.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/livewire/livewire@v3.6.3-p2+tuxcare" } } ], "timestamp": "2026-10-12T12:01:00.095182+00:00", "status_notes": "Vulnerability CVE-2025-54068 is fixed in version v3.6.3-p2+tuxcare of livewire/livewire.", "vulnerability": { "name": "CVE-2025-54068" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/livewire/livewire@v3.6.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/livewire/livewire@v3.6.3-p2+tuxcare" } } ], "timestamp": "2026-10-12T12:01:00.095182+00:00", "status_notes": "Vulnerability CVE-2026-81887 is fixed in version v3.6.3-p2+tuxcare of livewire/livewire.", "vulnerability": { "name": "CVE-2026-81887" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/livewire/livewire@v3.6.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/livewire/livewire@v3.6.3-p1+tuxcare" } } ], "timestamp": "2026-10-12T12:01:00.095182+00:00", "status_notes": "Vulnerability CVE-2025-54068 is fixed in version v3.6.3-p1+tuxcare of livewire/livewire.", "vulnerability": { "name": "CVE-2025-54068" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/livewire/livewire@v3.6.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/livewire/livewire@v3.6.3-p1+tuxcare" } } ], "timestamp": "2026-10-12T12:01:00.095182+00:00", "status_notes": "Vulnerability CVE-2026-81887 affects version v3.6.3-p1+tuxcare of livewire/livewire, and is fixed in v3.6.3-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-81887" }, "action_statement": "Vulnerability CVE-2026-81887 affects version v3.6.3-p1+tuxcare of livewire/livewire, and is fixed in v3.6.3-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/livewire/livewire@v3.6.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/livewire/livewire@v3.6.3-p3+tuxcare" } } ], "timestamp": "2026-10-12T12:27:00.060353+00:00", "status_notes": "Vulnerability CVE-2025-54068 is fixed in version v3.6.3-p3+tuxcare of livewire/livewire.", "vulnerability": { "name": "CVE-2025-54068" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/livewire/livewire@v3.6.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/livewire/livewire@v3.6.3-p3+tuxcare" } } ], "timestamp": "2026-10-12T12:27:00.060353+00:00", "status_notes": "Vulnerability CVE-2026-81887 is fixed in version v3.6.3-p3+tuxcare of livewire/livewire.", "vulnerability": { "name": "CVE-2026-81887" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p4+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:37:00.264563+00:00", "status_notes": "Vulnerability CVE-2023-51651 is fixed in version 3.263.4-p4+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "CVE-2023-51651" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p4+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:37:00.264563+00:00", "status_notes": "Vulnerability CVE-2025-14761 is fixed in version 3.263.4-p4+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "CVE-2025-14761" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p4+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:37:00.264563+00:00", "status_notes": "Vulnerability GHSA-27qh-8cxx-2cr5 is fixed in version 3.263.4-p4+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "GHSA-27qh-8cxx-2cr5" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-29248 is fixed in version 6.0.2-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-29248" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31042 is fixed in version 6.0.2-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31042" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31043 is fixed in version 6.0.2-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31043" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31090 is fixed in version 6.0.2-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31091 is fixed in version 6.0.2-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31091" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55568 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-55568" }, "action_statement": "Vulnerability CVE-2026-55568 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55767 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-55767" }, "action_statement": "Vulnerability CVE-2026-55767 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59883 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-59883" }, "action_statement": "Vulnerability CVE-2026-59883 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67339 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67339" }, "action_statement": "Vulnerability CVE-2026-67339 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67353 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67353" }, "action_statement": "Vulnerability CVE-2026-67353 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67354 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67354" }, "action_statement": "Vulnerability CVE-2026-67354 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67355 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67355" }, "action_statement": "Vulnerability CVE-2026-67355 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69245 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-69245" }, "action_statement": "Vulnerability CVE-2026-69245 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69246 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-69246" }, "action_statement": "Vulnerability CVE-2026-69246 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 6.0.2-p3+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 6.0.2-p3+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" }, "action_statement": "Vulnerability GHSA-94pj-82f3-465w affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" }, "action_statement": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" }, "action_statement": "Vulnerability GHSA-h95v-h523-3mw8 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 6.0.2-p3+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 6.0.2-p3+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" }, "action_statement": "Vulnerability GHSA-wm3w-8rrp-j577 affects version 6.0.2-p3+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-29248 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p3+tuxcare.", "vulnerability": { "name": "CVE-2022-29248" }, "action_statement": "Vulnerability CVE-2022-29248 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31042 is fixed in version 6.0.2-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31042" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31043 is fixed in version 6.0.2-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31043" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31090 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p3+tuxcare.", "vulnerability": { "name": "CVE-2022-31090" }, "action_statement": "Vulnerability CVE-2022-31090 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31091 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p3+tuxcare.", "vulnerability": { "name": "CVE-2022-31091" }, "action_statement": "Vulnerability CVE-2022-31091 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55568 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-55568" }, "action_statement": "Vulnerability CVE-2026-55568 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55767 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-55767" }, "action_statement": "Vulnerability CVE-2026-55767 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59883 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-59883" }, "action_statement": "Vulnerability CVE-2026-59883 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67339 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67339" }, "action_statement": "Vulnerability CVE-2026-67339 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67353 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67353" }, "action_statement": "Vulnerability CVE-2026-67353 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67354 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67354" }, "action_statement": "Vulnerability CVE-2026-67354 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67355 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67355" }, "action_statement": "Vulnerability CVE-2026-67355 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69245 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-69245" }, "action_statement": "Vulnerability CVE-2026-69245 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69246 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-69246" }, "action_statement": "Vulnerability CVE-2026-69246 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 6.0.2-p2+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 6.0.2-p2+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" }, "action_statement": "Vulnerability GHSA-94pj-82f3-465w affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" }, "action_statement": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" }, "action_statement": "Vulnerability GHSA-h95v-h523-3mw8 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 6.0.2-p2+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 6.0.2-p2+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" }, "action_statement": "Vulnerability GHSA-wm3w-8rrp-j577 affects version 6.0.2-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-29248 is fixed in version 6.3.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-29248" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31042 is fixed in version 6.3.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31042" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31043 is fixed in version 6.3.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31043" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31090 is fixed in version 6.3.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31091 is fixed in version 6.3.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31091" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55568 is fixed in version 6.3.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55568" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55767 is fixed in version 6.3.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55767" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59883 is fixed in version 6.3.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-59883" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67339 affects version 6.3.3-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-67339" }, "action_statement": "Vulnerability CVE-2026-67339 affects version 6.3.3-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67353 affects version 6.3.3-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-67353" }, "action_statement": "Vulnerability CVE-2026-67353 affects version 6.3.3-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67354 affects version 6.3.3-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-67354" }, "action_statement": "Vulnerability CVE-2026-67354 affects version 6.3.3-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67355 affects version 6.3.3-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-67355" }, "action_statement": "Vulnerability CVE-2026-67355 affects version 6.3.3-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69245 affects version 6.3.3-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-69245" }, "action_statement": "Vulnerability CVE-2026-69245 affects version 6.3.3-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69246 affects version 6.3.3-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-69246" }, "action_statement": "Vulnerability CVE-2026-69246 affects version 6.3.3-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 6.3.3-p2+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 6.3.3-p2+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w is fixed in version 6.3.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.3.3-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" }, "action_statement": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.3.3-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 is fixed in version 6.3.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 6.3.3-p2+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 6.3.3-p2+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 is fixed in version 6.3.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-29248 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p3+tuxcare.", "vulnerability": { "name": "CVE-2022-29248" }, "action_statement": "Vulnerability CVE-2022-29248 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31042 is fixed in version 6.0.2-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31042" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31043 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p2+tuxcare.", "vulnerability": { "name": "CVE-2022-31043" }, "action_statement": "Vulnerability CVE-2022-31043 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31090 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p3+tuxcare.", "vulnerability": { "name": "CVE-2022-31090" }, "action_statement": "Vulnerability CVE-2022-31090 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31091 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p3+tuxcare.", "vulnerability": { "name": "CVE-2022-31091" }, "action_statement": "Vulnerability CVE-2022-31091 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55568 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-55568" }, "action_statement": "Vulnerability CVE-2026-55568 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55767 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-55767" }, "action_statement": "Vulnerability CVE-2026-55767 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59883 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-59883" }, "action_statement": "Vulnerability CVE-2026-59883 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67339 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67339" }, "action_statement": "Vulnerability CVE-2026-67339 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67353 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67353" }, "action_statement": "Vulnerability CVE-2026-67353 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67354 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67354" }, "action_statement": "Vulnerability CVE-2026-67354 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67355 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67355" }, "action_statement": "Vulnerability CVE-2026-67355 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69245 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-69245" }, "action_statement": "Vulnerability CVE-2026-69245 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69246 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-69246" }, "action_statement": "Vulnerability CVE-2026-69246 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 6.0.2-p1+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 6.0.2-p1+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" }, "action_statement": "Vulnerability GHSA-94pj-82f3-465w affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" }, "action_statement": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" }, "action_statement": "Vulnerability GHSA-h95v-h523-3mw8 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 6.0.2-p1+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 6.0.2-p1+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" }, "action_statement": "Vulnerability GHSA-wm3w-8rrp-j577 affects version 6.0.2-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/mongodb/mongodb@1.9.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/mongodb/mongodb@1.9.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2021-20332 is a false positive for mongodb/mongodb 1.9.0-p1+tuxcare. false_positive \u2014 CVE-2021-20332 concerns the MongoDB Rust Driver, but the target repository is the MongoDB PHP Library (mongodb/mongodb) version 1.9.0. This is a wrong-project match - the CVE applies to a different product in a different programming language.", "vulnerability": { "name": "CVE-2021-20332" }, "impact_statement": "false_positive \u2014 CVE-2021-20332 concerns the MongoDB Rust Driver, but the target repository is the MongoDB PHP Library (mongodb/mongodb) version 1.9.0. This is a wrong-project match - the CVE applies to a different product in a different programming language." }, { "status": "affected", "products": [ { "@id": "pkg:composer/mongodb/mongodb@1.9.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/mongodb/mongodb@1.9.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2021-32050 affects version 1.9.0-p1+tuxcare of mongodb/mongodb and will not be fixed. Security fix is in mongo-c-driver (a C library we don't maintain). PHP picks it up indirectly through the PECL ext-mongodb extension, which ships a new binary bundling the patched libmongoc. mongo-php-library itself receives no source-code change \u2014 a future release may bump its ext-mongodb version requirement, but no direct patch applies here.", "vulnerability": { "name": "CVE-2021-32050" }, "action_statement": "Vulnerability CVE-2021-32050 affects version 1.9.0-p1+tuxcare of mongodb/mongodb and will not be fixed. Security fix is in mongo-c-driver (a C library we don't maintain). PHP picks it up indirectly through the PECL ext-mongodb extension, which ships a new binary bundling the patched libmongoc. mongo-php-library itself receives no source-code change \u2014 a future release may bump its ext-mongodb version requirement, but no direct patch applies here." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/mongodb/mongodb@1.9.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/mongodb/mongodb@1.9.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-11695 is a false positive for mongodb/mongodb 1.9.0-p1+tuxcare. false_positive \u2014 CVE-2025-11695 affects the MongoDB Rust Driver, but this repository is the MongoDB PHP Library. These are separate codebases for different language ecosystems with no code sharing, vendoring, or dependency relationship. The CVE's tlsInsecure parameter logic does not exist in this PHP library.", "vulnerability": { "name": "CVE-2025-11695" }, "impact_statement": "false_positive \u2014 CVE-2025-11695 affects the MongoDB Rust Driver, but this repository is the MongoDB PHP Library. These are separate codebases for different language ecosystems with no code sharing, vendoring, or dependency relationship. The CVE's tlsInsecure parameter logic does not exist in this PHP library." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/mongodb/mongodb@1.9.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/mongodb/mongodb@1.9.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-81525 is fixed in version 1.9.0-p1+tuxcare of mongodb/mongodb.", "vulnerability": { "name": "CVE-2026-81525" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/mongodb/mongodb@1.9.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/mongodb/mongodb@1.9.0-p1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-88023 affects version 1.9.0-p1+tuxcare of mongodb/mongodb.", "vulnerability": { "name": "CVE-2026-88023" }, "action_statement": "Vulnerability CVE-2026-88023 affects version 1.9.0-p1+tuxcare of mongodb/mongodb." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/mongodb/mongodb@1.9.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/mongodb/mongodb@1.9.0-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-x6mc-fgjf-77r7 is a false positive for mongodb/mongodb 1.9.0-p1+tuxcare.", "vulnerability": { "name": "GHSA-x6mc-fgjf-77r7" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-29248 is fixed in version 6.0.2-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-29248" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31042 is fixed in version 6.0.2-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31042" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31043 is fixed in version 6.0.2-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31043" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31090 is fixed in version 6.0.2-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31091 is fixed in version 6.0.2-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31091" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55568 is fixed in version 6.0.2-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55568" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55767 is fixed in version 6.0.2-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55767" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59883 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-59883" }, "action_statement": "Vulnerability CVE-2026-59883 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67339 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67339" }, "action_statement": "Vulnerability CVE-2026-67339 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67353 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67353" }, "action_statement": "Vulnerability CVE-2026-67353 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67354 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67354" }, "action_statement": "Vulnerability CVE-2026-67354 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67355 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-67355" }, "action_statement": "Vulnerability CVE-2026-67355 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69245 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-69245" }, "action_statement": "Vulnerability CVE-2026-69245 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69246 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-69246" }, "action_statement": "Vulnerability CVE-2026-69246 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 6.0.2-p4+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 6.0.2-p4+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" }, "action_statement": "Vulnerability GHSA-94pj-82f3-465w affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" }, "action_statement": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" }, "action_statement": "Vulnerability GHSA-h95v-h523-3mw8 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 6.0.2-p4+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 6.0.2-p4+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" }, "action_statement": "Vulnerability GHSA-wm3w-8rrp-j577 affects version 6.0.2-p4+tuxcare of guzzlehttp/guzzle, and is fixed in 6.0.2-p5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-29248 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-29248" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31042 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31042" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31043 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31043" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31090 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31091 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31091" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55568 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55568" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55767 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55767" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59883 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-59883" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67339 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67339" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67353 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67353" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67354 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67354" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67355 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67355" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69245 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-69245" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69246 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-69246" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 6.3.3-p3+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 6.3.3-p3+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 6.3.3-p3+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 6.3.3-p3+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 is fixed in version 6.3.3-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-29248 is fixed in version 6.3.3-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-29248" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31042 is fixed in version 6.3.3-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31042" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31043 is fixed in version 6.3.3-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31043" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31090 is fixed in version 6.3.3-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31091 is fixed in version 6.3.3-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31091" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55568 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-55568" }, "action_statement": "Vulnerability CVE-2026-55568 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55767 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-55767" }, "action_statement": "Vulnerability CVE-2026-55767 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59883 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-59883" }, "action_statement": "Vulnerability CVE-2026-59883 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67339 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-67339" }, "action_statement": "Vulnerability CVE-2026-67339 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67353 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-67353" }, "action_statement": "Vulnerability CVE-2026-67353 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67354 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-67354" }, "action_statement": "Vulnerability CVE-2026-67354 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67355 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-67355" }, "action_statement": "Vulnerability CVE-2026-67355 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69245 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-69245" }, "action_statement": "Vulnerability CVE-2026-69245 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69246 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-69246" }, "action_statement": "Vulnerability CVE-2026-69246 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 6.3.3-p1+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 6.3.3-p1+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p2+tuxcare.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" }, "action_statement": "Vulnerability GHSA-94pj-82f3-465w affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" }, "action_statement": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p2+tuxcare.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" }, "action_statement": "Vulnerability GHSA-h95v-h523-3mw8 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 6.3.3-p1+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 6.3.3-p1+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.3.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p2+tuxcare.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" }, "action_statement": "Vulnerability GHSA-wm3w-8rrp-j577 affects version 6.3.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.3.3-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-29248 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-29248" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31042 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31042" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31043 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31043" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31090 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31091 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31091" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55568 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55568" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55767 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55767" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59883 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-59883" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67339 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67339" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67353 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67353" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67354 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67354" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67355 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67355" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69245 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-69245" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69246 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-69246" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 6.0.2-p5+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.0.2-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 is fixed in version 6.0.2-p5+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p5+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p5+tuxcare" } } ], "timestamp": "2026-10-20T20:47:00.216698+00:00", "status_notes": "Vulnerability CVE-2023-51651 is fixed in version 3.263.4-p5+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "CVE-2023-51651" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p5+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p5+tuxcare" } } ], "timestamp": "2026-10-20T20:47:00.216698+00:00", "status_notes": "Vulnerability CVE-2025-14761 is fixed in version 3.263.4-p5+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "CVE-2025-14761" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p5+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p5+tuxcare" } } ], "timestamp": "2026-10-20T20:47:00.216698+00:00", "status_notes": "Vulnerability GHSA-27qh-8cxx-2cr5 is fixed in version 3.263.4-p5+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "GHSA-27qh-8cxx-2cr5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/swiftmailer/swiftmailer@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/swiftmailer/swiftmailer@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-10-21T07:26:00.072497+00:00", "status_notes": "Vulnerability CVE-2016-10074 does not affect version 6.0.2-p2+tuxcare of swiftmailer/swiftmailer. already_fixed \u2014 The target repository (swiftmailer v6.0.2) is NOT vulnerable to CVE-2016-10074. The vulnerable Swift_Transport_MailTransport class was completely removed from the codebase in version 6.0.0, prior to the current version. The security fix was first applied in version 5.4.5 (December 2016), the mail transport was deprecated, and then the entire class was removed in version 6.0.0 (May 2017). The cu...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-10074" }, "impact_statement": "already_fixed \u2014 The target repository (swiftmailer v6.0.2) is NOT vulnerable to CVE-2016-10074. The vulnerable Swift_Transport_MailTransport class was completely removed from the codebase in version 6.0.0, prior to the current version. The security fix was first applied in version 5.4.5 (December 2016), the mail transport was deprecated, and then the entire class was removed in version 6.0.0 (May 2017). The cu..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/swiftmailer/swiftmailer@6.0.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/swiftmailer/swiftmailer@6.0.2-p2+tuxcare" } } ], "timestamp": "2026-10-21T07:26:00.072497+00:00", "status_notes": "Vulnerability CVE-2024-28859 is fixed in version 6.0.2-p2+tuxcare of swiftmailer/swiftmailer.", "vulnerability": { "name": "CVE-2024-28859" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2011-1939 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2011-1939" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-3363 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-3363" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-4451 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-4451" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-5657 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-5657" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-6531 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-6531" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-6532 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-6532" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2681 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2681" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2682 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2682" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2683 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2683" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2684 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2684" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2685 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2685" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-8088 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-8088" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-8089 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-8089" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-3154 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-3154" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5161 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5161" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5723 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5723" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-7695 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-7695" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-4861 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-4861" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-6233 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-6233" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-229x-22xc-2f2w is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-229x-22xc-2f2w" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-2jx7-xg83-j2m7 affects version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-2jx7-xg83-j2m7" }, "action_statement": "Vulnerability GHSA-2jx7-xg83-j2m7 affects version 1.11.0-p4+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2x36-qhx3-7m5f is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-2x36-qhx3-7m5f" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-4j9x-g4x8-vcmf affects version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-4j9x-g4x8-vcmf" }, "action_statement": "Vulnerability GHSA-4j9x-g4x8-vcmf affects version 1.11.0-p4+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6fqw-j3vm-7f66 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-6fqw-j3vm-7f66" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-848f-mph5-9pm9 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-848f-mph5-9pm9" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8xhv-gqm4-3w99 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-8xhv-gqm4-3w99" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9v78-h226-2rmq is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-9v78-h226-2rmq" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g52p-86j5-xr8q is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-g52p-86j5-xr8q" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gff2-p6vm-3p8g is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-gff2-p6vm-3p8g" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mhpx-3rv8-wrjm is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-mhpx-3rv8-wrjm" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-qf36-fx9f-232x affects version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-qf36-fx9f-232x" }, "action_statement": "Vulnerability GHSA-qf36-fx9f-232x affects version 1.11.0-p4+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v42g-7q2x-cw32 is fixed in version 1.11.0-p4+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-v42g-7q2x-cw32" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2011-1939 affects version 1.10.6-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare.", "vulnerability": { "name": "CVE-2011-1939" }, "action_statement": "Vulnerability CVE-2011-1939 affects version 1.10.6-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-3363 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-3363" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-4451 affects version 1.10.6-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare.", "vulnerability": { "name": "CVE-2012-4451" }, "action_statement": "Vulnerability CVE-2012-4451 affects version 1.10.6-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-5657 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-5657" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-6531 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-6531" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-6532 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-6532" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2681 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2681" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2682 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2682" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2683 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2683" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2684 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2684" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2685 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2685" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-8088 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-8088" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-8089 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-8089" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-3154 affects version 1.10.6-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare.", "vulnerability": { "name": "CVE-2015-3154" }, "action_statement": "Vulnerability CVE-2015-3154 affects version 1.10.6-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5161 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5161" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5723 affects version 1.10.6-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2015-5723" }, "action_statement": "Vulnerability CVE-2015-5723 affects version 1.10.6-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-7695 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-7695" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-4861 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-4861" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-6233 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-6233" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-229x-22xc-2f2w is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-229x-22xc-2f2w" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-2jx7-xg83-j2m7 affects version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-2jx7-xg83-j2m7" }, "action_statement": "Vulnerability GHSA-2jx7-xg83-j2m7 affects version 1.10.6-p1+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2x36-qhx3-7m5f is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-2x36-qhx3-7m5f" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6fqw-j3vm-7f66 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-6fqw-j3vm-7f66" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-848f-mph5-9pm9 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-848f-mph5-9pm9" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8xhv-gqm4-3w99 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-8xhv-gqm4-3w99" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9v78-h226-2rmq is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-9v78-h226-2rmq" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g52p-86j5-xr8q affects version 1.10.6-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare.", "vulnerability": { "name": "GHSA-g52p-86j5-xr8q" }, "action_statement": "Vulnerability GHSA-g52p-86j5-xr8q affects version 1.10.6-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gff2-p6vm-3p8g affects version 1.10.6-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare.", "vulnerability": { "name": "GHSA-gff2-p6vm-3p8g" }, "action_statement": "Vulnerability GHSA-gff2-p6vm-3p8g affects version 1.10.6-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mhpx-3rv8-wrjm is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-mhpx-3rv8-wrjm" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-qf36-fx9f-232x affects version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-qf36-fx9f-232x" }, "action_statement": "Vulnerability GHSA-qf36-fx9f-232x affects version 1.10.6-p1+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v42g-7q2x-cw32 is fixed in version 1.10.6-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-v42g-7q2x-cw32" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2011-1939 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2011-1939" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-3363 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-3363" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-4451 affects version 1.11.0-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2012-4451" }, "action_statement": "Vulnerability CVE-2012-4451 affects version 1.11.0-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-5657 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-5657" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-6531 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-6531" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-6532 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-6532" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2681 affects version 1.11.0-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2014-2681" }, "action_statement": "Vulnerability CVE-2014-2681 affects version 1.11.0-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2682 affects version 1.11.0-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2014-2682" }, "action_statement": "Vulnerability CVE-2014-2682 affects version 1.11.0-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2683 affects version 1.11.0-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2014-2683" }, "action_statement": "Vulnerability CVE-2014-2683 affects version 1.11.0-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2684 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2684" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2685 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2685" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-8088 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-8088" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-8089 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-8089" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-3154 affects version 1.11.0-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p3+tuxcare.", "vulnerability": { "name": "CVE-2015-3154" }, "action_statement": "Vulnerability CVE-2015-3154 affects version 1.11.0-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5161 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5161" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5723 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5723" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-7695 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-7695" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-4861 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-4861" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-6233 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-6233" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-229x-22xc-2f2w is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-229x-22xc-2f2w" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-2jx7-xg83-j2m7 affects version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-2jx7-xg83-j2m7" }, "action_statement": "Vulnerability GHSA-2jx7-xg83-j2m7 affects version 1.11.0-p2+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2x36-qhx3-7m5f is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-2x36-qhx3-7m5f" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-4j9x-g4x8-vcmf affects version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-4j9x-g4x8-vcmf" }, "action_statement": "Vulnerability GHSA-4j9x-g4x8-vcmf affects version 1.11.0-p2+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6fqw-j3vm-7f66 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-6fqw-j3vm-7f66" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-848f-mph5-9pm9 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-848f-mph5-9pm9" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8xhv-gqm4-3w99 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-8xhv-gqm4-3w99" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9v78-h226-2rmq is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-9v78-h226-2rmq" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g52p-86j5-xr8q affects version 1.11.0-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "GHSA-g52p-86j5-xr8q" }, "action_statement": "Vulnerability GHSA-g52p-86j5-xr8q affects version 1.11.0-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gff2-p6vm-3p8g affects version 1.11.0-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "GHSA-gff2-p6vm-3p8g" }, "action_statement": "Vulnerability GHSA-gff2-p6vm-3p8g affects version 1.11.0-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mhpx-3rv8-wrjm is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-mhpx-3rv8-wrjm" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-qf36-fx9f-232x affects version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-qf36-fx9f-232x" }, "action_statement": "Vulnerability GHSA-qf36-fx9f-232x affects version 1.11.0-p2+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v42g-7q2x-cw32 is fixed in version 1.11.0-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-v42g-7q2x-cw32" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2011-1939 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2011-1939" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-3363 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-3363" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-4451 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-4451" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-5657 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-5657" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-6531 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-6531" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-6532 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-6532" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2681 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2681" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2682 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2682" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2683 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2683" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2684 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2684" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2685 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2685" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-8088 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-8088" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-8089 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-8089" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-3154 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-3154" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5161 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5161" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5723 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5723" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-7695 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-7695" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-4861 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-4861" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-6233 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-6233" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-229x-22xc-2f2w is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-229x-22xc-2f2w" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-2jx7-xg83-j2m7 affects version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-2jx7-xg83-j2m7" }, "action_statement": "Vulnerability GHSA-2jx7-xg83-j2m7 affects version 1.10.6-p3+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2x36-qhx3-7m5f is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-2x36-qhx3-7m5f" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6fqw-j3vm-7f66 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-6fqw-j3vm-7f66" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-848f-mph5-9pm9 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-848f-mph5-9pm9" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8xhv-gqm4-3w99 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-8xhv-gqm4-3w99" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9v78-h226-2rmq is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-9v78-h226-2rmq" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g52p-86j5-xr8q is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-g52p-86j5-xr8q" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gff2-p6vm-3p8g is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-gff2-p6vm-3p8g" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mhpx-3rv8-wrjm is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-mhpx-3rv8-wrjm" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-qf36-fx9f-232x affects version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-qf36-fx9f-232x" }, "action_statement": "Vulnerability GHSA-qf36-fx9f-232x affects version 1.10.6-p3+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v42g-7q2x-cw32 is fixed in version 1.10.6-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-v42g-7q2x-cw32" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2011-1939 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2011-1939" }, "action_statement": "Vulnerability CVE-2011-1939 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-3363 is fixed in version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-3363" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-4451 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2012-4451" }, "action_statement": "Vulnerability CVE-2012-4451 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-5657 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2012-5657" }, "action_statement": "Vulnerability CVE-2012-5657 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-6531 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2012-6531" }, "action_statement": "Vulnerability CVE-2012-6531 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-6532 is fixed in version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-6532" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2681 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2014-2681" }, "action_statement": "Vulnerability CVE-2014-2681 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2682 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2014-2682" }, "action_statement": "Vulnerability CVE-2014-2682 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2683 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2014-2683" }, "action_statement": "Vulnerability CVE-2014-2683 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2684 is fixed in version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2684" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2685 is fixed in version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2685" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-8088 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2014-8088" }, "action_statement": "Vulnerability CVE-2014-8088 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-8089 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2014-8089" }, "action_statement": "Vulnerability CVE-2014-8089 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-3154 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p3+tuxcare.", "vulnerability": { "name": "CVE-2015-3154" }, "action_statement": "Vulnerability CVE-2015-3154 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5161 is fixed in version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5161" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5723 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2015-5723" }, "action_statement": "Vulnerability CVE-2015-5723 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-7695 is fixed in version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-7695" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-4861 is fixed in version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-4861" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-6233 is fixed in version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-6233" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-229x-22xc-2f2w affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-229x-22xc-2f2w" }, "action_statement": "Vulnerability GHSA-229x-22xc-2f2w affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-2jx7-xg83-j2m7 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-2jx7-xg83-j2m7" }, "action_statement": "Vulnerability GHSA-2jx7-xg83-j2m7 affects version 1.11.0-p1+tuxcare of zendframework/zendframework1." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2x36-qhx3-7m5f affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-2x36-qhx3-7m5f" }, "action_statement": "Vulnerability GHSA-2x36-qhx3-7m5f affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-4j9x-g4x8-vcmf affects version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-4j9x-g4x8-vcmf" }, "action_statement": "Vulnerability GHSA-4j9x-g4x8-vcmf affects version 1.11.0-p1+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6fqw-j3vm-7f66 is fixed in version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-6fqw-j3vm-7f66" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-848f-mph5-9pm9 is fixed in version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-848f-mph5-9pm9" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8xhv-gqm4-3w99 is fixed in version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-8xhv-gqm4-3w99" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9v78-h226-2rmq affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-9v78-h226-2rmq" }, "action_statement": "Vulnerability GHSA-9v78-h226-2rmq affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g52p-86j5-xr8q affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "GHSA-g52p-86j5-xr8q" }, "action_statement": "Vulnerability GHSA-g52p-86j5-xr8q affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gff2-p6vm-3p8g affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "GHSA-gff2-p6vm-3p8g" }, "action_statement": "Vulnerability GHSA-gff2-p6vm-3p8g affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mhpx-3rv8-wrjm affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-mhpx-3rv8-wrjm" }, "action_statement": "Vulnerability GHSA-mhpx-3rv8-wrjm affects version 1.11.0-p1+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-qf36-fx9f-232x affects version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-qf36-fx9f-232x" }, "action_statement": "Vulnerability GHSA-qf36-fx9f-232x affects version 1.11.0-p1+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v42g-7q2x-cw32 is fixed in version 1.11.0-p1+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-v42g-7q2x-cw32" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2011-1939 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2011-1939" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-3363 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-3363" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-4451 affects version 1.11.0-p3+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2012-4451" }, "action_statement": "Vulnerability CVE-2012-4451 affects version 1.11.0-p3+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-5657 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-5657" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-6531 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-6531" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-6532 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-6532" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2681 affects version 1.11.0-p3+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2014-2681" }, "action_statement": "Vulnerability CVE-2014-2681 affects version 1.11.0-p3+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2682 affects version 1.11.0-p3+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2014-2682" }, "action_statement": "Vulnerability CVE-2014-2682 affects version 1.11.0-p3+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2683 affects version 1.11.0-p3+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2014-2683" }, "action_statement": "Vulnerability CVE-2014-2683 affects version 1.11.0-p3+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2684 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2684" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2685 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2685" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-8088 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-8088" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-8089 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-8089" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-3154 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-3154" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5161 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5161" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5723 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5723" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-7695 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-7695" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-4861 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-4861" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-6233 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-6233" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-229x-22xc-2f2w is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-229x-22xc-2f2w" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-2jx7-xg83-j2m7 affects version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-2jx7-xg83-j2m7" }, "action_statement": "Vulnerability GHSA-2jx7-xg83-j2m7 affects version 1.11.0-p3+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2x36-qhx3-7m5f is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-2x36-qhx3-7m5f" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-4j9x-g4x8-vcmf affects version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-4j9x-g4x8-vcmf" }, "action_statement": "Vulnerability GHSA-4j9x-g4x8-vcmf affects version 1.11.0-p3+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6fqw-j3vm-7f66 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-6fqw-j3vm-7f66" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-848f-mph5-9pm9 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-848f-mph5-9pm9" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8xhv-gqm4-3w99 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-8xhv-gqm4-3w99" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9v78-h226-2rmq is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-9v78-h226-2rmq" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g52p-86j5-xr8q affects version 1.11.0-p3+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "GHSA-g52p-86j5-xr8q" }, "action_statement": "Vulnerability GHSA-g52p-86j5-xr8q affects version 1.11.0-p3+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gff2-p6vm-3p8g affects version 1.11.0-p3+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare.", "vulnerability": { "name": "GHSA-gff2-p6vm-3p8g" }, "action_statement": "Vulnerability GHSA-gff2-p6vm-3p8g affects version 1.11.0-p3+tuxcare of zendframework/zendframework1, and is fixed in 1.11.0-p4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mhpx-3rv8-wrjm is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-mhpx-3rv8-wrjm" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-qf36-fx9f-232x affects version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-qf36-fx9f-232x" }, "action_statement": "Vulnerability GHSA-qf36-fx9f-232x affects version 1.11.0-p3+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.11.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v42g-7q2x-cw32 is fixed in version 1.11.0-p3+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-v42g-7q2x-cw32" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2011-1939 affects version 1.10.6-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare.", "vulnerability": { "name": "CVE-2011-1939" }, "action_statement": "Vulnerability CVE-2011-1939 affects version 1.10.6-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-3363 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-3363" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-4451 affects version 1.10.6-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare.", "vulnerability": { "name": "CVE-2012-4451" }, "action_statement": "Vulnerability CVE-2012-4451 affects version 1.10.6-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-5657 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-5657" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-6531 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-6531" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2012-6532 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2012-6532" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2681 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2681" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2682 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2682" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2683 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2683" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2684 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2684" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-2685 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-2685" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-8088 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-8088" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-8089 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2014-8089" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-3154 affects version 1.10.6-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare.", "vulnerability": { "name": "CVE-2015-3154" }, "action_statement": "Vulnerability CVE-2015-3154 affects version 1.10.6-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5161 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5161" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-5723 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-5723" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-7695 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2015-7695" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-4861 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-4861" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-6233 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "CVE-2016-6233" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-229x-22xc-2f2w is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-229x-22xc-2f2w" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-2jx7-xg83-j2m7 affects version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-2jx7-xg83-j2m7" }, "action_statement": "Vulnerability GHSA-2jx7-xg83-j2m7 affects version 1.10.6-p2+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2x36-qhx3-7m5f is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-2x36-qhx3-7m5f" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6fqw-j3vm-7f66 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-6fqw-j3vm-7f66" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-848f-mph5-9pm9 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-848f-mph5-9pm9" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8xhv-gqm4-3w99 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-8xhv-gqm4-3w99" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9v78-h226-2rmq is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-9v78-h226-2rmq" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g52p-86j5-xr8q affects version 1.10.6-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare.", "vulnerability": { "name": "GHSA-g52p-86j5-xr8q" }, "action_statement": "Vulnerability GHSA-g52p-86j5-xr8q affects version 1.10.6-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gff2-p6vm-3p8g affects version 1.10.6-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare.", "vulnerability": { "name": "GHSA-gff2-p6vm-3p8g" }, "action_statement": "Vulnerability GHSA-gff2-p6vm-3p8g affects version 1.10.6-p2+tuxcare of zendframework/zendframework1, and is fixed in 1.10.6-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mhpx-3rv8-wrjm is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-mhpx-3rv8-wrjm" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-10-26T13:12:00.538529+00:00", "status_notes": "Vulnerability GHSA-qf36-fx9f-232x affects version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-qf36-fx9f-232x" }, "action_statement": "Vulnerability GHSA-qf36-fx9f-232x affects version 1.10.6-p2+tuxcare of zendframework/zendframework1." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework1@1.10.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v42g-7q2x-cw32 is fixed in version 1.10.6-p2+tuxcare of zendframework/zendframework1.", "vulnerability": { "name": "GHSA-v42g-7q2x-cw32" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/mtdowling/jmespath.php@2.6.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/mtdowling/jmespath.php@2.6.1-p1+tuxcare" } } ], "timestamp": "2026-10-28T15:36:00.123359+00:00", "status_notes": "Vulnerability CVE-2026-54133 is fixed in version 2.6.1-p1+tuxcare of mtdowling/jmespath.php.", "vulnerability": { "name": "CVE-2026-54133" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25270 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25270" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25271 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25273 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25275 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25276 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25276" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25277 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25278 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25278" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-5256 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-10-28T15:41:51.810505+00:00", "status_notes": "Vulnerability CVE-2024-45440 affects version 8.9.20-p6+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare.", "vulnerability": { "name": "CVE-2024-45440" }, "action_statement": "Vulnerability CVE-2024-45440 affects version 8.9.20-p6+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13081 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13081" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13082 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13083 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13083" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108097 affects version 8.9.20-p6+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-108097" }, "action_statement": "Vulnerability CVE-2026-108097 affects version 8.9.20-p6+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108515 affects version 8.9.20-p6+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-108515" }, "action_statement": "Vulnerability CVE-2026-108515 affects version 8.9.20-p6+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw is fixed in version 8.9.20-p6+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2022-25270 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25270" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2022-25271 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2022-25273 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2022-25275 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2022-25276 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25276" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2022-25277 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2022-25278 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25278" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2023-5256 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:51.810505+00:00", "status_notes": "Vulnerability CVE-2024-45440 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-45440" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2025-13081 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13081" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2025-13082 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2025-13083 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13083" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2026-108097 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-108097" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2026-108515 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-108515" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p10+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p10+tuxcare" } } ], "timestamp": "2026-10-28T15:41:47.455468+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw is fixed in version 8.9.20-p10+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25270 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25270" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25271 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25273 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25275 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25276 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25276" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25277 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25278 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25278" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-5256 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-10-28T15:41:51.810505+00:00", "status_notes": "Vulnerability CVE-2024-45440 affects version 8.9.20-p1+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare.", "vulnerability": { "name": "CVE-2024-45440" }, "action_statement": "Vulnerability CVE-2024-45440 affects version 8.9.20-p1+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13081 affects version 8.9.20-p1+tuxcare of drupal/core, and is fixed in 8.9.20-p2+tuxcare.", "vulnerability": { "name": "CVE-2025-13081" }, "action_statement": "Vulnerability CVE-2025-13081 affects version 8.9.20-p1+tuxcare of drupal/core, and is fixed in 8.9.20-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13082 affects version 8.9.20-p1+tuxcare of drupal/core, and is fixed in 8.9.20-p2+tuxcare.", "vulnerability": { "name": "CVE-2025-13082" }, "action_statement": "Vulnerability CVE-2025-13082 affects version 8.9.20-p1+tuxcare of drupal/core, and is fixed in 8.9.20-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13083 affects version 8.9.20-p1+tuxcare of drupal/core, and is fixed in 8.9.20-p2+tuxcare.", "vulnerability": { "name": "CVE-2025-13083" }, "action_statement": "Vulnerability CVE-2025-13083 affects version 8.9.20-p1+tuxcare of drupal/core, and is fixed in 8.9.20-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3057 affects version 8.9.20-p1+tuxcare of drupal/core, and is fixed in 8.9.20-p2+tuxcare.", "vulnerability": { "name": "CVE-2025-3057" }, "action_statement": "Vulnerability CVE-2025-3057 affects version 8.9.20-p1+tuxcare of drupal/core, and is fixed in 8.9.20-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108097 affects version 8.9.20-p1+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-108097" }, "action_statement": "Vulnerability CVE-2026-108097 affects version 8.9.20-p1+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108515 affects version 8.9.20-p1+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-108515" }, "action_statement": "Vulnerability CVE-2026-108515 affects version 8.9.20-p1+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw is fixed in version 8.9.20-p1+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25270 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25270" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25271 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25273 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25275 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25276 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25276" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25277 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25278 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25278" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-5256 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-10-28T15:41:51.810505+00:00", "status_notes": "Vulnerability CVE-2024-45440 affects version 8.9.20-p4+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare.", "vulnerability": { "name": "CVE-2024-45440" }, "action_statement": "Vulnerability CVE-2024-45440 affects version 8.9.20-p4+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13081 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13081" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13082 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13083 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13083" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108097 affects version 8.9.20-p4+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-108097" }, "action_statement": "Vulnerability CVE-2026-108097 affects version 8.9.20-p4+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108515 affects version 8.9.20-p4+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-108515" }, "action_statement": "Vulnerability CVE-2026-108515 affects version 8.9.20-p4+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw is fixed in version 8.9.20-p4+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25270 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25270" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25271 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25273 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25275 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25276 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25276" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25277 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25278 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25278" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-5256 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-10-28T15:41:51.810505+00:00", "status_notes": "Vulnerability CVE-2024-45440 affects version 8.9.20-p2+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare.", "vulnerability": { "name": "CVE-2024-45440" }, "action_statement": "Vulnerability CVE-2024-45440 affects version 8.9.20-p2+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13081 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13081" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13082 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13083 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13083" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108097 affects version 8.9.20-p2+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-108097" }, "action_statement": "Vulnerability CVE-2026-108097 affects version 8.9.20-p2+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108515 affects version 8.9.20-p2+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-108515" }, "action_statement": "Vulnerability CVE-2026-108515 affects version 8.9.20-p2+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw is fixed in version 8.9.20-p2+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25270 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25270" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25271 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25273 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25275 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25276 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25276" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25277 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25278 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25278" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-5256 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-10-28T15:41:51.810505+00:00", "status_notes": "Vulnerability CVE-2024-45440 affects version 8.9.20-p3+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare.", "vulnerability": { "name": "CVE-2024-45440" }, "action_statement": "Vulnerability CVE-2024-45440 affects version 8.9.20-p3+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13081 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13081" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13082 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13083 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13083" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108097 affects version 8.9.20-p3+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-108097" }, "action_statement": "Vulnerability CVE-2026-108097 affects version 8.9.20-p3+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108515 affects version 8.9.20-p3+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-108515" }, "action_statement": "Vulnerability CVE-2026-108515 affects version 8.9.20-p3+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw is fixed in version 8.9.20-p3+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25270 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25270" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25271 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25273 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25275 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25276 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25276" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25277 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25278 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25278" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-5256 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-10-28T15:41:51.810505+00:00", "status_notes": "Vulnerability CVE-2024-45440 affects version 8.9.20-p5+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare.", "vulnerability": { "name": "CVE-2024-45440" }, "action_statement": "Vulnerability CVE-2024-45440 affects version 8.9.20-p5+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13081 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13081" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13082 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13083 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13083" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108097 affects version 8.9.20-p5+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-108097" }, "action_statement": "Vulnerability CVE-2026-108097 affects version 8.9.20-p5+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108515 affects version 8.9.20-p5+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-108515" }, "action_statement": "Vulnerability CVE-2026-108515 affects version 8.9.20-p5+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw is fixed in version 8.9.20-p5+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2022-25270 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25270" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2022-25271 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2022-25273 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2022-25275 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2022-25276 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25276" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2022-25277 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2022-25278 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25278" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2023-5256 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-28T15:41:51.810505+00:00", "status_notes": "Vulnerability CVE-2024-45440 affects version 8.9.20-p8+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare.", "vulnerability": { "name": "CVE-2024-45440" }, "action_statement": "Vulnerability CVE-2024-45440 affects version 8.9.20-p8+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2025-13081 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13081" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2025-13082 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2025-13083 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13083" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108097 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-108097" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108515 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-108515" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p8+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw is fixed in version 8.9.20-p8+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2022-25270 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25270" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2022-25271 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2022-25273 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2022-25275 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2022-25276 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25276" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2022-25277 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2022-25278 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25278" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2023-5256 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-28T15:41:51.810505+00:00", "status_notes": "Vulnerability CVE-2024-45440 affects version 8.9.20-p9+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare.", "vulnerability": { "name": "CVE-2024-45440" }, "action_statement": "Vulnerability CVE-2024-45440 affects version 8.9.20-p9+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2025-13081 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13081" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2025-13082 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2025-13083 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13083" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2026-108097 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-108097" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2026-108515 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-108515" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p9+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p9+tuxcare" } } ], "timestamp": "2026-10-21T09:45:00.179446+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw is fixed in version 8.9.20-p9+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25270 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25270" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25271 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25273 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25275 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25276 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25276" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25277 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-25278 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25278" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-5256 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-10-28T15:41:51.810505+00:00", "status_notes": "Vulnerability CVE-2024-45440 affects version 8.9.20-p7+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare.", "vulnerability": { "name": "CVE-2024-45440" }, "action_statement": "Vulnerability CVE-2024-45440 affects version 8.9.20-p7+tuxcare of drupal/core, and is fixed in 8.9.20-p10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13081 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13081" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13082 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13083 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13083" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108097 affects version 8.9.20-p7+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-108097" }, "action_statement": "Vulnerability CVE-2026-108097 affects version 8.9.20-p7+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-10-20T20:46:00.144564+00:00", "status_notes": "Vulnerability CVE-2026-108515 affects version 8.9.20-p7+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-108515" }, "action_statement": "Vulnerability CVE-2026-108515 affects version 8.9.20-p7+tuxcare of drupal/core, and is fixed in 8.9.20-p8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw is fixed in version 8.9.20-p7+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/image-optimizer@1.5.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/image-optimizer@1.5.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:25:14.318468+00:00", "status_notes": "Vulnerability CVE-2024-34515 is fixed in version 1.5.0-p1+tuxcare of spatie/image-optimizer.", "vulnerability": { "name": "CVE-2024-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p6+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p6+tuxcare" } } ], "timestamp": "2026-10-28T20:26:51.065887+00:00", "status_notes": "Vulnerability CVE-2023-51651 is fixed in version 3.263.4-p6+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "CVE-2023-51651" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p6+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p6+tuxcare" } } ], "timestamp": "2026-10-28T20:26:51.065887+00:00", "status_notes": "Vulnerability CVE-2025-14761 is fixed in version 3.263.4-p6+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "CVE-2025-14761" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/aws/aws-sdk-php@3.263.4-p6+tuxcare", "identifiers": { "purl": "pkg:composer/aws/aws-sdk-php@3.263.4-p6+tuxcare" } } ], "timestamp": "2026-10-28T20:26:51.065887+00:00", "status_notes": "Vulnerability GHSA-27qh-8cxx-2cr5 is fixed in version 3.263.4-p6+tuxcare of aws/aws-sdk-php.", "vulnerability": { "name": "GHSA-27qh-8cxx-2cr5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/google/protobuf@3.24.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/google/protobuf@3.24.4-p1+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2021-22570 is a false positive for google/protobuf 3.24.4-p1+tuxcare.", "vulnerability": { "name": "CVE-2021-22570" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/google/protobuf@3.24.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/google/protobuf@3.24.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6409 is fixed in version 3.24.4-p1+tuxcare of google/protobuf.", "vulnerability": { "name": "CVE-2026-6409" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/google/protobuf@3.24.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/google/protobuf@3.24.4-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-qjfj-3mm5-vrjg is a false positive for google/protobuf 3.24.4-p1+tuxcare.", "vulnerability": { "name": "GHSA-qjfj-3mm5-vrjg" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/google/protobuf@3.25.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/google/protobuf@3.25.9-p1+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2021-22570 is a false positive for google/protobuf 3.25.9-p1+tuxcare.", "vulnerability": { "name": "CVE-2021-22570" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/google/protobuf@3.25.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/google/protobuf@3.25.9-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6409 is fixed in version 3.25.9-p1+tuxcare of google/protobuf.", "vulnerability": { "name": "CVE-2026-6409" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/google/protobuf@3.25.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/google/protobuf@3.25.9-p1+tuxcare" } } ], "timestamp": "2026-10-26T15:32:16.744693+00:00", "status_notes": "Vulnerability GHSA-qjfj-3mm5-vrjg is a false positive for google/protobuf 3.25.9-p1+tuxcare.", "vulnerability": { "name": "GHSA-qjfj-3mm5-vrjg" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:22:00.156974+00:00", "status_notes": "Vulnerability CVE-2025-46734 is fixed in version 1.6.7-p6+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2025-46734" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:22:00.156974+00:00", "status_notes": "Vulnerability CVE-2026-30838 is fixed in version 1.6.7-p6+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-30838" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:22:00.156974+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 1.6.7-p6+tuxcare of league/commonmark. The affected files doesn't exist in the version 1.6.7 and also The GitHub Advisory (GHSA-hh8v-hgvp-g3f5) lists the vulnerable range as >= 2.3.0 <= 2.8.1", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "The affected files doesn't exist in the version 1.6.7 and also The GitHub Advisory (GHSA-hh8v-hgvp-g3f5) lists the vulnerable range as >= 2.3.0 <= 2.8.1" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:22:00.156974+00:00", "status_notes": "Vulnerability CVE-2026-71478 is fixed in version 1.6.7-p6+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71478" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:22:00.156974+00:00", "status_notes": "Vulnerability CVE-2026-71488 is fixed in version 1.6.7-p6+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71488" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 1.6.7-p6+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare.", "vulnerability": { "name": "GHSA-3q6v-r5mr-hxv8" }, "action_statement": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 1.6.7-p6+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:22:00.156974+00:00", "status_notes": "Vulnerability GHSA-8rr7-cvq3-gmfh is fixed in version 1.6.7-p6+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-8rr7-cvq3-gmfh" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:23:00.200135+00:00", "status_notes": "Vulnerability GHSA-97jj-33gv-5xf9 is fixed in version 1.6.7-p6+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-97jj-33gv-5xf9" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:22:00.156974+00:00", "status_notes": "Vulnerability GHSA-c2pc-g5qf-rfrf is fixed in version 1.6.7-p6+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-c2pc-g5qf-rfrf" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 1.6.7-p6+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare.", "vulnerability": { "name": "GHSA-f8fg-pg57-v4j8" }, "action_statement": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 1.6.7-p6+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:22:00.156974+00:00", "status_notes": "Vulnerability GHSA-g2gp-3wwq-f4ph is fixed in version 1.6.7-p6+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-g2gp-3wwq-f4ph" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:22:00.156974+00:00", "status_notes": "Vulnerability GHSA-j8pm-gj4c-rq4x is fixed in version 1.6.7-p6+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-j8pm-gj4c-rq4x" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:22:00.156974+00:00", "status_notes": "Vulnerability GHSA-jfm3-95jq-q3rf is fixed in version 1.6.7-p6+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jfm3-95jq-q3rf" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:22:00.156974+00:00", "status_notes": "Vulnerability GHSA-jjv6-8j6v-6j52 is fixed in version 1.6.7-p6+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jjv6-8j6v-6j52" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability GHSA-mh25-x5hq-wrqp affects version 1.6.7-p6+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare.", "vulnerability": { "name": "GHSA-mh25-x5hq-wrqp" }, "action_statement": "Vulnerability GHSA-mh25-x5hq-wrqp affects version 1.6.7-p6+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p6+tuxcare" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability GHSA-mj63-m3rc-8ppr does not affect version 1.6.7-p6+tuxcare of league/commonmark. not_affected \u2014 The target (league/commonmark 1.6.7) is not affected by GHSA-mj63-m3rc-8ppr. The vulnerability affects the XmlRenderer component which emits depth-proportional indentation, leading to O(n\u00b2) output size. However, XmlRenderer was introduced in version 2.0.0-beta1 (June 2021) and does not exist in any 1.x version. The target has only HTML rendering capability (HtmlRenderer). TuxCare backported thi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-mj63-m3rc-8ppr" }, "impact_statement": "not_affected \u2014 The target (league/commonmark 1.6.7) is not affected by GHSA-mj63-m3rc-8ppr. The vulnerability affects the XmlRenderer component which emits depth-proportional indentation, leading to O(n\u00b2) output size. However, XmlRenderer was introduced in version 2.0.0-beta1 (June 2021) and does not exist in any 1.x version. The target has only HTML rendering capability (HtmlRenderer). TuxCare backported thi..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability CVE-2025-46734 is fixed in version 1.6.7-p7+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2025-46734" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability CVE-2026-30838 is fixed in version 1.6.7-p7+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-30838" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 1.6.7-p7+tuxcare of league/commonmark. The affected files doesn't exist in the version 1.6.7 and also The GitHub Advisory (GHSA-hh8v-hgvp-g3f5) lists the vulnerable range as >= 2.3.0 <= 2.8.1", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "The affected files doesn't exist in the version 1.6.7 and also The GitHub Advisory (GHSA-hh8v-hgvp-g3f5) lists the vulnerable range as >= 2.3.0 <= 2.8.1" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability CVE-2026-71478 is fixed in version 1.6.7-p7+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71478" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability CVE-2026-71488 is fixed in version 1.6.7-p7+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71488" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability GHSA-3q6v-r5mr-hxv8 is fixed in version 1.6.7-p7+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-3q6v-r5mr-hxv8" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability GHSA-8rr7-cvq3-gmfh is fixed in version 1.6.7-p7+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-8rr7-cvq3-gmfh" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability GHSA-97jj-33gv-5xf9 is fixed in version 1.6.7-p7+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-97jj-33gv-5xf9" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability GHSA-c2pc-g5qf-rfrf is fixed in version 1.6.7-p7+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-c2pc-g5qf-rfrf" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability GHSA-f8fg-pg57-v4j8 is fixed in version 1.6.7-p7+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-f8fg-pg57-v4j8" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability GHSA-g2gp-3wwq-f4ph is fixed in version 1.6.7-p7+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-g2gp-3wwq-f4ph" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability GHSA-j8pm-gj4c-rq4x is fixed in version 1.6.7-p7+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-j8pm-gj4c-rq4x" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability GHSA-jfm3-95jq-q3rf is fixed in version 1.6.7-p7+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jfm3-95jq-q3rf" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability GHSA-jjv6-8j6v-6j52 is fixed in version 1.6.7-p7+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jjv6-8j6v-6j52" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability GHSA-mh25-x5hq-wrqp is fixed in version 1.6.7-p7+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mh25-x5hq-wrqp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p7+tuxcare" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability GHSA-mj63-m3rc-8ppr does not affect version 1.6.7-p7+tuxcare of league/commonmark. not_affected \u2014 The target (league/commonmark 1.6.7) is not affected by GHSA-mj63-m3rc-8ppr. The vulnerability affects the XmlRenderer component which emits depth-proportional indentation, leading to O(n\u00b2) output size. However, XmlRenderer was introduced in version 2.0.0-beta1 (June 2021) and does not exist in any 1.x version. The target has only HTML rendering capability (HtmlRenderer). TuxCare backported thi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-mj63-m3rc-8ppr" }, "impact_statement": "not_affected \u2014 The target (league/commonmark 1.6.7) is not affected by GHSA-mj63-m3rc-8ppr. The vulnerability affects the XmlRenderer component which emits depth-proportional indentation, leading to O(n\u00b2) output size. However, XmlRenderer was introduced in version 2.0.0-beta1 (June 2021) and does not exist in any 1.x version. The target has only HTML rendering capability (HtmlRenderer). TuxCare backported thi..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54370 is fixed in version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2025-54370" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability CVE-2026-108357 affects version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-108357" }, "action_statement": "Vulnerability CVE-2026-108357 affects version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2026-108358 affects version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-108358" }, "action_statement": "Vulnerability CVE-2026-108358 affects version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability CVE-2026-108359 affects version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-108359" }, "action_statement": "Vulnerability CVE-2026-108359 affects version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability CVE-2026-108360 affects version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-108360" }, "action_statement": "Vulnerability CVE-2026-108360 affects version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34084 is fixed in version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-34084" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-35453 is fixed in version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-35453" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40296 is fixed in version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-40296" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40863 is fixed in version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-40863" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40902 is fixed in version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-40902" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59931 does not affect version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet. not_affected \u2014 PhpSpreadsheet 4.5.0 is not affected by CVE-2026-59931. This CVE specifically describes a bypass of the domain whitelist feature via HTTP redirects. The domain whitelist was introduced in PhpSpreadsheet version 5.4.0, and the target version 4.5.0 predates this feature entirely. Since there is no domain whitelist in version 4.5.0, the whitelist bypass vulnerability described in CVE-2026-59931 do...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59931" }, "impact_statement": "not_affected \u2014 PhpSpreadsheet 4.5.0 is not affected by CVE-2026-59931. This CVE specifically describes a bypass of the domain whitelist feature via HTTP redirects. The domain whitelist was introduced in PhpSpreadsheet version 5.4.0, and the target version 4.5.0 predates this feature entirely. Since there is no domain whitelist in version 4.5.0, the whitelist bypass vulnerability described in CVE-2026-59931 do..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59932 affects version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-59932" }, "action_statement": "Vulnerability CVE-2026-59932 affects version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59933 affects version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-59933" }, "action_statement": "Vulnerability CVE-2026-59933 affects version 4.5.0-p2+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54370 is fixed in version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2025-54370" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability CVE-2026-108357 affects version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-108357" }, "action_statement": "Vulnerability CVE-2026-108357 affects version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2026-108358 affects version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-108358" }, "action_statement": "Vulnerability CVE-2026-108358 affects version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability CVE-2026-108359 affects version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-108359" }, "action_statement": "Vulnerability CVE-2026-108359 affects version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability CVE-2026-108360 affects version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-108360" }, "action_statement": "Vulnerability CVE-2026-108360 affects version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34084 is fixed in version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-34084" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-35453 is fixed in version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-35453" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40296 is fixed in version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-40296" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40863 is fixed in version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-40863" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40902 is fixed in version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-40902" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59931 does not affect version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet. not_affected \u2014 PhpSpreadsheet 4.5.0 is not affected by CVE-2026-59931. This CVE specifically describes a bypass of the domain whitelist feature via HTTP redirects. The domain whitelist was introduced in PhpSpreadsheet version 5.4.0, and the target version 4.5.0 predates this feature entirely. Since there is no domain whitelist in version 4.5.0, the whitelist bypass vulnerability described in CVE-2026-59931 do...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59931" }, "impact_statement": "not_affected \u2014 PhpSpreadsheet 4.5.0 is not affected by CVE-2026-59931. This CVE specifically describes a bypass of the domain whitelist feature via HTTP redirects. The domain whitelist was introduced in PhpSpreadsheet version 5.4.0, and the target version 4.5.0 predates this feature entirely. Since there is no domain whitelist in version 4.5.0, the whitelist bypass vulnerability described in CVE-2026-59931 do..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59932 is fixed in version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-59932" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59933 is fixed in version 4.5.0-p3+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-59933" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46734 is fixed in version 1.6.7-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2025-46734" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-30838 affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-30838" }, "action_statement": "Vulnerability CVE-2026-30838 affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 1.6.7-p2+tuxcare of league/commonmark. The affected files doesn't exist in the version 1.6.7 and also The GitHub Advisory (GHSA-hh8v-hgvp-g3f5) lists the vulnerable range as >= 2.3.0 <= 2.8.1", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "The affected files doesn't exist in the version 1.6.7 and also The GitHub Advisory (GHSA-hh8v-hgvp-g3f5) lists the vulnerable range as >= 2.3.0 <= 2.8.1" }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71478 affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-71478" }, "action_statement": "Vulnerability CVE-2026-71478 affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71488 affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-71488" }, "action_statement": "Vulnerability CVE-2026-71488 affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare.", "vulnerability": { "name": "GHSA-3q6v-r5mr-hxv8" }, "action_statement": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8rr7-cvq3-gmfh affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare.", "vulnerability": { "name": "GHSA-8rr7-cvq3-gmfh" }, "action_statement": "Vulnerability GHSA-8rr7-cvq3-gmfh affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-10-08T11:23:00.200135+00:00", "status_notes": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p6+tuxcare.", "vulnerability": { "name": "GHSA-97jj-33gv-5xf9" }, "action_statement": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c2pc-g5qf-rfrf is fixed in version 1.6.7-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-c2pc-g5qf-rfrf" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare.", "vulnerability": { "name": "GHSA-f8fg-pg57-v4j8" }, "action_statement": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g2gp-3wwq-f4ph affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare.", "vulnerability": { "name": "GHSA-g2gp-3wwq-f4ph" }, "action_statement": "Vulnerability GHSA-g2gp-3wwq-f4ph affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-j8pm-gj4c-rq4x affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare.", "vulnerability": { "name": "GHSA-j8pm-gj4c-rq4x" }, "action_statement": "Vulnerability GHSA-j8pm-gj4c-rq4x affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jfm3-95jq-q3rf affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare.", "vulnerability": { "name": "GHSA-jfm3-95jq-q3rf" }, "action_statement": "Vulnerability GHSA-jfm3-95jq-q3rf affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jjv6-8j6v-6j52 affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare.", "vulnerability": { "name": "GHSA-jjv6-8j6v-6j52" }, "action_statement": "Vulnerability GHSA-jjv6-8j6v-6j52 affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability GHSA-mh25-x5hq-wrqp affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare.", "vulnerability": { "name": "GHSA-mh25-x5hq-wrqp" }, "action_statement": "Vulnerability GHSA-mh25-x5hq-wrqp affects version 1.6.7-p2+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability GHSA-mj63-m3rc-8ppr does not affect version 1.6.7-p2+tuxcare of league/commonmark. not_affected \u2014 The target (league/commonmark 1.6.7) is not affected by GHSA-mj63-m3rc-8ppr. The vulnerability affects the XmlRenderer component which emits depth-proportional indentation, leading to O(n\u00b2) output size. However, XmlRenderer was introduced in version 2.0.0-beta1 (June 2021) and does not exist in any 1.x version. The target has only HTML rendering capability (HtmlRenderer). TuxCare backported thi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-mj63-m3rc-8ppr" }, "impact_statement": "not_affected \u2014 The target (league/commonmark 1.6.7) is not affected by GHSA-mj63-m3rc-8ppr. The vulnerability affects the XmlRenderer component which emits depth-proportional indentation, leading to O(n\u00b2) output size. However, XmlRenderer was introduced in version 2.0.0-beta1 (June 2021) and does not exist in any 1.x version. The target has only HTML rendering capability (HtmlRenderer). TuxCare backported thi..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46734 is fixed in version 1.6.7-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2025-46734" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-30838 is fixed in version 1.6.7-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-30838" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 1.6.7-p4+tuxcare of league/commonmark. The affected files doesn't exist in the version 1.6.7 and also The GitHub Advisory (GHSA-hh8v-hgvp-g3f5) lists the vulnerable range as >= 2.3.0 <= 2.8.1", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "The affected files doesn't exist in the version 1.6.7 and also The GitHub Advisory (GHSA-hh8v-hgvp-g3f5) lists the vulnerable range as >= 2.3.0 <= 2.8.1" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71478 is fixed in version 1.6.7-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71478" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71488 is fixed in version 1.6.7-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71488" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 1.6.7-p4+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare.", "vulnerability": { "name": "GHSA-3q6v-r5mr-hxv8" }, "action_statement": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 1.6.7-p4+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8rr7-cvq3-gmfh affects version 1.6.7-p4+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare.", "vulnerability": { "name": "GHSA-8rr7-cvq3-gmfh" }, "action_statement": "Vulnerability GHSA-8rr7-cvq3-gmfh affects version 1.6.7-p4+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:23:00.200135+00:00", "status_notes": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 1.6.7-p4+tuxcare of league/commonmark, and is fixed in 1.6.7-p6+tuxcare.", "vulnerability": { "name": "GHSA-97jj-33gv-5xf9" }, "action_statement": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 1.6.7-p4+tuxcare of league/commonmark, and is fixed in 1.6.7-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c2pc-g5qf-rfrf is fixed in version 1.6.7-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-c2pc-g5qf-rfrf" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 1.6.7-p4+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare.", "vulnerability": { "name": "GHSA-f8fg-pg57-v4j8" }, "action_statement": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 1.6.7-p4+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g2gp-3wwq-f4ph is fixed in version 1.6.7-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-g2gp-3wwq-f4ph" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-j8pm-gj4c-rq4x affects version 1.6.7-p4+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare.", "vulnerability": { "name": "GHSA-j8pm-gj4c-rq4x" }, "action_statement": "Vulnerability GHSA-j8pm-gj4c-rq4x affects version 1.6.7-p4+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jfm3-95jq-q3rf is fixed in version 1.6.7-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jfm3-95jq-q3rf" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jjv6-8j6v-6j52 affects version 1.6.7-p4+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare.", "vulnerability": { "name": "GHSA-jjv6-8j6v-6j52" }, "action_statement": "Vulnerability GHSA-jjv6-8j6v-6j52 affects version 1.6.7-p4+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability GHSA-mh25-x5hq-wrqp affects version 1.6.7-p4+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare.", "vulnerability": { "name": "GHSA-mh25-x5hq-wrqp" }, "action_statement": "Vulnerability GHSA-mh25-x5hq-wrqp affects version 1.6.7-p4+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability GHSA-mj63-m3rc-8ppr does not affect version 1.6.7-p4+tuxcare of league/commonmark. not_affected \u2014 The target (league/commonmark 1.6.7) is not affected by GHSA-mj63-m3rc-8ppr. The vulnerability affects the XmlRenderer component which emits depth-proportional indentation, leading to O(n\u00b2) output size. However, XmlRenderer was introduced in version 2.0.0-beta1 (June 2021) and does not exist in any 1.x version. The target has only HTML rendering capability (HtmlRenderer). TuxCare backported thi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-mj63-m3rc-8ppr" }, "impact_statement": "not_affected \u2014 The target (league/commonmark 1.6.7) is not affected by GHSA-mj63-m3rc-8ppr. The vulnerability affects the XmlRenderer component which emits depth-proportional indentation, leading to O(n\u00b2) output size. However, XmlRenderer was introduced in version 2.0.0-beta1 (June 2021) and does not exist in any 1.x version. The target has only HTML rendering capability (HtmlRenderer). TuxCare backported thi..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46734 affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p2+tuxcare.", "vulnerability": { "name": "CVE-2025-46734" }, "action_statement": "Vulnerability CVE-2025-46734 affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-30838 affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-30838" }, "action_statement": "Vulnerability CVE-2026-30838 affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 1.6.7-p1+tuxcare of league/commonmark. The affected files doesn't exist in the version 1.6.7 and also The GitHub Advisory (GHSA-hh8v-hgvp-g3f5) lists the vulnerable range as >= 2.3.0 <= 2.8.1", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "The affected files doesn't exist in the version 1.6.7 and also The GitHub Advisory (GHSA-hh8v-hgvp-g3f5) lists the vulnerable range as >= 2.3.0 <= 2.8.1" }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71478 affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-71478" }, "action_statement": "Vulnerability CVE-2026-71478 affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71488 affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-71488" }, "action_statement": "Vulnerability CVE-2026-71488 affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare.", "vulnerability": { "name": "GHSA-3q6v-r5mr-hxv8" }, "action_statement": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8rr7-cvq3-gmfh affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare.", "vulnerability": { "name": "GHSA-8rr7-cvq3-gmfh" }, "action_statement": "Vulnerability GHSA-8rr7-cvq3-gmfh affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-10-08T11:23:00.200135+00:00", "status_notes": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p6+tuxcare.", "vulnerability": { "name": "GHSA-97jj-33gv-5xf9" }, "action_statement": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c2pc-g5qf-rfrf is fixed in version 1.6.7-p1+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-c2pc-g5qf-rfrf" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare.", "vulnerability": { "name": "GHSA-f8fg-pg57-v4j8" }, "action_statement": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g2gp-3wwq-f4ph affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare.", "vulnerability": { "name": "GHSA-g2gp-3wwq-f4ph" }, "action_statement": "Vulnerability GHSA-g2gp-3wwq-f4ph affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-j8pm-gj4c-rq4x affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare.", "vulnerability": { "name": "GHSA-j8pm-gj4c-rq4x" }, "action_statement": "Vulnerability GHSA-j8pm-gj4c-rq4x affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jfm3-95jq-q3rf affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare.", "vulnerability": { "name": "GHSA-jfm3-95jq-q3rf" }, "action_statement": "Vulnerability GHSA-jfm3-95jq-q3rf affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jjv6-8j6v-6j52 affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare.", "vulnerability": { "name": "GHSA-jjv6-8j6v-6j52" }, "action_statement": "Vulnerability GHSA-jjv6-8j6v-6j52 affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability GHSA-mh25-x5hq-wrqp affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare.", "vulnerability": { "name": "GHSA-mh25-x5hq-wrqp" }, "action_statement": "Vulnerability GHSA-mh25-x5hq-wrqp affects version 1.6.7-p1+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability GHSA-mj63-m3rc-8ppr does not affect version 1.6.7-p1+tuxcare of league/commonmark. not_affected \u2014 The target (league/commonmark 1.6.7) is not affected by GHSA-mj63-m3rc-8ppr. The vulnerability affects the XmlRenderer component which emits depth-proportional indentation, leading to O(n\u00b2) output size. However, XmlRenderer was introduced in version 2.0.0-beta1 (June 2021) and does not exist in any 1.x version. The target has only HTML rendering capability (HtmlRenderer). TuxCare backported thi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-mj63-m3rc-8ppr" }, "impact_statement": "not_affected \u2014 The target (league/commonmark 1.6.7) is not affected by GHSA-mj63-m3rc-8ppr. The vulnerability affects the XmlRenderer component which emits depth-proportional indentation, leading to O(n\u00b2) output size. However, XmlRenderer was introduced in version 2.0.0-beta1 (June 2021) and does not exist in any 1.x version. The target has only HTML rendering capability (HtmlRenderer). TuxCare backported thi..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54370 is fixed in version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2025-54370" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability CVE-2026-108357 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-108357" }, "action_statement": "Vulnerability CVE-2026-108357 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2026-108358 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-108358" }, "action_statement": "Vulnerability CVE-2026-108358 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability CVE-2026-108359 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-108359" }, "action_statement": "Vulnerability CVE-2026-108359 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability CVE-2026-108360 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-108360" }, "action_statement": "Vulnerability CVE-2026-108360 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34084 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-34084" }, "action_statement": "Vulnerability CVE-2026-34084 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-35453 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-35453" }, "action_statement": "Vulnerability CVE-2026-35453 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40296 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-40296" }, "action_statement": "Vulnerability CVE-2026-40296 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40863 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-40863" }, "action_statement": "Vulnerability CVE-2026-40863 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40902 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-40902" }, "action_statement": "Vulnerability CVE-2026-40902 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59931 does not affect version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet. not_affected \u2014 PhpSpreadsheet 4.5.0 is not affected by CVE-2026-59931. This CVE specifically describes a bypass of the domain whitelist feature via HTTP redirects. The domain whitelist was introduced in PhpSpreadsheet version 5.4.0, and the target version 4.5.0 predates this feature entirely. Since there is no domain whitelist in version 4.5.0, the whitelist bypass vulnerability described in CVE-2026-59931 do...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59931" }, "impact_statement": "not_affected \u2014 PhpSpreadsheet 4.5.0 is not affected by CVE-2026-59931. This CVE specifically describes a bypass of the domain whitelist feature via HTTP redirects. The domain whitelist was introduced in PhpSpreadsheet version 5.4.0, and the target version 4.5.0 predates this feature entirely. Since there is no domain whitelist in version 4.5.0, the whitelist bypass vulnerability described in CVE-2026-59931 do..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59932 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-59932" }, "action_statement": "Vulnerability CVE-2026-59932 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59933 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-59933" }, "action_statement": "Vulnerability CVE-2026-59933 affects version 4.5.0-p1+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46734 is fixed in version 1.6.7-p5+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2025-46734" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-30838 is fixed in version 1.6.7-p5+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-30838" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 1.6.7-p5+tuxcare of league/commonmark. The affected files doesn't exist in the version 1.6.7 and also The GitHub Advisory (GHSA-hh8v-hgvp-g3f5) lists the vulnerable range as >= 2.3.0 <= 2.8.1", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "The affected files doesn't exist in the version 1.6.7 and also The GitHub Advisory (GHSA-hh8v-hgvp-g3f5) lists the vulnerable range as >= 2.3.0 <= 2.8.1" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71478 is fixed in version 1.6.7-p5+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71478" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71488 is fixed in version 1.6.7-p5+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71488" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 1.6.7-p5+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare.", "vulnerability": { "name": "GHSA-3q6v-r5mr-hxv8" }, "action_statement": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 1.6.7-p5+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8rr7-cvq3-gmfh is fixed in version 1.6.7-p5+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-8rr7-cvq3-gmfh" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-10-08T11:23:00.200135+00:00", "status_notes": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 1.6.7-p5+tuxcare of league/commonmark, and is fixed in 1.6.7-p6+tuxcare.", "vulnerability": { "name": "GHSA-97jj-33gv-5xf9" }, "action_statement": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 1.6.7-p5+tuxcare of league/commonmark, and is fixed in 1.6.7-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c2pc-g5qf-rfrf is fixed in version 1.6.7-p5+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-c2pc-g5qf-rfrf" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 1.6.7-p5+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare.", "vulnerability": { "name": "GHSA-f8fg-pg57-v4j8" }, "action_statement": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 1.6.7-p5+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g2gp-3wwq-f4ph is fixed in version 1.6.7-p5+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-g2gp-3wwq-f4ph" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-j8pm-gj4c-rq4x is fixed in version 1.6.7-p5+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-j8pm-gj4c-rq4x" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jfm3-95jq-q3rf is fixed in version 1.6.7-p5+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jfm3-95jq-q3rf" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jjv6-8j6v-6j52 is fixed in version 1.6.7-p5+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jjv6-8j6v-6j52" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability GHSA-mh25-x5hq-wrqp affects version 1.6.7-p5+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare.", "vulnerability": { "name": "GHSA-mh25-x5hq-wrqp" }, "action_statement": "Vulnerability GHSA-mh25-x5hq-wrqp affects version 1.6.7-p5+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability GHSA-mj63-m3rc-8ppr does not affect version 1.6.7-p5+tuxcare of league/commonmark. not_affected \u2014 The target (league/commonmark 1.6.7) is not affected by GHSA-mj63-m3rc-8ppr. The vulnerability affects the XmlRenderer component which emits depth-proportional indentation, leading to O(n\u00b2) output size. However, XmlRenderer was introduced in version 2.0.0-beta1 (June 2021) and does not exist in any 1.x version. The target has only HTML rendering capability (HtmlRenderer). TuxCare backported thi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-mj63-m3rc-8ppr" }, "impact_statement": "not_affected \u2014 The target (league/commonmark 1.6.7) is not affected by GHSA-mj63-m3rc-8ppr. The vulnerability affects the XmlRenderer component which emits depth-proportional indentation, leading to O(n\u00b2) output size. However, XmlRenderer was introduced in version 2.0.0-beta1 (June 2021) and does not exist in any 1.x version. The target has only HTML rendering capability (HtmlRenderer). TuxCare backported thi..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2025-54370 is fixed in version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2025-54370" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability CVE-2026-108357 affects version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-108357" }, "action_statement": "Vulnerability CVE-2026-108357 affects version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2026-108358 is fixed in version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-108358" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability CVE-2026-108359 affects version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-108359" }, "action_statement": "Vulnerability CVE-2026-108359 affects version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability CVE-2026-108360 affects version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-108360" }, "action_statement": "Vulnerability CVE-2026-108360 affects version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet, and is fixed in 4.5.0-p5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2026-34084 is fixed in version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-34084" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2026-35453 is fixed in version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-35453" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2026-40296 is fixed in version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-40296" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2026-40863 is fixed in version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-40863" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2026-40902 is fixed in version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-40902" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2026-59931 does not affect version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet. not_affected \u2014 PhpSpreadsheet 4.5.0 is not affected by CVE-2026-59931. This CVE specifically describes a bypass of the domain whitelist feature via HTTP redirects. The domain whitelist was introduced in PhpSpreadsheet version 5.4.0, and the target version 4.5.0 predates this feature entirely. Since there is no domain whitelist in version 4.5.0, the whitelist bypass vulnerability described in CVE-2026-59931 do...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59931" }, "impact_statement": "not_affected \u2014 PhpSpreadsheet 4.5.0 is not affected by CVE-2026-59931. This CVE specifically describes a bypass of the domain whitelist feature via HTTP redirects. The domain whitelist was introduced in PhpSpreadsheet version 5.4.0, and the target version 4.5.0 predates this feature entirely. Since there is no domain whitelist in version 4.5.0, the whitelist bypass vulnerability described in CVE-2026-59931 do..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2026-59932 is fixed in version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-59932" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p4+tuxcare" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2026-59933 is fixed in version 4.5.0-p4+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-59933" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p5+tuxcare" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability CVE-2025-54370 is fixed in version 4.5.0-p5+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2025-54370" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p5+tuxcare" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability CVE-2026-108357 is fixed in version 4.5.0-p5+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-108357" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p5+tuxcare" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability CVE-2026-108358 is fixed in version 4.5.0-p5+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-108358" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p5+tuxcare" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability CVE-2026-108359 is fixed in version 4.5.0-p5+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-108359" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p5+tuxcare" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability CVE-2026-108360 is fixed in version 4.5.0-p5+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-108360" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p5+tuxcare" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability CVE-2026-34084 is fixed in version 4.5.0-p5+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-34084" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p5+tuxcare" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability CVE-2026-35453 is fixed in version 4.5.0-p5+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-35453" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p5+tuxcare" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability CVE-2026-40296 is fixed in version 4.5.0-p5+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-40296" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p5+tuxcare" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability CVE-2026-40863 is fixed in version 4.5.0-p5+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-40863" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p5+tuxcare" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability CVE-2026-40902 is fixed in version 4.5.0-p5+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-40902" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p5+tuxcare" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability CVE-2026-59931 does not affect version 4.5.0-p5+tuxcare of phpoffice/phpspreadsheet. not_affected \u2014 PhpSpreadsheet 4.5.0 is not affected by CVE-2026-59931. This CVE specifically describes a bypass of the domain whitelist feature via HTTP redirects. The domain whitelist was introduced in PhpSpreadsheet version 5.4.0, and the target version 4.5.0 predates this feature entirely. Since there is no domain whitelist in version 4.5.0, the whitelist bypass vulnerability described in CVE-2026-59931 do...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59931" }, "impact_statement": "not_affected \u2014 PhpSpreadsheet 4.5.0 is not affected by CVE-2026-59931. This CVE specifically describes a bypass of the domain whitelist feature via HTTP redirects. The domain whitelist was introduced in PhpSpreadsheet version 5.4.0, and the target version 4.5.0 predates this feature entirely. Since there is no domain whitelist in version 4.5.0, the whitelist bypass vulnerability described in CVE-2026-59931 do..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p5+tuxcare" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability CVE-2026-59932 is fixed in version 4.5.0-p5+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-59932" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/phpoffice/phpspreadsheet@4.5.0-p5+tuxcare" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability CVE-2026-59933 is fixed in version 4.5.0-p5+tuxcare of phpoffice/phpspreadsheet.", "vulnerability": { "name": "CVE-2026-59933" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46734 is fixed in version 1.6.7-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2025-46734" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-30838 is fixed in version 1.6.7-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-30838" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 1.6.7-p3+tuxcare of league/commonmark. The affected files doesn't exist in the version 1.6.7 and also The GitHub Advisory (GHSA-hh8v-hgvp-g3f5) lists the vulnerable range as >= 2.3.0 <= 2.8.1", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "The affected files doesn't exist in the version 1.6.7 and also The GitHub Advisory (GHSA-hh8v-hgvp-g3f5) lists the vulnerable range as >= 2.3.0 <= 2.8.1" }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71478 affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-71478" }, "action_statement": "Vulnerability CVE-2026-71478 affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71488 affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-71488" }, "action_statement": "Vulnerability CVE-2026-71488 affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare.", "vulnerability": { "name": "GHSA-3q6v-r5mr-hxv8" }, "action_statement": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8rr7-cvq3-gmfh affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare.", "vulnerability": { "name": "GHSA-8rr7-cvq3-gmfh" }, "action_statement": "Vulnerability GHSA-8rr7-cvq3-gmfh affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-10-08T11:23:00.200135+00:00", "status_notes": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p6+tuxcare.", "vulnerability": { "name": "GHSA-97jj-33gv-5xf9" }, "action_statement": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c2pc-g5qf-rfrf is fixed in version 1.6.7-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-c2pc-g5qf-rfrf" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare.", "vulnerability": { "name": "GHSA-f8fg-pg57-v4j8" }, "action_statement": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g2gp-3wwq-f4ph affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare.", "vulnerability": { "name": "GHSA-g2gp-3wwq-f4ph" }, "action_statement": "Vulnerability GHSA-g2gp-3wwq-f4ph affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-j8pm-gj4c-rq4x affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare.", "vulnerability": { "name": "GHSA-j8pm-gj4c-rq4x" }, "action_statement": "Vulnerability GHSA-j8pm-gj4c-rq4x affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jfm3-95jq-q3rf affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare.", "vulnerability": { "name": "GHSA-jfm3-95jq-q3rf" }, "action_statement": "Vulnerability GHSA-jfm3-95jq-q3rf affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jjv6-8j6v-6j52 affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare.", "vulnerability": { "name": "GHSA-jjv6-8j6v-6j52" }, "action_statement": "Vulnerability GHSA-jjv6-8j6v-6j52 affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability GHSA-mh25-x5hq-wrqp affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare.", "vulnerability": { "name": "GHSA-mh25-x5hq-wrqp" }, "action_statement": "Vulnerability GHSA-mh25-x5hq-wrqp affects version 1.6.7-p3+tuxcare of league/commonmark, and is fixed in 1.6.7-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@1.6.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability GHSA-mj63-m3rc-8ppr does not affect version 1.6.7-p3+tuxcare of league/commonmark. not_affected \u2014 The target (league/commonmark 1.6.7) is not affected by GHSA-mj63-m3rc-8ppr. The vulnerability affects the XmlRenderer component which emits depth-proportional indentation, leading to O(n\u00b2) output size. However, XmlRenderer was introduced in version 2.0.0-beta1 (June 2021) and does not exist in any 1.x version. The target has only HTML rendering capability (HtmlRenderer). TuxCare backported thi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-mj63-m3rc-8ppr" }, "impact_statement": "not_affected \u2014 The target (league/commonmark 1.6.7) is not affected by GHSA-mj63-m3rc-8ppr. The vulnerability affects the XmlRenderer component which emits depth-proportional indentation, leading to O(n\u00b2) output size. However, XmlRenderer was introduced in version 2.0.0-beta1 (June 2021) and does not exist in any 1.x version. The target has only HTML rendering capability (HtmlRenderer). TuxCare backported thi..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 12.58.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 12.58.0-p3+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 12.58.0-p3+tuxcare of laravel/framework. CVE-2018-15133 describes remote code execution via unsafe PHP object deserialization when decrypting X-XSRF-TOKEN cookies. The vulnerability required the attacker to know the application encryption key and craft a malicious serialized object payload. Laravel Framework fixed this in August 2018 by disabling PHP object serialization during cookie encryption/decryption (setting $serialize=false by default). The target repository (laravel/framework version 12.58.0-p6+tuxcare) contains the complete vendor fix, which was shipped in the upstream Laravel v12.58.0 release and imported via TuxCare snapshot commit 85d8011ca6. The vulnerable pattern (unsafe unserialize() calls on cookie data) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 describes remote code execution via unsafe PHP object deserialization when decrypting X-XSRF-TOKEN cookies. The vulnerability required the attacker to know the application encryption key and craft a malicious serialized object payload. Laravel Framework fixed this in August 2018 by disabling PHP object serialization during cookie encryption/decryption (setting $serialize=false by default). The target repository (laravel/framework version 12.58.0-p6+tuxcare) contains the complete vendor fix, which was shipped in the upstream Laravel v12.58.0 release and imported via TuxCare snapshot commit 85d8011ca6. The vulnerable pattern (unsafe unserialize() calls on cookie data) is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 12.58.0-p3+tuxcare of laravel/framework. CVE-2019-9081 describes a PHP object injection gadget chain in PendingCommand's __destruct method. While this gadget chain exists in version 12.58.0, the framework itself does not provide any production code path where user-controllable serialized data is unserialized and could trigger this gadget. PendingCommand is a testing utility instantiated only in test contexts. Laravel's production serialization (sessions, cookies, cache) uses encrypted/signed data or server-side storage, preventing arbitrary payload injection. The framework is not vulnerable when used as designed; exploitation requires downstream applications to explicitly unserialize untrusted user data without restrictions, which constitutes an application-level vulnerability, not a framework vulnerability.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 describes a PHP object injection gadget chain in PendingCommand's __destruct method. While this gadget chain exists in version 12.58.0, the framework itself does not provide any production code path where user-controllable serialized data is unserialized and could trigger this gadget. PendingCommand is a testing utility instantiated only in test contexts. Laravel's production serialization (sessions, cookies, cache) uses encrypted/signed data or server-side storage, preventing arbitrary payload injection. The framework is not vulnerable when used as designed; exploitation requires downstream applications to explicitly unserialize untrusted user data without restrictions, which constitutes an application-level vulnerability, not a framework vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 12.58.0-p3+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before v5.8.17 (May 2019). The target repository is Laravel Framework v12.58.0 (released late 2024), which already contains the upstream fix. The vulnerable code pattern (unescaped shell parameters in the link() method) is not present. Both exec() calls at lines 358 and 364 in src/Illuminate/Filesystem/Filesystem.php properly use escapeshellarg() on the $target and $link parameters, preventing OS command injection. This fix was shipped in the upstream v12.58.0 release that TuxCare imported via snapshot commit 85d8011ca6, not added as a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before v5.8.17 (May 2019). The target repository is Laravel Framework v12.58.0 (released late 2024), which already contains the upstream fix. The vulnerable code pattern (unescaped shell parameters in the link() method) is not present. Both exec() calls at lines 358 and 364 in src/Illuminate/Filesystem/Filesystem.php properly use escapeshellarg() on the $target and $link parameters, preventing OS command injection. This fix was shipped in the upstream v12.58.0 release that TuxCare imported via snapshot commit 85d8011ca6, not added as a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:41:57.354813+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 12.58.0-p3+tuxcare of laravel/framework. The target Laravel 12.58.0 is not affected by CVE-2020-24941. The vulnerability affected Laravel before 6.18.35 and 7.x before 7.24.0, where the $guarded property could be bypassed using JSON column nesting expressions or non-existent column names. The upstream fix (commit 897d107775, authored by Taylor Otwell on 2020-08-07) introduced the isGuardableColumn() method that validates attribute keys against actual database columns. This fix has been part of Laravel's codebase for years and was already present in the upstream v12.58.0 release that TuxCare onboarded in May 2026. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel 12.58.0 is not affected by CVE-2020-24941. The vulnerability affected Laravel before 6.18.35 and 7.x before 7.24.0, where the $guarded property could be bypassed using JSON column nesting expressions or non-existent column names. The upstream fix (commit 897d107775, authored by Taylor Otwell on 2020-08-07) introduced the isGuardableColumn() method that validates attribute keys against actual database columns. This fix has been part of Laravel's codebase for years and was already present in the upstream v12.58.0 release that TuxCare onboarded in May 2026. The vulnerable code pattern is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 12.58.0-p3+tuxcare of laravel/framework. Laravel v12.58.0 is not affected by CVE-2021-21263. The upstream release already contains the flattenValue() method which provides equivalent protection to the security patch. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) normalize array inputs to scalars before adding query bindings, preventing the query binding exploitation described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "Laravel v12.58.0 is not affected by CVE-2021-21263. The upstream release already contains the flattenValue() method which provides equivalent protection to the security patch. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) normalize array inputs to scalars before adding query bindings, preventing the query binding exploitation described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 12.58.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 12.58.0-p3+tuxcare of laravel/framework. CVE-2024-52301 (environment manipulation via query string) is NOT present in Laravel Framework v12.58.0-p6+tuxcare. The vulnerable pattern (unconditional use of $_SERVER['argv'] for environment detection) has been replaced with a SAPI-based guard that blocks web requests from using argv values. The fix was authored by Taylor Otwell and shipped in upstream Laravel v12.58.0 before TuxCare snapshotted this version. The current code at Application.php:791 checks runningInConsole() (which validates PHP_SAPI === 'cli') before accessing argv, preventing attackers from manipulating the framework environment via crafted query strings when register_argc_argv is enabled.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "CVE-2024-52301 (environment manipulation via query string) is NOT present in Laravel Framework v12.58.0-p6+tuxcare. The vulnerable pattern (unconditional use of $_SERVER['argv'] for environment detection) has been replaced with a SAPI-based guard that blocks web requests from using argv values. The fix was authored by Taylor Otwell and shipped in upstream Laravel v12.58.0 before TuxCare snapshotted this version. The current code at Application.php:791 checks runningInConsole() (which validates PHP_SAPI === 'cli') before accessing argv, preventing attackers from manipulating the framework environment via crafted query strings when register_argc_argv is enabled." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 12.58.0-p3+tuxcare of laravel/framework. not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-01T15:26:55.316610+00:00", "status_notes": "Vulnerability CVE-2026-102279 affects version 12.58.0-p3+tuxcare of laravel/framework, and is fixed in 12.58.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-102279" }, "action_statement": "Vulnerability CVE-2026-102279 affects version 12.58.0-p3+tuxcare of laravel/framework, and is fixed in 12.58.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2026-114508 affects version 12.58.0-p3+tuxcare of laravel/framework, and is fixed in 12.58.0-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-114508" }, "action_statement": "Vulnerability CVE-2026-114508 affects version 12.58.0-p3+tuxcare of laravel/framework, and is fixed in 12.58.0-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T12:31:25.113305+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 12.58.0-p3+tuxcare of laravel/framework, and is fixed in 12.58.0-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 12.58.0-p3+tuxcare of laravel/framework, and is fixed in 12.58.0-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:49:09.974795+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 12.58.0-p3+tuxcare of laravel/framework. not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 12.58.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 12.58.0-p3+tuxcare of laravel/framework. not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 12.58.0-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp is fixed in version 12.58.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:16:19.887305+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 12.58.0-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:18:00.235397+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 12.58.0-p3+tuxcare of laravel/framework. The target Laravel framework v12.58.0 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability (predictable SHA1-based cookie prefixes enabling encryption oracle attacks) was fixed in upstream Laravel 6.18.31 (July 2020). The fix uses HMAC-SHA1 with the secret key instead of plain SHA1, preventing attackers from crafting valid cookie prefixes. This fix was already present in the upstream Laravel 12.58.0 release that TuxCare onboarded, making the vulnerable code pattern absent from the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework v12.58.0 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability (predictable SHA1-based cookie prefixes enabling encryption oracle attacks) was fixed in upstream Laravel 6.18.31 (July 2020). The fix uses HMAC-SHA1 with the secret key instead of plain SHA1, preventing attackers from crafting valid cookie prefixes. This fix was already present in the upstream Laravel 12.58.0 release that TuxCare onboarded, making the vulnerable code pattern absent from the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 12.58.0-p3+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:41:57.354813+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 12.58.0-p3+tuxcare of laravel/framework. Laravel framework v12.58.0 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability affects Laravel 6.x (patched January 2021) where array values passed to query builder methods could inject unexpected bindings. The current version 12.58.0 already includes upstream protection via the flattenValue() helper method, which flattens array inputs to scalar values before binding. All 10 affected methods (where, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, whereBetween, havingBetween) use this protection. The fix was present in the upstream Laravel v12.58.0 release imported during onboarding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "Laravel framework v12.58.0 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability affects Laravel 6.x (patched January 2021) where array values passed to query builder methods could inject unexpected bindings. The current version 12.58.0 already includes upstream protection via the flattenValue() helper method, which flattens array inputs to scalar values before binding. All 10 affected methods (where, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, whereBetween, havingBetween) use this protection. The fix was present in the upstream Laravel v12.58.0 release imported during onboarding." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.3-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2017-14775. The vulnerability concerned non-constant-time token comparison in remember_me token verification, which was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.3 (released in 2021) already includes the upstream fix using hash_equals() for constant-time comparison in both DatabaseUserProvider and EloquentUserProvider. The fix came w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2017-14775. The vulnerability concerned non-constant-time token comparison in remember_me token verification, which was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.3 (released in 2021) already includes the upstream fix using hash_equals() for constant-time comparison in both DatabaseUserProvider and EloquentUserProvider. The fix came w..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.3-p1+tuxcare of laravel/framework. CVE-2018-15133 is NOT present in this target. The vulnerability involved remote code execution via PHP object injection when decrypted cookie values (especially X-XSRF-TOKEN) were passed through unserialize(). The upstream Laravel fix (August 2018, commit 97467e3ca by Taylor Otwell) disabled serialization for all cookies by setting `protected static $serialize = false` and passing `false` to all decrypt() calls. This fix was already included in Laravel v8.12.3 (December 2020) when TuxCare onboarded it via snapshot commit 90eb977a3b. The target code at HEAD (8.12.3-p5+tuxcare) contains this upstream fix: EncryptCookies.php line 34 sets `$serialize = false`, and Encrypter.php line 151 returns decrypted values directly without calling unserialize() when the flag is false. The vulnerable pattern (unserialization of decrypted cookies) does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 is NOT present in this target. The vulnerability involved remote code execution via PHP object injection when decrypted cookie values (especially X-XSRF-TOKEN) were passed through unserialize(). The upstream Laravel fix (August 2018, commit 97467e3ca by Taylor Otwell) disabled serialization for all cookies by setting `protected static $serialize = false` and passing `false` to all decrypt() calls. This fix was already included in Laravel v8.12.3 (December 2020) when TuxCare onboarded it via snapshot commit 90eb977a3b. The target code at HEAD (8.12.3-p5+tuxcare) contains this upstream fix: EncryptCookies.php line 34 sets `$serialize = false`, and Encrypter.php line 151 returns decrypted values directly without calling unserialize() when the flag is false. The vulnerable pattern (unserialization of decrypted cookies) does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 8.12.3-p1+tuxcare of laravel/framework. Laravel Framework 8.12.3 is not affected by CVE-2019-9081. While the PendingCommand class with its __destruct method exists and can execute commands when unserialized, there is no reachable attack path in Laravel's own code where attacker-controlled serialized data reaches unserialize(). The framework's unserialize() calls (e.g., Session/Store.php:98) operate on server-side data that is not directly controllable by attackers in default configuration. This is a gadget-chain component that requires an application-level unserialize vulnerability to be exploitable, not a framework vulnerability.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "Laravel Framework 8.12.3 is not affected by CVE-2019-9081. While the PendingCommand class with its __destruct method exists and can execute commands when unserialized, there is no reachable attack path in Laravel's own code where attacker-controlled serialized data reaches unserialize(). The framework's unserialize() calls (e.g., Session/Store.php:98) operate on server-side data that is not directly controllable by attackers in default configuration. This is a gadget-chain component that requires an application-level unserialize vulnerability to be exploitable, not a framework vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.3-p1+tuxcare of laravel/framework. The target Laravel Framework 8.12.3 is NOT AFFECTED by CVE-2020-19316 (OS command injection in Filesystem.php link() function). The vulnerability was fixed upstream by Taylor Otwell in commit 44c3feb604 (May 2019, Laravel 5.8.17). The fix wraps both $link and $target parameters with escapeshellarg() before passing to the Windows mklink shell command. Laravel 8.12.3 (released December 2020) already includes this fix. Line 320 of src/Illuminate/Filesystem/Filesystem.php shows: exec(\"mklink /{$mode} \".escapeshellarg($link).' '.escapeshellarg($target)); This protection prevents shell metacharacters from being interpreted as command injection sequences. The fix shipped in the upstream release that TuxCare onboarded via snapshot commit 90eb977a3b.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target Laravel Framework 8.12.3 is NOT AFFECTED by CVE-2020-19316 (OS command injection in Filesystem.php link() function). The vulnerability was fixed upstream by Taylor Otwell in commit 44c3feb604 (May 2019, Laravel 5.8.17). The fix wraps both $link and $target parameters with escapeshellarg() before passing to the Windows mklink shell command. Laravel 8.12.3 (released December 2020) already includes this fix. Line 320 of src/Illuminate/Filesystem/Filesystem.php shows: exec(\"mklink /{$mode} \".escapeshellarg($link).' '.escapeshellarg($target)); This protection prevents shell metacharacters from being interpreted as command injection sequences. The fix shipped in the upstream release that TuxCare onboarded via snapshot commit 90eb977a3b." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:41:18.186955+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.3-p1+tuxcare of laravel/framework. CVE-2020-24941 affects Laravel versions before 6.18.35 and 7.x before 7.24.0. The target repository is Laravel 8.12.3-p5+tuxcare, which was released after the CVE was fixed upstream (August 2020). The vulnerability pattern is not present in the target because the fix was already included in the upstream Laravel 8.12.3 release that TuxCare snapshotted. The GuardsAttributes.php file contains the isGuardableColumn() method and the fixed isGuarded() logic that validates attribute keys against actual database columns, preventing the mass-assignment bypass that the CVE describes.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 affects Laravel versions before 6.18.35 and 7.x before 7.24.0. The target repository is Laravel 8.12.3-p5+tuxcare, which was released after the CVE was fixed upstream (August 2020). The vulnerability pattern is not present in the target because the fix was already included in the upstream Laravel 8.12.3 release that TuxCare snapshotted. The GuardsAttributes.php file contains the isGuardableColumn() method and the fixed isGuarded() logic that validates attribute keys against actual database columns, preventing the mass-assignment bypass that the CVE describes." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.3-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.3-p1+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.3-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.3-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.3-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:27:02.675922+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.3-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.3-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-114508. The vulnerable JsonApi resources feature was introduced in Laravel 12.45.0, approximately 4 major versions after the target version. The entire JsonApi resources module, including the ResolvesJsonApiElements trait and sparseIncluded() method processing, does not exist in Laravel 8.x. The vulnerability requires processing HTTP query parameters w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-114508. The vulnerable JsonApi resources feature was introduced in Laravel 12.45.0, approximately 4 major versions after the target version. The entire JsonApi resources module, including the ResolvesJsonApiElements trait and sparseIncluded() method processing, does not exist in Laravel 8.x. The vulnerability requires processing HTTP query parameters w..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.3-p1+tuxcare of laravel/framework, and is fixed in 8.12.3-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.3-p1+tuxcare of laravel/framework, and is fixed in 8.12.3-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.3-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.12.3-p1+tuxcare of laravel/framework, and is fixed in 8.12.3-p2+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.12.3-p1+tuxcare of laravel/framework, and is fixed in 8.12.3-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.3-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 8.12.3 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie unserialization). The vulnerability affected Laravel 5.6.30 (August 2018) and was fixed by disabling PHP object serialization in cookie encryption. Laravel 8.12.3 (December 2020) shipped with this protection already in place: EncryptCookies uses `static $serialize = false` to prevent object unseria...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel 8.12.3 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie unserialization). The vulnerability affected Laravel 5.6.30 (August 2018) and was fixed by disabling PHP object serialization in cookie encryption. Laravel 8.12.3 (December 2020) shipped with this protection already in place: EncryptCookies uses `static $serialize = false` to prevent object unseria..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.3-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v8.12.3 is not affected by GHSA-7852-w36x-6mf6 (Laravel Encrypter IV length validation bypass). The vulnerability pattern is absent because the upstream fix was already present in Laravel v8.12.3 when TuxCare onboarded it. The validPayload() method includes IV length validation that prevents manipulated payloads from causing false-return decryption failures exploita...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework v8.12.3 is not affected by GHSA-7852-w36x-6mf6 (Laravel Encrypter IV length validation bypass). The vulnerability pattern is absent because the upstream fix was already present in Laravel v8.12.3 when TuxCare onboarded it. The validPayload() method includes IV length validation that prevents manipulated payloads from causing false-return decryption failures exploita..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.3-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.3-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:15:18.533137+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.3-p1+tuxcare of laravel/framework. Laravel framework 8.12.3-p5+tuxcare is not affected by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The vulnerability required using predictable sha1() hashes for cookie prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The target already contains the upstream security fix that replaced sha1() with hash_hmac() using the application's secret key, making cookie prefixes unguessable. This fix was shipped in upstream Laravel 8.12.3 (released October 29, 2020) before TuxCare began maintaining this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel framework 8.12.3-p5+tuxcare is not affected by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The vulnerability required using predictable sha1() hashes for cookie prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The target already contains the upstream security fix that replaced sha1() with hash_hmac() using the application's secret key, making cookie prefixes unguessable. This fix was shipped in upstream Laravel 8.12.3 (released October 29, 2020) before TuxCare began maintaining this version." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.3-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.3-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T15:16:46.609947+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 10.50.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 10.50.2-p4+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before version 5.5.10 due to timing-attack vulnerability in remember-me token verification. The target repository contains Laravel 10.50.2, which is approximately 7 years newer than the fixed version. The fix (constant-time token comparison using hash_equals) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. Both DatabaseUserProvi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before version 5.5.10 due to timing-attack vulnerability in remember-me token verification. The target repository contains Laravel 10.50.2, which is approximately 7 years newer than the fixed version. The fix (constant-time token comparison using hash_equals) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. Both DatabaseUserProvi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 10.50.2-p4+tuxcare of laravel/framework. Laravel 10.50.2 is not affected by CVE-2018-15133 (PHP object injection via unserialized cookies). The vulnerability affected Laravel 5.5.x/5.6.x in 2018 and was fixed upstream by disabling automatic unserialization in cookie decryption. Version 10.50.2 (released in 2024) was built on the fixed codebase and contains the defense by default: `protected static $serialize = false` ensures all decrypt() calls pass `false` for the unserialize parameter, preventing dangerous unserialize() from being called on attacker-controlled cookie data. The fix was authored by Taylor Otwell (upstream Laravel maintainer) and shipped in the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "Laravel 10.50.2 is not affected by CVE-2018-15133 (PHP object injection via unserialized cookies). The vulnerability affected Laravel 5.5.x/5.6.x in 2018 and was fixed upstream by disabling automatic unserialization in cookie decryption. Version 10.50.2 (released in 2024) was built on the fixed codebase and contains the defense by default: `protected static $serialize = false` ensures all decrypt() calls pass `false` for the unserialize parameter, preventing dangerous unserialize() from being called on attacker-controlled cookie data. The fix was authored by Taylor Otwell (upstream Laravel maintainer) and shipped in the upstream release that TuxCare onboarded." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 10.50.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 10.50.2-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 10.50.2-p4+tuxcare of laravel/framework. CVE-2020-19316 (OS command injection via unsanitized mklink parameters) does not affect Laravel Framework 10.50.2. The upstream fix (escapeshellarg on both $link and $target parameters) was introduced in Laravel 5.8.17 (May 2019) by Taylor Otwell and is present in the target version. Target version 10.50.2 is 5+ major versions after the fix, confirming it shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 (OS command injection via unsanitized mklink parameters) does not affect Laravel Framework 10.50.2. The upstream fix (escapeshellarg on both $link and $target parameters) was introduced in Laravel 5.8.17 (May 2019) by Taylor Otwell and is present in the target version. Target version 10.50.2 is 5+ major versions after the fix, confirming it shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:42:04.797220+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 10.50.2-p4+tuxcare of laravel/framework. CVE-2020-24941 is NOT present in Laravel 10.50.2-p4+tuxcare. The vulnerability involves bypassing the $guarded property using non-existent column names or JSON nesting expressions. The target contains the complete upstream fix: the isGuarded() method validates that column names exist in the database schema via isGuardableColumn(), treating non-existent columns as automatically guarded. This fix was included in the upstream Laravel 10.50.2 release and imported via TuxCare's onboarding commit (snapshot without history).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 is NOT present in Laravel 10.50.2-p4+tuxcare. The vulnerability involves bypassing the $guarded property using non-existent column names or JSON nesting expressions. The target contains the complete upstream fix: the isGuarded() method validates that column names exist in the database schema via isGuardableColumn(), treating non-existent columns as automatically guarded. This fix was included in the upstream Laravel 10.50.2 release and imported via TuxCare's onboarding commit (snapshot without history)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 10.50.2-p4+tuxcare of laravel/framework. Laravel 10.50.2 is not affected by CVE-2021-21263. The vulnerability targeted Laravel versions < 6.20.12, < 7.30.3, and < 8.22.1, and was patched in January 2021. The target version (10.50.2, released in 2024) already contains the fix from the upstream release. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) now use the flattenValue() method which prevents array values from adding unexpected query bindings. This fix was present in the upstream Laravel 10.50.2 release before TuxCare's onboarding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "Laravel 10.50.2 is not affected by CVE-2021-21263. The vulnerability targeted Laravel versions < 6.20.12, < 7.30.3, and < 8.22.1, and was patched in January 2021. The target version (10.50.2, released in 2024) already contains the fix from the upstream release. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) now use the flattenValue() method which prevents array values from adding unexpected query bindings. This fix was present in the upstream Laravel 10.50.2 release before TuxCare's onboarding." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 10.50.2-p4+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is NOT present in Laravel 10.50.2. The vulnerability was fixed upstream in December 2021 (Laravel 6.x/7.x/8.x), and the fix was already included when Laravel 10.x was released in February 2023. The target code shows all three components of the security fix: (1) ManagesLayouts.php generates parent placeholders using a random 40-charac...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is NOT present in Laravel 10.50.2. The vulnerability was fixed upstream in December 2021 (Laravel 6.x/7.x/8.x), and the fix was already included when Laravel 10.x was released in February 2023. The target code shows all three components of the security fix: (1) ManagesLayouts.php generates parent placeholders using a random 40-charac..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 10.50.2-p4+tuxcare of laravel/framework. The target repository (laravel/framework 10.50.2) is NOT affected by CVE-2024-52301. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when register_argc_argv was enabled. The fix\u2014checking runningInConsole() before using $_SERVER['argv'] for environment detection\u2014was already present in the upstream Laravel 10.50.2 release (Nov 12, 2024) and was imported by TuxCare via the onboarding snapshot commit. The vulnerable pattern (unconditional use of $_SERVER['argv']) is absent in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target repository (laravel/framework 10.50.2) is NOT affected by CVE-2024-52301. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when register_argc_argv was enabled. The fix\u2014checking runningInConsole() before using $_SERVER['argv'] for environment detection\u2014was already present in the upstream Laravel 10.50.2 release (Nov 12, 2024) and was imported by TuxCare via the onboarding snapshot commit. The vulnerable pattern (unconditional use of $_SERVER['argv']) is absent in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 10.50.2-p4+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 10.50.2-p4+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. The fix modifies the Validator class to preserve internal placeholder encoding when passing attribute names to File/Email/Password custom rules, preventing attackers from bypassing wildcard valid...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target repository (laravel/framework 10.50.2-p4+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. The fix modifies the Validator class to preserve internal placeholder encoding when passing attribute names to File/Email/Password custom rules, preventing attackers from bypassing wildcard valid..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T15:16:46.609947+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 10.50.2-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.50.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's new exception renderer feature that uses Tippy.js tooltips with allowHTML:true. Laravel 10.x uses a completely different exception handling system (Whoops library) and does not contain the vulnerable code pattern. The exception renderer with Tippy.js was introduced in Laravel 12.x and does not exist i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 10.50.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's new exception renderer feature that uses Tippy.js tooltips with allowHTML:true. Laravel 10.x uses a completely different exception handling system (Whoops library) and does not contain the vulnerable code pattern. The exception renderer with Tippy.js was introduced in Laravel 12.x and does not exist i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 10.50.2-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework 10.50.2-p4+tuxcare is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in the JsonApi resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x (December 2025). Laravel 10.x does not contain any JsonApi resource functionality. Exhaustive searches across all 2522 files in the repository found no JsonApi-related co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target Laravel Framework 10.50.2-p4+tuxcare is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in the JsonApi resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x (December 2025). Laravel 10.x does not contain any JsonApi resource functionality. Exhaustive searches across all 2522 files in the repository found no JsonApi-related co..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T15:16:50.127733+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 10.50.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:46:45.854078+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 10.50.2-p4+tuxcare of laravel/framework. not_affected \u2014 The target (Laravel 10.50.2-p4+tuxcare) is NOT AFFECTED by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input to limit/offset/skip/take functions on SQL Server. The fix (integer casting) was already present in upstream Laravel 10.50.2 when TuxCare onboarded it on 2026-05-05. Defense exists at two layers: (1) Builder methods cast inputs via (int) before stor...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The target (Laravel 10.50.2-p4+tuxcare) is NOT AFFECTED by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input to limit/offset/skip/take functions on SQL Server. The fix (integer casting) was already present in upstream Laravel 10.50.2 when TuxCare onboarded it on 2026-05-05. Defense exists at two layers: (1) Builder methods cast inputs via (int) before stor..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T15:16:46.609947+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 10.50.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:02:56.515055+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 10.50.2-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.50.2-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling serialization for cookies. Laravel 10.50.2 inherits this fix from upstream with a static $serialize = false property that prevents all cookie serialization. The vulnerable pattern (serialization enabled by default) is...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 10.50.2-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling serialization for cookies. Laravel 10.50.2 inherits this fix from upstream with a static $serialize = false property that prevents all cookie serialization. The vulnerable pattern (serialization enabled by default) is..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 10.50.2-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 10.50.2 is NOT AFFECTED by GHSA-7852-w36x-6mf6 (Encrypter IV length validation vulnerability). The fix for this vulnerability was already present in the upstream Laravel 10.50.2 release when TuxCare onboarded it. The vulnerable code pattern (missing IV length validation in validPayload method) is not present in the current HEAD. The defense validates that the base64...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework 10.50.2 is NOT AFFECTED by GHSA-7852-w36x-6mf6 (Encrypter IV length validation vulnerability). The fix for this vulnerability was already present in the upstream Laravel 10.50.2 release when TuxCare onboarded it. The vulnerable code pattern (missing IV length validation in validPayload method) is not present in the current HEAD. The defense validates that the base64..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T15:16:46.609947+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 10.50.2-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.50.2 does not contain the vulnerable local filesystem temporary signed URL feature. The LocalFilesystemAdapter class and its associated temporaryUrl()/temporaryUploadUrl() methods were introduced in Laravel 11.x. The vulnerable code path does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 10.50.2 does not contain the vulnerable local filesystem temporary signed URL feature. The LocalFilesystemAdapter class and its associated temporaryUrl()/temporaryUploadUrl() methods were introduced in Laravel 11.x. The vulnerable code path does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:19:00.657885+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 10.50.2-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability involves crafting HTTP request parameters as arrays (including nested arrays) where scalar values are expected, causing unexpected SQL query bindings. The fix (flattenValue method using Arr::flatten()) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. All vulnerable ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability involves crafting HTTP request parameters as arrays (including nested arrays) where scalar values are expected, causing unexpected SQL query bindings. The fix (flattenValue method using Arr::flatten()) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. All vulnerable ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:19:00.105438+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 10.50.2-p4+tuxcare of laravel/framework. Laravel Framework version 10.50.2 is not affected by GHSA-qm5c-m76r-2hfr (cookie session encryption oracle RCE vulnerability). The vulnerability was fixed upstream in Laravel 6.18.31 (July 2020) by replacing predictable sha1() cookie prefixes with HMAC-based prefixes using the secret key. Version 10.50.2 (released in 2024) already contains this fix as part of the upstream release. The target uses CookieValuePrefix class with hash_hmac for cookie prefixing, matching the patched version. No TuxCare backport was necessary for this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel Framework version 10.50.2 is not affected by GHSA-qm5c-m76r-2hfr (cookie session encryption oracle RCE vulnerability). The vulnerability was fixed upstream in Laravel 6.18.31 (July 2020) by replacing predictable sha1() cookie prefixes with HMAC-based prefixes using the secret key. Version 10.50.2 (released in 2024) already contains this fix as part of the upstream release. The target uses CookieValuePrefix class with hash_hmac for cookie prefixing, matching the patched version. No TuxCare backport was necessary for this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 10.50.2-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). All required integer casting defenses are present in the codebase. The fix was already included in the upstream Laravel 10.50.2 release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable pattern (unvalidated user input in limit/offset parameters reaching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). All required integer casting defenses are present in the codebase. The fix was already included in the upstream Laravel 10.50.2 release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable pattern (unvalidated user input in limit/offset parameters reaching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:42:13.594930+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 10.50.2-p4+tuxcare of laravel/framework. The target Laravel framework 10.50.2 is NOT AFFECTED by GHSA-x7p5-p2c9-phvg. The vulnerability pattern (unchecked array-to-binding expansion) is not present because the fix was already included in the upstream Laravel 10.50.2 release. All affected query builder methods (where, having, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, whereBetween, havingBetween) implement array flattening and binding limits via the `flattenValue()` helper method and `array_slice()` guards. The fix was present in the initial TuxCare snapshot commit that onboarded Laravel 10.50.2 from upstream, indicating it shipped with the upstream release rather than being backported by TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "The target Laravel framework 10.50.2 is NOT AFFECTED by GHSA-x7p5-p2c9-phvg. The vulnerability pattern (unchecked array-to-binding expansion) is not present because the fix was already included in the upstream Laravel 10.50.2 release. All affected query builder methods (where, having, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, whereBetween, havingBetween) implement array flattening and binding limits via the `flattenValue()` helper method and `array_slice()` guards. The fix was present in the initial TuxCare snapshot commit that onboarded Laravel 10.50.2 from upstream, indicating it shipped with the upstream release rather than being backported by TuxCare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 9.52.21-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 9.52.21-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 9.52.21-p4+tuxcare is not affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 9.52.21, released years later, already contains this fix. Both DatabaseUserProvider.php and Eloque...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 9.52.21-p4+tuxcare is not affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 9.52.21, released years later, already contains this fix. Both DatabaseUserProvider.php and Eloque..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 9.52.21-p1+tuxcare of laravel/framework. The target Laravel framework version 9.52.21-p4+tuxcare is NOT AFFECTED by CVE-2018-15133. The vulnerability pattern (automatic PHP deserialization of decrypted cookie/header values) is not present because the upstream Laravel 9.52.21 release already shipped with the fix. The defense mechanism (passing `false` to the encrypter's decrypt method to prevent unserialize()) is active for both X-XSRF-TOKEN headers and encrypted cookies. All decrypt operations use `static::$serialize = false`, preventing the dangerous unserialize() call that would enable RCE through PHP object injection.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "The target Laravel framework version 9.52.21-p4+tuxcare is NOT AFFECTED by CVE-2018-15133. The vulnerability pattern (automatic PHP deserialization of decrypted cookie/header values) is not present because the upstream Laravel 9.52.21 release already shipped with the fix. The defense mechanism (passing `false` to the encrypter's decrypt method to prevent unserialize()) is active for both X-XSRF-TOKEN headers and encrypted cookies. All decrypt operations use `static::$serialize = false`, preventing the dangerous unserialize() call that would enable RCE through PHP object injection." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 9.52.21-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 9.52.21-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 9.52.21-p1+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before 5.8.17. Target version 9.52.21 already contains the upstream fix (escapeshellarg on both parameters in Filesystem.php::link()). The vulnerable code pattern is not present. The fix was shipped in upstream release v9.52.21, which was onboarded by TuxCare via snapshot commit ed9bb51c72.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before 5.8.17. Target version 9.52.21 already contains the upstream fix (escapeshellarg on both parameters in Filesystem.php::link()). The vulnerable code pattern is not present. The fix was shipped in upstream release v9.52.21, which was onboarded by TuxCare via snapshot commit ed9bb51c72." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:42:13.594930+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 9.52.21-p1+tuxcare of laravel/framework. CVE-2020-24941 does not affect this Laravel 9.52.21 installation. The vulnerability involved missing validation that attribute keys in mass-assignment correspond to actual database columns, allowing attackers to bypass $guarded protection using fake column names with JSON notation. The target code contains the complete upstream fix (isGuardableColumn method verifying against actual database columns) which was already present in Laravel v9.52.21 when TuxCare onboarded it in snapshot commit ed9bb51c. No TuxCare backport was needed as the fix shipped in the upstream release (original fix by Taylor Otwell in commit 897d107 for Laravel 6.x in August 2020, forward-ported to all subsequent versions including 9.x released February 2022).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 does not affect this Laravel 9.52.21 installation. The vulnerability involved missing validation that attribute keys in mass-assignment correspond to actual database columns, allowing attackers to bypass $guarded protection using fake column names with JSON notation. The target code contains the complete upstream fix (isGuardableColumn method verifying against actual database columns) which was already present in Laravel v9.52.21 when TuxCare onboarded it in snapshot commit ed9bb51c. No TuxCare backport was needed as the fix shipped in the upstream release (original fix by Taylor Otwell in commit 897d107 for Laravel 6.x in August 2020, forward-ported to all subsequent versions including 9.x released February 2022)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 9.52.21-p1+tuxcare of laravel/framework. Laravel framework v9.52.21 is not affected by CVE-2021-21263. The vulnerability affects versions <6.20.12, <7.30.3, and <8.22.1. Version 9.52.21 already contains the upstream fix that limits query bindings when array values are passed where scalar values are expected. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() method or array_slice() to restrict array inputs to expected element counts, preventing query binding exploitation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "Laravel framework v9.52.21 is not affected by CVE-2021-21263. The vulnerability affects versions <6.20.12, <7.30.3, and <8.22.1. Version 9.52.21 already contains the upstream fix that limits query bindings when array values are passed where scalar values are expected. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() method or array_slice() to restrict array inputs to expected element counts, preventing query binding exploitation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 9.52.21-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework 9.52.21 is not affected by CVE-2021-43808. The vulnerability fix (random per-request salt for parent placeholder hashing in Blade templates) was already present in the upstream Laravel 9.52.21 release when TuxCare onboarded it. The vulnerable pattern (predictable parent placeholder hash based solely on sha1($section)) is not present in the codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 The target Laravel Framework 9.52.21 is not affected by CVE-2021-43808. The vulnerability fix (random per-request salt for parent placeholder hashing in Blade templates) was already present in the upstream Laravel 9.52.21 release when TuxCare onboarded it. The vulnerable pattern (predictable parent placeholder hash based solely on sha1($section)) is not present in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 9.52.21-p1+tuxcare of laravel/framework. The target repository (Laravel framework 9.52.21) is NOT affected by CVE-2024-52301. The vulnerable code pattern that allowed environment manipulation via query strings is not present. The upstream Laravel team (Taylor Otwell) fixed this vulnerability in version 9.52.17 by adding a check to ensure $_SERVER['argv'] is only used when running in console mode (PHP_SAPI === 'cli' || PHP_SAPI === 'phpdbg'). This fix was already present in the upstream release 9.52.21 that TuxCare onboarded, making it an upstream fix rather than a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target repository (Laravel framework 9.52.21) is NOT affected by CVE-2024-52301. The vulnerable code pattern that allowed environment manipulation via query strings is not present. The upstream Laravel team (Taylor Otwell) fixed this vulnerability in version 9.52.17 by adding a check to ensure $_SERVER['argv'] is only used when running in console mode (PHP_SAPI === 'cli' || PHP_SAPI === 'phpdbg'). This fix was already present in the upstream release 9.52.21 that TuxCare onboarded, making it an upstream fix rather than a TuxCare backport." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 affects version 9.52.21-p1+tuxcare of laravel/framework, and is fixed in 9.52.21-p2+tuxcare.", "vulnerability": { "name": "CVE-2025-27515" }, "action_statement": "Vulnerability CVE-2025-27515 affects version 9.52.21-p1+tuxcare of laravel/framework, and is fixed in 9.52.21-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:36:58.499788+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 9.52.21-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-102279. The vulnerability concerns XSS via Tippy.js tooltips with allowHTML:true in Laravel 12.x's new exception renderer component. This component does not exist in Laravel 9.52.21, which uses Whoops or Symfony's HtmlErrorRenderer for exception display instead. Exhaustive searches found no tippy.js, allowHTML, or formatted-source.blade.php in the tar...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-102279. The vulnerability concerns XSS via Tippy.js tooltips with allowHTML:true in Laravel 12.x's new exception renderer component. This component does not exist in Laravel 9.52.21, which uses Whoops or Symfony's HtmlErrorRenderer for exception display instead. Exhaustive searches found no tippy.js, allowHTML, or formatted-source.blade.php in the tar..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 9.52.21-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource implementation (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x. Version 9.52.21 predates this feature entirely\u2014the JsonApi namespace, related classes, and the vulnerable include parameter processing mechanism do not exist in this version. The target cannot...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource implementation (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x. Version 9.52.21 predates this feature entirely\u2014the JsonApi namespace, related classes, and the vulnerable include parameter processing mechanism do not exist in this version. The target cannot..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-28T13:20:48.512438+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 9.52.21-p1+tuxcare of laravel/framework, and is fixed in 9.52.21-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 9.52.21-p1+tuxcare of laravel/framework, and is fixed in 9.52.21-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 9.52.21-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "action_statement": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 9.52.21-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 9.52.21-p1+tuxcare of laravel/framework, and is fixed in 9.52.21-p3+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 9.52.21-p1+tuxcare of laravel/framework, and is fixed in 9.52.21-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:04:11.478044+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 9.52.21-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-6jvx-8ch9-j2jr (CVE-2018-15133). The vulnerability involves PHP object injection through cookie deserialization. The upstream Laravel team fixed this in version 5.6.30 (August 2018) by disabling serialization for all cookies. Laravel 9.52.21, released years later, includes this fix via the EncryptCookies middleware's `$serialize = false` default. The vuln...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-6jvx-8ch9-j2jr (CVE-2018-15133). The vulnerability involves PHP object injection through cookie deserialization. The upstream Laravel team fixed this in version 5.6.30 (August 2018) by disabling serialization for all cookies. Laravel 9.52.21, released years later, includes this fix via the EncryptCookies middleware's `$serialize = false` default. The vuln..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 9.52.21-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework v9.52.21 is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decryption to return false instead of throwing an exception on manipulated payloads) was fixed by the upstream vendor in March 2018. The fix is present in the target at src/Illuminate/Encryption/Encrypter.php:246, where validPayload() validates that the base64-...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 Laravel Framework v9.52.21 is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decryption to return false instead of throwing an exception on manipulated payloads) was fixed by the upstream vendor in March 2018. The fix is present in the target at src/Illuminate/Encryption/Encrypter.php:246, where validPayload() validates that the base64-..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 9.52.21-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 9.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 9.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 9.52.21-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable code pattern (uncontrolled array inputs causing unexpected query bindings) is not present because the upstream Laravel 9.52.21 release already contained all necessary fixes before TuxCare's snapshot import. The target implements the same defenses as the vendor patches: flattenValue() method normalizes array inputs...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable code pattern (uncontrolled array inputs causing unexpected query bindings) is not present because the upstream Laravel 9.52.21 release already contained all necessary fixes before TuxCare's snapshot import. The target implements the same defenses as the vendor patches: flattenValue() method normalizes array inputs..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:19:00.105438+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 9.52.21-p1+tuxcare of laravel/framework. The target Laravel 9.52.21-p4+tuxcare is NOT vulnerable to GHSA-qm5c-m76r-2hfr (cookie session driver RCE via encryption oracle). The vulnerability was fixed in upstream Laravel 6.18.31 (July 2020) by replacing predictable SHA1-based cookie prefixes with HMAC-based validation requiring the encryption key. Laravel 9.52.21 (released 2023) already contains this fix. The target was onboarded from the upstream release via snapshot commit ed9bb51c72, which brought the pre-fixed version. No vulnerable code patterns exist in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel 9.52.21-p4+tuxcare is NOT vulnerable to GHSA-qm5c-m76r-2hfr (cookie session driver RCE via encryption oracle). The vulnerability was fixed in upstream Laravel 6.18.31 (July 2020) by replacing predictable SHA1-based cookie prefixes with HMAC-based validation requiring the encryption key. Laravel 9.52.21 (released 2023) already contains this fix. The target was onboarded from the upstream release via snapshot commit ed9bb51c72, which brought the pre-fixed version. No vulnerable code patterns exist in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 9.52.21-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v9.52.21-p4+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL injection via limit/offset in SQL Server). The vulnerability pattern is not present because the fix was already included in the upstream Laravel v9.52.21 release that TuxCare onboarded. All required protections are in place: integer casting in Builder.php limit()/offset() methods and SqlServerGrammar.ph...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel framework v9.52.21-p4+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL injection via limit/offset in SQL Server). The vulnerability pattern is not present because the fix was already included in the upstream Laravel v9.52.21 release that TuxCare onboarded. All required protections are in place: integer casting in Builder.php limit()/offset() methods and SqlServerGrammar.ph..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:42:13.594930+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 9.52.21-p1+tuxcare of laravel/framework. Target Laravel 9.52.21 is not affected by GHSA-x7p5-p2c9-phvg. The fix for this vulnerability was already present in the upstream Laravel 9.52.21 release that TuxCare onboarded. The target contains the `flattenValue()` helper method (line 3720-3723 in Builder.php) that flattens nested arrays and extracts the first scalar element, which is semantically identical to the vendor patches' `scalarValue()` helper. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use this helper to limit query bindings to expected counts, preventing the injection of unexpected bindings that could cause queries to return unexpected results.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "Target Laravel 9.52.21 is not affected by GHSA-x7p5-p2c9-phvg. The fix for this vulnerability was already present in the upstream Laravel 9.52.21 release that TuxCare onboarded. The target contains the `flattenValue()` helper method (line 3720-3723 in Builder.php) that flattens nested arrays and extracts the first scalar element, which is semantically identical to the vendor patches' `scalarValue()` helper. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use this helper to limit query bindings to expected counts, preventing the injection of unexpected bindings that could cause queries to return unexpected results." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.3-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2017-14775. The vulnerability concerned non-constant-time token comparison in remember_me token verification, which was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.3 (released in 2021) already includes the upstream fix using hash_equals() for constant-time comparison in both DatabaseUserProvider and EloquentUserProvider. The fix came w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2017-14775. The vulnerability concerned non-constant-time token comparison in remember_me token verification, which was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.3 (released in 2021) already includes the upstream fix using hash_equals() for constant-time comparison in both DatabaseUserProvider and EloquentUserProvider. The fix came w..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.3-p3+tuxcare of laravel/framework. CVE-2018-15133 is NOT present in this target. The vulnerability involved remote code execution via PHP object injection when decrypted cookie values (especially X-XSRF-TOKEN) were passed through unserialize(). The upstream Laravel fix (August 2018, commit 97467e3ca by Taylor Otwell) disabled serialization for all cookies by setting `protected static $serialize = false` and passing `false` to all decrypt() calls. This fix was already included in Laravel v8.12.3 (December 2020) when TuxCare onboarded it via snapshot commit 90eb977a3b. The target code at HEAD (8.12.3-p5+tuxcare) contains this upstream fix: EncryptCookies.php line 34 sets `$serialize = false`, and Encrypter.php line 151 returns decrypted values directly without calling unserialize() when the flag is false. The vulnerable pattern (unserialization of decrypted cookies) does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 is NOT present in this target. The vulnerability involved remote code execution via PHP object injection when decrypted cookie values (especially X-XSRF-TOKEN) were passed through unserialize(). The upstream Laravel fix (August 2018, commit 97467e3ca by Taylor Otwell) disabled serialization for all cookies by setting `protected static $serialize = false` and passing `false` to all decrypt() calls. This fix was already included in Laravel v8.12.3 (December 2020) when TuxCare onboarded it via snapshot commit 90eb977a3b. The target code at HEAD (8.12.3-p5+tuxcare) contains this upstream fix: EncryptCookies.php line 34 sets `$serialize = false`, and Encrypter.php line 151 returns decrypted values directly without calling unserialize() when the flag is false. The vulnerable pattern (unserialization of decrypted cookies) does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 8.12.3-p3+tuxcare of laravel/framework. Laravel Framework 8.12.3 is not affected by CVE-2019-9081. While the PendingCommand class with its __destruct method exists and can execute commands when unserialized, there is no reachable attack path in Laravel's own code where attacker-controlled serialized data reaches unserialize(). The framework's unserialize() calls (e.g., Session/Store.php:98) operate on server-side data that is not directly controllable by attackers in default configuration. This is a gadget-chain component that requires an application-level unserialize vulnerability to be exploitable, not a framework vulnerability.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "Laravel Framework 8.12.3 is not affected by CVE-2019-9081. While the PendingCommand class with its __destruct method exists and can execute commands when unserialized, there is no reachable attack path in Laravel's own code where attacker-controlled serialized data reaches unserialize(). The framework's unserialize() calls (e.g., Session/Store.php:98) operate on server-side data that is not directly controllable by attackers in default configuration. This is a gadget-chain component that requires an application-level unserialize vulnerability to be exploitable, not a framework vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.3-p3+tuxcare of laravel/framework. The target Laravel Framework 8.12.3 is NOT AFFECTED by CVE-2020-19316 (OS command injection in Filesystem.php link() function). The vulnerability was fixed upstream by Taylor Otwell in commit 44c3feb604 (May 2019, Laravel 5.8.17). The fix wraps both $link and $target parameters with escapeshellarg() before passing to the Windows mklink shell command. Laravel 8.12.3 (released December 2020) already includes this fix. Line 320 of src/Illuminate/Filesystem/Filesystem.php shows: exec(\"mklink /{$mode} \".escapeshellarg($link).' '.escapeshellarg($target)); This protection prevents shell metacharacters from being interpreted as command injection sequences. The fix shipped in the upstream release that TuxCare onboarded via snapshot commit 90eb977a3b.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target Laravel Framework 8.12.3 is NOT AFFECTED by CVE-2020-19316 (OS command injection in Filesystem.php link() function). The vulnerability was fixed upstream by Taylor Otwell in commit 44c3feb604 (May 2019, Laravel 5.8.17). The fix wraps both $link and $target parameters with escapeshellarg() before passing to the Windows mklink shell command. Laravel 8.12.3 (released December 2020) already includes this fix. Line 320 of src/Illuminate/Filesystem/Filesystem.php shows: exec(\"mklink /{$mode} \".escapeshellarg($link).' '.escapeshellarg($target)); This protection prevents shell metacharacters from being interpreted as command injection sequences. The fix shipped in the upstream release that TuxCare onboarded via snapshot commit 90eb977a3b." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:41:18.186955+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.3-p3+tuxcare of laravel/framework. CVE-2020-24941 affects Laravel versions before 6.18.35 and 7.x before 7.24.0. The target repository is Laravel 8.12.3-p5+tuxcare, which was released after the CVE was fixed upstream (August 2020). The vulnerability pattern is not present in the target because the fix was already included in the upstream Laravel 8.12.3 release that TuxCare snapshotted. The GuardsAttributes.php file contains the isGuardableColumn() method and the fixed isGuarded() logic that validates attribute keys against actual database columns, preventing the mass-assignment bypass that the CVE describes.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 affects Laravel versions before 6.18.35 and 7.x before 7.24.0. The target repository is Laravel 8.12.3-p5+tuxcare, which was released after the CVE was fixed upstream (August 2020). The vulnerability pattern is not present in the target because the fix was already included in the upstream Laravel 8.12.3 release that TuxCare snapshotted. The GuardsAttributes.php file contains the isGuardableColumn() method and the fixed isGuarded() logic that validates attribute keys against actual database columns, preventing the mass-assignment bypass that the CVE describes." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.3-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.3-p3+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.3-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.3-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.3-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-09-29T20:27:02.675922+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.3-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.3-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-114508. The vulnerable JsonApi resources feature was introduced in Laravel 12.45.0, approximately 4 major versions after the target version. The entire JsonApi resources module, including the ResolvesJsonApiElements trait and sparseIncluded() method processing, does not exist in Laravel 8.x. The vulnerability requires processing HTTP query parameters w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-114508. The vulnerable JsonApi resources feature was introduced in Laravel 12.45.0, approximately 4 major versions after the target version. The entire JsonApi resources module, including the ResolvesJsonApiElements trait and sparseIncluded() method processing, does not exist in Laravel 8.x. The vulnerability requires processing HTTP query parameters w..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.3-p3+tuxcare of laravel/framework, and is fixed in 8.12.3-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.3-p3+tuxcare of laravel/framework, and is fixed in 8.12.3-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.3-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.3-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.3-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 8.12.3 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie unserialization). The vulnerability affected Laravel 5.6.30 (August 2018) and was fixed by disabling PHP object serialization in cookie encryption. Laravel 8.12.3 (December 2020) shipped with this protection already in place: EncryptCookies uses `static $serialize = false` to prevent object unseria...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel 8.12.3 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie unserialization). The vulnerability affected Laravel 5.6.30 (August 2018) and was fixed by disabling PHP object serialization in cookie encryption. Laravel 8.12.3 (December 2020) shipped with this protection already in place: EncryptCookies uses `static $serialize = false` to prevent object unseria..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.3-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v8.12.3 is not affected by GHSA-7852-w36x-6mf6 (Laravel Encrypter IV length validation bypass). The vulnerability pattern is absent because the upstream fix was already present in Laravel v8.12.3 when TuxCare onboarded it. The validPayload() method includes IV length validation that prevents manipulated payloads from causing false-return decryption failures exploita...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework v8.12.3 is not affected by GHSA-7852-w36x-6mf6 (Laravel Encrypter IV length validation bypass). The vulnerability pattern is absent because the upstream fix was already present in Laravel v8.12.3 when TuxCare onboarded it. The validPayload() method includes IV length validation that prevents manipulated payloads from causing false-return decryption failures exploita..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.3-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.3-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:15:18.533137+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.3-p3+tuxcare of laravel/framework. Laravel framework 8.12.3-p5+tuxcare is not affected by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The vulnerability required using predictable sha1() hashes for cookie prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The target already contains the upstream security fix that replaced sha1() with hash_hmac() using the application's secret key, making cookie prefixes unguessable. This fix was shipped in upstream Laravel 8.12.3 (released October 29, 2020) before TuxCare began maintaining this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel framework 8.12.3-p5+tuxcare is not affected by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The vulnerability required using predictable sha1() hashes for cookie prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The target already contains the upstream security fix that replaced sha1() with hash_hmac() using the application's secret key, making cookie prefixes unguessable. This fix was shipped in upstream Laravel 8.12.3 (released October 29, 2020) before TuxCare began maintaining this version." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.3-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.3-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-01T15:26:55.316610+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 12.58.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 12.58.0-p4+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 12.58.0-p4+tuxcare of laravel/framework. CVE-2018-15133 describes remote code execution via unsafe PHP object deserialization when decrypting X-XSRF-TOKEN cookies. The vulnerability required the attacker to know the application encryption key and craft a malicious serialized object payload. Laravel Framework fixed this in August 2018 by disabling PHP object serialization during cookie encryption/decryption (setting $serialize=false by default). The target repository (laravel/framework version 12.58.0-p6+tuxcare) contains the complete vendor fix, which was shipped in the upstream Laravel v12.58.0 release and imported via TuxCare snapshot commit 85d8011ca6. The vulnerable pattern (unsafe unserialize() calls on cookie data) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 describes remote code execution via unsafe PHP object deserialization when decrypting X-XSRF-TOKEN cookies. The vulnerability required the attacker to know the application encryption key and craft a malicious serialized object payload. Laravel Framework fixed this in August 2018 by disabling PHP object serialization during cookie encryption/decryption (setting $serialize=false by default). The target repository (laravel/framework version 12.58.0-p6+tuxcare) contains the complete vendor fix, which was shipped in the upstream Laravel v12.58.0 release and imported via TuxCare snapshot commit 85d8011ca6. The vulnerable pattern (unsafe unserialize() calls on cookie data) is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 12.58.0-p4+tuxcare of laravel/framework. CVE-2019-9081 describes a PHP object injection gadget chain in PendingCommand's __destruct method. While this gadget chain exists in version 12.58.0, the framework itself does not provide any production code path where user-controllable serialized data is unserialized and could trigger this gadget. PendingCommand is a testing utility instantiated only in test contexts. Laravel's production serialization (sessions, cookies, cache) uses encrypted/signed data or server-side storage, preventing arbitrary payload injection. The framework is not vulnerable when used as designed; exploitation requires downstream applications to explicitly unserialize untrusted user data without restrictions, which constitutes an application-level vulnerability, not a framework vulnerability.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 describes a PHP object injection gadget chain in PendingCommand's __destruct method. While this gadget chain exists in version 12.58.0, the framework itself does not provide any production code path where user-controllable serialized data is unserialized and could trigger this gadget. PendingCommand is a testing utility instantiated only in test contexts. Laravel's production serialization (sessions, cookies, cache) uses encrypted/signed data or server-side storage, preventing arbitrary payload injection. The framework is not vulnerable when used as designed; exploitation requires downstream applications to explicitly unserialize untrusted user data without restrictions, which constitutes an application-level vulnerability, not a framework vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 12.58.0-p4+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before v5.8.17 (May 2019). The target repository is Laravel Framework v12.58.0 (released late 2024), which already contains the upstream fix. The vulnerable code pattern (unescaped shell parameters in the link() method) is not present. Both exec() calls at lines 358 and 364 in src/Illuminate/Filesystem/Filesystem.php properly use escapeshellarg() on the $target and $link parameters, preventing OS command injection. This fix was shipped in the upstream v12.58.0 release that TuxCare imported via snapshot commit 85d8011ca6, not added as a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before v5.8.17 (May 2019). The target repository is Laravel Framework v12.58.0 (released late 2024), which already contains the upstream fix. The vulnerable code pattern (unescaped shell parameters in the link() method) is not present. Both exec() calls at lines 358 and 364 in src/Illuminate/Filesystem/Filesystem.php properly use escapeshellarg() on the $target and $link parameters, preventing OS command injection. This fix was shipped in the upstream v12.58.0 release that TuxCare imported via snapshot commit 85d8011ca6, not added as a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:41:57.354813+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 12.58.0-p4+tuxcare of laravel/framework. The target Laravel 12.58.0 is not affected by CVE-2020-24941. The vulnerability affected Laravel before 6.18.35 and 7.x before 7.24.0, where the $guarded property could be bypassed using JSON column nesting expressions or non-existent column names. The upstream fix (commit 897d107775, authored by Taylor Otwell on 2020-08-07) introduced the isGuardableColumn() method that validates attribute keys against actual database columns. This fix has been part of Laravel's codebase for years and was already present in the upstream v12.58.0 release that TuxCare onboarded in May 2026. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel 12.58.0 is not affected by CVE-2020-24941. The vulnerability affected Laravel before 6.18.35 and 7.x before 7.24.0, where the $guarded property could be bypassed using JSON column nesting expressions or non-existent column names. The upstream fix (commit 897d107775, authored by Taylor Otwell on 2020-08-07) introduced the isGuardableColumn() method that validates attribute keys against actual database columns. This fix has been part of Laravel's codebase for years and was already present in the upstream v12.58.0 release that TuxCare onboarded in May 2026. The vulnerable code pattern is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 12.58.0-p4+tuxcare of laravel/framework. Laravel v12.58.0 is not affected by CVE-2021-21263. The upstream release already contains the flattenValue() method which provides equivalent protection to the security patch. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) normalize array inputs to scalars before adding query bindings, preventing the query binding exploitation described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "Laravel v12.58.0 is not affected by CVE-2021-21263. The upstream release already contains the flattenValue() method which provides equivalent protection to the security patch. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) normalize array inputs to scalars before adding query bindings, preventing the query binding exploitation described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 12.58.0-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 12.58.0-p4+tuxcare of laravel/framework. CVE-2024-52301 (environment manipulation via query string) is NOT present in Laravel Framework v12.58.0-p6+tuxcare. The vulnerable pattern (unconditional use of $_SERVER['argv'] for environment detection) has been replaced with a SAPI-based guard that blocks web requests from using argv values. The fix was authored by Taylor Otwell and shipped in upstream Laravel v12.58.0 before TuxCare snapshotted this version. The current code at Application.php:791 checks runningInConsole() (which validates PHP_SAPI === 'cli') before accessing argv, preventing attackers from manipulating the framework environment via crafted query strings when register_argc_argv is enabled.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "CVE-2024-52301 (environment manipulation via query string) is NOT present in Laravel Framework v12.58.0-p6+tuxcare. The vulnerable pattern (unconditional use of $_SERVER['argv'] for environment detection) has been replaced with a SAPI-based guard that blocks web requests from using argv values. The fix was authored by Taylor Otwell and shipped in upstream Laravel v12.58.0 before TuxCare snapshotted this version. The current code at Application.php:791 checks runningInConsole() (which validates PHP_SAPI === 'cli') before accessing argv, preventing attackers from manipulating the framework environment via crafted query strings when register_argc_argv is enabled." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 12.58.0-p4+tuxcare of laravel/framework. not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-01T15:26:55.316610+00:00", "status_notes": "Vulnerability CVE-2026-102279 is fixed in version 12.58.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-102279" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2026-114508 affects version 12.58.0-p4+tuxcare of laravel/framework, and is fixed in 12.58.0-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-114508" }, "action_statement": "Vulnerability CVE-2026-114508 affects version 12.58.0-p4+tuxcare of laravel/framework, and is fixed in 12.58.0-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T12:31:25.113305+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 12.58.0-p4+tuxcare of laravel/framework, and is fixed in 12.58.0-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 12.58.0-p4+tuxcare of laravel/framework, and is fixed in 12.58.0-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:49:09.974795+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 12.58.0-p4+tuxcare of laravel/framework. not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-01T15:26:55.316610+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 12.58.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 12.58.0-p4+tuxcare of laravel/framework. not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 12.58.0-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-01T15:26:55.316610+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp is fixed in version 12.58.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:16:19.887305+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 12.58.0-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:18:00.235397+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 12.58.0-p4+tuxcare of laravel/framework. The target Laravel framework v12.58.0 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability (predictable SHA1-based cookie prefixes enabling encryption oracle attacks) was fixed in upstream Laravel 6.18.31 (July 2020). The fix uses HMAC-SHA1 with the secret key instead of plain SHA1, preventing attackers from crafting valid cookie prefixes. This fix was already present in the upstream Laravel 12.58.0 release that TuxCare onboarded, making the vulnerable code pattern absent from the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework v12.58.0 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability (predictable SHA1-based cookie prefixes enabling encryption oracle attacks) was fixed in upstream Laravel 6.18.31 (July 2020). The fix uses HMAC-SHA1 with the secret key instead of plain SHA1, preventing attackers from crafting valid cookie prefixes. This fix was already present in the upstream Laravel 12.58.0 release that TuxCare onboarded, making the vulnerable code pattern absent from the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 12.58.0-p4+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:41:57.354813+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 12.58.0-p4+tuxcare of laravel/framework. Laravel framework v12.58.0 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability affects Laravel 6.x (patched January 2021) where array values passed to query builder methods could inject unexpected bindings. The current version 12.58.0 already includes upstream protection via the flattenValue() helper method, which flattens array inputs to scalar values before binding. All 10 affected methods (where, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, whereBetween, havingBetween) use this protection. The fix was present in the upstream Laravel v12.58.0 release imported during onboarding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "Laravel framework v12.58.0 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability affects Laravel 6.x (patched January 2021) where array values passed to query builder methods could inject unexpected bindings. The current version 12.58.0 already includes upstream protection via the flattenValue() helper method, which flattens array inputs to scalar values before binding. All 10 affected methods (where, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, whereBetween, havingBetween) use this protection. The fix was present in the upstream Laravel v12.58.0 release imported during onboarding." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 12.58.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 12.58.0-p2+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 12.58.0-p2+tuxcare of laravel/framework. CVE-2018-15133 describes remote code execution via unsafe PHP object deserialization when decrypting X-XSRF-TOKEN cookies. The vulnerability required the attacker to know the application encryption key and craft a malicious serialized object payload. Laravel Framework fixed this in August 2018 by disabling PHP object serialization during cookie encryption/decryption (setting $serialize=false by default). The target repository (laravel/framework version 12.58.0-p6+tuxcare) contains the complete vendor fix, which was shipped in the upstream Laravel v12.58.0 release and imported via TuxCare snapshot commit 85d8011ca6. The vulnerable pattern (unsafe unserialize() calls on cookie data) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 describes remote code execution via unsafe PHP object deserialization when decrypting X-XSRF-TOKEN cookies. The vulnerability required the attacker to know the application encryption key and craft a malicious serialized object payload. Laravel Framework fixed this in August 2018 by disabling PHP object serialization during cookie encryption/decryption (setting $serialize=false by default). The target repository (laravel/framework version 12.58.0-p6+tuxcare) contains the complete vendor fix, which was shipped in the upstream Laravel v12.58.0 release and imported via TuxCare snapshot commit 85d8011ca6. The vulnerable pattern (unsafe unserialize() calls on cookie data) is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 12.58.0-p2+tuxcare of laravel/framework. CVE-2019-9081 describes a PHP object injection gadget chain in PendingCommand's __destruct method. While this gadget chain exists in version 12.58.0, the framework itself does not provide any production code path where user-controllable serialized data is unserialized and could trigger this gadget. PendingCommand is a testing utility instantiated only in test contexts. Laravel's production serialization (sessions, cookies, cache) uses encrypted/signed data or server-side storage, preventing arbitrary payload injection. The framework is not vulnerable when used as designed; exploitation requires downstream applications to explicitly unserialize untrusted user data without restrictions, which constitutes an application-level vulnerability, not a framework vulnerability.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 describes a PHP object injection gadget chain in PendingCommand's __destruct method. While this gadget chain exists in version 12.58.0, the framework itself does not provide any production code path where user-controllable serialized data is unserialized and could trigger this gadget. PendingCommand is a testing utility instantiated only in test contexts. Laravel's production serialization (sessions, cookies, cache) uses encrypted/signed data or server-side storage, preventing arbitrary payload injection. The framework is not vulnerable when used as designed; exploitation requires downstream applications to explicitly unserialize untrusted user data without restrictions, which constitutes an application-level vulnerability, not a framework vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 12.58.0-p2+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before v5.8.17 (May 2019). The target repository is Laravel Framework v12.58.0 (released late 2024), which already contains the upstream fix. The vulnerable code pattern (unescaped shell parameters in the link() method) is not present. Both exec() calls at lines 358 and 364 in src/Illuminate/Filesystem/Filesystem.php properly use escapeshellarg() on the $target and $link parameters, preventing OS command injection. This fix was shipped in the upstream v12.58.0 release that TuxCare imported via snapshot commit 85d8011ca6, not added as a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before v5.8.17 (May 2019). The target repository is Laravel Framework v12.58.0 (released late 2024), which already contains the upstream fix. The vulnerable code pattern (unescaped shell parameters in the link() method) is not present. Both exec() calls at lines 358 and 364 in src/Illuminate/Filesystem/Filesystem.php properly use escapeshellarg() on the $target and $link parameters, preventing OS command injection. This fix was shipped in the upstream v12.58.0 release that TuxCare imported via snapshot commit 85d8011ca6, not added as a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:41:57.354813+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 12.58.0-p2+tuxcare of laravel/framework. The target Laravel 12.58.0 is not affected by CVE-2020-24941. The vulnerability affected Laravel before 6.18.35 and 7.x before 7.24.0, where the $guarded property could be bypassed using JSON column nesting expressions or non-existent column names. The upstream fix (commit 897d107775, authored by Taylor Otwell on 2020-08-07) introduced the isGuardableColumn() method that validates attribute keys against actual database columns. This fix has been part of Laravel's codebase for years and was already present in the upstream v12.58.0 release that TuxCare onboarded in May 2026. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel 12.58.0 is not affected by CVE-2020-24941. The vulnerability affected Laravel before 6.18.35 and 7.x before 7.24.0, where the $guarded property could be bypassed using JSON column nesting expressions or non-existent column names. The upstream fix (commit 897d107775, authored by Taylor Otwell on 2020-08-07) introduced the isGuardableColumn() method that validates attribute keys against actual database columns. This fix has been part of Laravel's codebase for years and was already present in the upstream v12.58.0 release that TuxCare onboarded in May 2026. The vulnerable code pattern is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 12.58.0-p2+tuxcare of laravel/framework. Laravel v12.58.0 is not affected by CVE-2021-21263. The upstream release already contains the flattenValue() method which provides equivalent protection to the security patch. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) normalize array inputs to scalars before adding query bindings, preventing the query binding exploitation described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "Laravel v12.58.0 is not affected by CVE-2021-21263. The upstream release already contains the flattenValue() method which provides equivalent protection to the security patch. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) normalize array inputs to scalars before adding query bindings, preventing the query binding exploitation described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 12.58.0-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 12.58.0-p2+tuxcare of laravel/framework. CVE-2024-52301 (environment manipulation via query string) is NOT present in Laravel Framework v12.58.0-p6+tuxcare. The vulnerable pattern (unconditional use of $_SERVER['argv'] for environment detection) has been replaced with a SAPI-based guard that blocks web requests from using argv values. The fix was authored by Taylor Otwell and shipped in upstream Laravel v12.58.0 before TuxCare snapshotted this version. The current code at Application.php:791 checks runningInConsole() (which validates PHP_SAPI === 'cli') before accessing argv, preventing attackers from manipulating the framework environment via crafted query strings when register_argc_argv is enabled.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "CVE-2024-52301 (environment manipulation via query string) is NOT present in Laravel Framework v12.58.0-p6+tuxcare. The vulnerable pattern (unconditional use of $_SERVER['argv'] for environment detection) has been replaced with a SAPI-based guard that blocks web requests from using argv values. The fix was authored by Taylor Otwell and shipped in upstream Laravel v12.58.0 before TuxCare snapshotted this version. The current code at Application.php:791 checks runningInConsole() (which validates PHP_SAPI === 'cli') before accessing argv, preventing attackers from manipulating the framework environment via crafted query strings when register_argc_argv is enabled." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 12.58.0-p2+tuxcare of laravel/framework. not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-01T15:26:55.316610+00:00", "status_notes": "Vulnerability CVE-2026-102279 affects version 12.58.0-p2+tuxcare of laravel/framework, and is fixed in 12.58.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-102279" }, "action_statement": "Vulnerability CVE-2026-102279 affects version 12.58.0-p2+tuxcare of laravel/framework, and is fixed in 12.58.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2026-114508 affects version 12.58.0-p2+tuxcare of laravel/framework, and is fixed in 12.58.0-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-114508" }, "action_statement": "Vulnerability CVE-2026-114508 affects version 12.58.0-p2+tuxcare of laravel/framework, and is fixed in 12.58.0-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T12:31:25.113305+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 12.58.0-p2+tuxcare of laravel/framework, and is fixed in 12.58.0-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 12.58.0-p2+tuxcare of laravel/framework, and is fixed in 12.58.0-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:49:09.974795+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 12.58.0-p2+tuxcare of laravel/framework. not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 12.58.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 12.58.0-p2+tuxcare of laravel/framework. not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 12.58.0-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp affects version 12.58.0-p2+tuxcare of laravel/framework, and is fixed in 12.58.0-p3+tuxcare.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "action_statement": "Vulnerability GHSA-crmm-hgp2-wgrp affects version 12.58.0-p2+tuxcare of laravel/framework, and is fixed in 12.58.0-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:16:19.887305+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 12.58.0-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:18:00.235397+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 12.58.0-p2+tuxcare of laravel/framework. The target Laravel framework v12.58.0 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability (predictable SHA1-based cookie prefixes enabling encryption oracle attacks) was fixed in upstream Laravel 6.18.31 (July 2020). The fix uses HMAC-SHA1 with the secret key instead of plain SHA1, preventing attackers from crafting valid cookie prefixes. This fix was already present in the upstream Laravel 12.58.0 release that TuxCare onboarded, making the vulnerable code pattern absent from the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework v12.58.0 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability (predictable SHA1-based cookie prefixes enabling encryption oracle attacks) was fixed in upstream Laravel 6.18.31 (July 2020). The fix uses HMAC-SHA1 with the secret key instead of plain SHA1, preventing attackers from crafting valid cookie prefixes. This fix was already present in the upstream Laravel 12.58.0 release that TuxCare onboarded, making the vulnerable code pattern absent from the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 12.58.0-p2+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:41:57.354813+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 12.58.0-p2+tuxcare of laravel/framework. Laravel framework v12.58.0 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability affects Laravel 6.x (patched January 2021) where array values passed to query builder methods could inject unexpected bindings. The current version 12.58.0 already includes upstream protection via the flattenValue() helper method, which flattens array inputs to scalar values before binding. All 10 affected methods (where, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, whereBetween, havingBetween) use this protection. The fix was present in the upstream Laravel v12.58.0 release imported during onboarding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "Laravel framework v12.58.0 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability affects Laravel 6.x (patched January 2021) where array values passed to query builder methods could inject unexpected bindings. The current version 12.58.0 already includes upstream protection via the flattenValue() helper method, which flattens array inputs to scalar values before binding. All 10 affected methods (where, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, whereBetween, havingBetween) use this protection. The fix was present in the upstream Laravel v12.58.0 release imported during onboarding." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.3-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2017-14775. The vulnerability concerned non-constant-time token comparison in remember_me token verification, which was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.3 (released in 2021) already includes the upstream fix using hash_equals() for constant-time comparison in both DatabaseUserProvider and EloquentUserProvider. The fix came w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2017-14775. The vulnerability concerned non-constant-time token comparison in remember_me token verification, which was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.3 (released in 2021) already includes the upstream fix using hash_equals() for constant-time comparison in both DatabaseUserProvider and EloquentUserProvider. The fix came w..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.3-p2+tuxcare of laravel/framework. CVE-2018-15133 is NOT present in this target. The vulnerability involved remote code execution via PHP object injection when decrypted cookie values (especially X-XSRF-TOKEN) were passed through unserialize(). The upstream Laravel fix (August 2018, commit 97467e3ca by Taylor Otwell) disabled serialization for all cookies by setting `protected static $serialize = false` and passing `false` to all decrypt() calls. This fix was already included in Laravel v8.12.3 (December 2020) when TuxCare onboarded it via snapshot commit 90eb977a3b. The target code at HEAD (8.12.3-p5+tuxcare) contains this upstream fix: EncryptCookies.php line 34 sets `$serialize = false`, and Encrypter.php line 151 returns decrypted values directly without calling unserialize() when the flag is false. The vulnerable pattern (unserialization of decrypted cookies) does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 is NOT present in this target. The vulnerability involved remote code execution via PHP object injection when decrypted cookie values (especially X-XSRF-TOKEN) were passed through unserialize(). The upstream Laravel fix (August 2018, commit 97467e3ca by Taylor Otwell) disabled serialization for all cookies by setting `protected static $serialize = false` and passing `false` to all decrypt() calls. This fix was already included in Laravel v8.12.3 (December 2020) when TuxCare onboarded it via snapshot commit 90eb977a3b. The target code at HEAD (8.12.3-p5+tuxcare) contains this upstream fix: EncryptCookies.php line 34 sets `$serialize = false`, and Encrypter.php line 151 returns decrypted values directly without calling unserialize() when the flag is false. The vulnerable pattern (unserialization of decrypted cookies) does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 8.12.3-p2+tuxcare of laravel/framework. Laravel Framework 8.12.3 is not affected by CVE-2019-9081. While the PendingCommand class with its __destruct method exists and can execute commands when unserialized, there is no reachable attack path in Laravel's own code where attacker-controlled serialized data reaches unserialize(). The framework's unserialize() calls (e.g., Session/Store.php:98) operate on server-side data that is not directly controllable by attackers in default configuration. This is a gadget-chain component that requires an application-level unserialize vulnerability to be exploitable, not a framework vulnerability.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "Laravel Framework 8.12.3 is not affected by CVE-2019-9081. While the PendingCommand class with its __destruct method exists and can execute commands when unserialized, there is no reachable attack path in Laravel's own code where attacker-controlled serialized data reaches unserialize(). The framework's unserialize() calls (e.g., Session/Store.php:98) operate on server-side data that is not directly controllable by attackers in default configuration. This is a gadget-chain component that requires an application-level unserialize vulnerability to be exploitable, not a framework vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.3-p2+tuxcare of laravel/framework. The target Laravel Framework 8.12.3 is NOT AFFECTED by CVE-2020-19316 (OS command injection in Filesystem.php link() function). The vulnerability was fixed upstream by Taylor Otwell in commit 44c3feb604 (May 2019, Laravel 5.8.17). The fix wraps both $link and $target parameters with escapeshellarg() before passing to the Windows mklink shell command. Laravel 8.12.3 (released December 2020) already includes this fix. Line 320 of src/Illuminate/Filesystem/Filesystem.php shows: exec(\"mklink /{$mode} \".escapeshellarg($link).' '.escapeshellarg($target)); This protection prevents shell metacharacters from being interpreted as command injection sequences. The fix shipped in the upstream release that TuxCare onboarded via snapshot commit 90eb977a3b.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target Laravel Framework 8.12.3 is NOT AFFECTED by CVE-2020-19316 (OS command injection in Filesystem.php link() function). The vulnerability was fixed upstream by Taylor Otwell in commit 44c3feb604 (May 2019, Laravel 5.8.17). The fix wraps both $link and $target parameters with escapeshellarg() before passing to the Windows mklink shell command. Laravel 8.12.3 (released December 2020) already includes this fix. Line 320 of src/Illuminate/Filesystem/Filesystem.php shows: exec(\"mklink /{$mode} \".escapeshellarg($link).' '.escapeshellarg($target)); This protection prevents shell metacharacters from being interpreted as command injection sequences. The fix shipped in the upstream release that TuxCare onboarded via snapshot commit 90eb977a3b." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:41:18.186955+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.3-p2+tuxcare of laravel/framework. CVE-2020-24941 affects Laravel versions before 6.18.35 and 7.x before 7.24.0. The target repository is Laravel 8.12.3-p5+tuxcare, which was released after the CVE was fixed upstream (August 2020). The vulnerability pattern is not present in the target because the fix was already included in the upstream Laravel 8.12.3 release that TuxCare snapshotted. The GuardsAttributes.php file contains the isGuardableColumn() method and the fixed isGuarded() logic that validates attribute keys against actual database columns, preventing the mass-assignment bypass that the CVE describes.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 affects Laravel versions before 6.18.35 and 7.x before 7.24.0. The target repository is Laravel 8.12.3-p5+tuxcare, which was released after the CVE was fixed upstream (August 2020). The vulnerability pattern is not present in the target because the fix was already included in the upstream Laravel 8.12.3 release that TuxCare snapshotted. The GuardsAttributes.php file contains the isGuardableColumn() method and the fixed isGuarded() logic that validates attribute keys against actual database columns, preventing the mass-assignment bypass that the CVE describes." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.3-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.3-p2+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.3-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.3-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.3-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:27:02.675922+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.3-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.3-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-114508. The vulnerable JsonApi resources feature was introduced in Laravel 12.45.0, approximately 4 major versions after the target version. The entire JsonApi resources module, including the ResolvesJsonApiElements trait and sparseIncluded() method processing, does not exist in Laravel 8.x. The vulnerability requires processing HTTP query parameters w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-114508. The vulnerable JsonApi resources feature was introduced in Laravel 12.45.0, approximately 4 major versions after the target version. The entire JsonApi resources module, including the ResolvesJsonApiElements trait and sparseIncluded() method processing, does not exist in Laravel 8.x. The vulnerability requires processing HTTP query parameters w..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.3-p2+tuxcare of laravel/framework, and is fixed in 8.12.3-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.3-p2+tuxcare of laravel/framework, and is fixed in 8.12.3-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.3-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.3-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.3-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 8.12.3 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie unserialization). The vulnerability affected Laravel 5.6.30 (August 2018) and was fixed by disabling PHP object serialization in cookie encryption. Laravel 8.12.3 (December 2020) shipped with this protection already in place: EncryptCookies uses `static $serialize = false` to prevent object unseria...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel 8.12.3 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie unserialization). The vulnerability affected Laravel 5.6.30 (August 2018) and was fixed by disabling PHP object serialization in cookie encryption. Laravel 8.12.3 (December 2020) shipped with this protection already in place: EncryptCookies uses `static $serialize = false` to prevent object unseria..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.3-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v8.12.3 is not affected by GHSA-7852-w36x-6mf6 (Laravel Encrypter IV length validation bypass). The vulnerability pattern is absent because the upstream fix was already present in Laravel v8.12.3 when TuxCare onboarded it. The validPayload() method includes IV length validation that prevents manipulated payloads from causing false-return decryption failures exploita...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework v8.12.3 is not affected by GHSA-7852-w36x-6mf6 (Laravel Encrypter IV length validation bypass). The vulnerability pattern is absent because the upstream fix was already present in Laravel v8.12.3 when TuxCare onboarded it. The validPayload() method includes IV length validation that prevents manipulated payloads from causing false-return decryption failures exploita..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.3-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.3-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:15:18.533137+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.3-p2+tuxcare of laravel/framework. Laravel framework 8.12.3-p5+tuxcare is not affected by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The vulnerability required using predictable sha1() hashes for cookie prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The target already contains the upstream security fix that replaced sha1() with hash_hmac() using the application's secret key, making cookie prefixes unguessable. This fix was shipped in upstream Laravel 8.12.3 (released October 29, 2020) before TuxCare began maintaining this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel framework 8.12.3-p5+tuxcare is not affected by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The vulnerability required using predictable sha1() hashes for cookie prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The target already contains the upstream security fix that replaced sha1() with hash_hmac() using the application's secret key, making cookie prefixes unguessable. This fix was shipped in upstream Laravel 8.12.3 (released October 29, 2020) before TuxCare began maintaining this version." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.3-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.3-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/livewire/livewire@v3.6.4-p2+tuxcare", "identifiers": { "purl": "pkg:composer/livewire/livewire@v3.6.4-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:31:06.412502+00:00", "status_notes": "Vulnerability CVE-2025-54068 does not affect version v3.6.4-p2+tuxcare of livewire/livewire. The target repository (livewire/livewire v3.6.4-p2+tuxcare) is not affected by CVE-2025-54068. The vulnerability was fixed by the upstream vendor in v3.6.4 (commit ef04be75 by Josh Hanley). TuxCare onboarded the already-patched v3.6.4 release via snapshot commit ac0e1f76. The fix adds a hydratePropertyUpdate() method that prevents nested property removal markers (__rm__) from being hydrated through synthesizers, blocking the RCE attack vector.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-54068" }, "impact_statement": "The target repository (livewire/livewire v3.6.4-p2+tuxcare) is not affected by CVE-2025-54068. The vulnerability was fixed by the upstream vendor in v3.6.4 (commit ef04be75 by Josh Hanley). TuxCare onboarded the already-patched v3.6.4 release via snapshot commit ac0e1f76. The fix adds a hydratePropertyUpdate() method that prevents nested property removal markers (__rm__) from being hydrated through synthesizers, blocking the RCE attack vector." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/livewire/livewire@v3.6.4-p2+tuxcare", "identifiers": { "purl": "pkg:composer/livewire/livewire@v3.6.4-p2+tuxcare" } } ], "timestamp": "2026-10-12T11:15:00.056759+00:00", "status_notes": "Vulnerability CVE-2026-81887 is fixed in version v3.6.4-p2+tuxcare of livewire/livewire.", "vulnerability": { "name": "CVE-2026-81887" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.3-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2017-14775. The vulnerability concerned non-constant-time token comparison in remember_me token verification, which was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.3 (released in 2021) already includes the upstream fix using hash_equals() for constant-time comparison in both DatabaseUserProvider and EloquentUserProvider. The fix came w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2017-14775. The vulnerability concerned non-constant-time token comparison in remember_me token verification, which was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.3 (released in 2021) already includes the upstream fix using hash_equals() for constant-time comparison in both DatabaseUserProvider and EloquentUserProvider. The fix came w..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.3-p6+tuxcare of laravel/framework. CVE-2018-15133 is NOT present in this target. The vulnerability involved remote code execution via PHP object injection when decrypted cookie values (especially X-XSRF-TOKEN) were passed through unserialize(). The upstream Laravel fix (August 2018, commit 97467e3ca by Taylor Otwell) disabled serialization for all cookies by setting `protected static $serialize = false` and passing `false` to all decrypt() calls. This fix was already included in Laravel v8.12.3 (December 2020) when TuxCare onboarded it via snapshot commit 90eb977a3b. The target code at HEAD (8.12.3-p5+tuxcare) contains this upstream fix: EncryptCookies.php line 34 sets `$serialize = false`, and Encrypter.php line 151 returns decrypted values directly without calling unserialize() when the flag is false. The vulnerable pattern (unserialization of decrypted cookies) does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 is NOT present in this target. The vulnerability involved remote code execution via PHP object injection when decrypted cookie values (especially X-XSRF-TOKEN) were passed through unserialize(). The upstream Laravel fix (August 2018, commit 97467e3ca by Taylor Otwell) disabled serialization for all cookies by setting `protected static $serialize = false` and passing `false` to all decrypt() calls. This fix was already included in Laravel v8.12.3 (December 2020) when TuxCare onboarded it via snapshot commit 90eb977a3b. The target code at HEAD (8.12.3-p5+tuxcare) contains this upstream fix: EncryptCookies.php line 34 sets `$serialize = false`, and Encrypter.php line 151 returns decrypted values directly without calling unserialize() when the flag is false. The vulnerable pattern (unserialization of decrypted cookies) does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 8.12.3-p6+tuxcare of laravel/framework. Laravel Framework 8.12.3 is not affected by CVE-2019-9081. While the PendingCommand class with its __destruct method exists and can execute commands when unserialized, there is no reachable attack path in Laravel's own code where attacker-controlled serialized data reaches unserialize(). The framework's unserialize() calls (e.g., Session/Store.php:98) operate on server-side data that is not directly controllable by attackers in default configuration. This is a gadget-chain component that requires an application-level unserialize vulnerability to be exploitable, not a framework vulnerability.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "Laravel Framework 8.12.3 is not affected by CVE-2019-9081. While the PendingCommand class with its __destruct method exists and can execute commands when unserialized, there is no reachable attack path in Laravel's own code where attacker-controlled serialized data reaches unserialize(). The framework's unserialize() calls (e.g., Session/Store.php:98) operate on server-side data that is not directly controllable by attackers in default configuration. This is a gadget-chain component that requires an application-level unserialize vulnerability to be exploitable, not a framework vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.3-p6+tuxcare of laravel/framework. The target Laravel Framework 8.12.3 is NOT AFFECTED by CVE-2020-19316 (OS command injection in Filesystem.php link() function). The vulnerability was fixed upstream by Taylor Otwell in commit 44c3feb604 (May 2019, Laravel 5.8.17). The fix wraps both $link and $target parameters with escapeshellarg() before passing to the Windows mklink shell command. Laravel 8.12.3 (released December 2020) already includes this fix. Line 320 of src/Illuminate/Filesystem/Filesystem.php shows: exec(\"mklink /{$mode} \".escapeshellarg($link).' '.escapeshellarg($target)); This protection prevents shell metacharacters from being interpreted as command injection sequences. The fix shipped in the upstream release that TuxCare onboarded via snapshot commit 90eb977a3b.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target Laravel Framework 8.12.3 is NOT AFFECTED by CVE-2020-19316 (OS command injection in Filesystem.php link() function). The vulnerability was fixed upstream by Taylor Otwell in commit 44c3feb604 (May 2019, Laravel 5.8.17). The fix wraps both $link and $target parameters with escapeshellarg() before passing to the Windows mklink shell command. Laravel 8.12.3 (released December 2020) already includes this fix. Line 320 of src/Illuminate/Filesystem/Filesystem.php shows: exec(\"mklink /{$mode} \".escapeshellarg($link).' '.escapeshellarg($target)); This protection prevents shell metacharacters from being interpreted as command injection sequences. The fix shipped in the upstream release that TuxCare onboarded via snapshot commit 90eb977a3b." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:41:18.186955+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.3-p6+tuxcare of laravel/framework. CVE-2020-24941 affects Laravel versions before 6.18.35 and 7.x before 7.24.0. The target repository is Laravel 8.12.3-p5+tuxcare, which was released after the CVE was fixed upstream (August 2020). The vulnerability pattern is not present in the target because the fix was already included in the upstream Laravel 8.12.3 release that TuxCare snapshotted. The GuardsAttributes.php file contains the isGuardableColumn() method and the fixed isGuarded() logic that validates attribute keys against actual database columns, preventing the mass-assignment bypass that the CVE describes.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 affects Laravel versions before 6.18.35 and 7.x before 7.24.0. The target repository is Laravel 8.12.3-p5+tuxcare, which was released after the CVE was fixed upstream (August 2020). The vulnerability pattern is not present in the target because the fix was already included in the upstream Laravel 8.12.3 release that TuxCare snapshotted. The GuardsAttributes.php file contains the isGuardableColumn() method and the fixed isGuarded() logic that validates attribute keys against actual database columns, preventing the mass-assignment bypass that the CVE describes." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.3-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.3-p6+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.3-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.3-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.3-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.3-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.3-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-114508. The vulnerable JsonApi resources feature was introduced in Laravel 12.45.0, approximately 4 major versions after the target version. The entire JsonApi resources module, including the ResolvesJsonApiElements trait and sparseIncluded() method processing, does not exist in Laravel 8.x. The vulnerability requires processing HTTP query parameters w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-114508. The vulnerable JsonApi resources feature was introduced in Laravel 12.45.0, approximately 4 major versions after the target version. The entire JsonApi resources module, including the ResolvesJsonApiElements trait and sparseIncluded() method processing, does not exist in Laravel 8.x. The vulnerability requires processing HTTP query parameters w..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 8.12.3-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.3-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.3-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.3-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 8.12.3 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie unserialization). The vulnerability affected Laravel 5.6.30 (August 2018) and was fixed by disabling PHP object serialization in cookie encryption. Laravel 8.12.3 (December 2020) shipped with this protection already in place: EncryptCookies uses `static $serialize = false` to prevent object unseria...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel 8.12.3 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie unserialization). The vulnerability affected Laravel 5.6.30 (August 2018) and was fixed by disabling PHP object serialization in cookie encryption. Laravel 8.12.3 (December 2020) shipped with this protection already in place: EncryptCookies uses `static $serialize = false` to prevent object unseria..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.3-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v8.12.3 is not affected by GHSA-7852-w36x-6mf6 (Laravel Encrypter IV length validation bypass). The vulnerability pattern is absent because the upstream fix was already present in Laravel v8.12.3 when TuxCare onboarded it. The validPayload() method includes IV length validation that prevents manipulated payloads from causing false-return decryption failures exploita...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework v8.12.3 is not affected by GHSA-7852-w36x-6mf6 (Laravel Encrypter IV length validation bypass). The vulnerability pattern is absent because the upstream fix was already present in Laravel v8.12.3 when TuxCare onboarded it. The validPayload() method includes IV length validation that prevents manipulated payloads from causing false-return decryption failures exploita..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.3-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.3-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:15:18.533137+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.3-p6+tuxcare of laravel/framework. Laravel framework 8.12.3-p5+tuxcare is not affected by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The vulnerability required using predictable sha1() hashes for cookie prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The target already contains the upstream security fix that replaced sha1() with hash_hmac() using the application's secret key, making cookie prefixes unguessable. This fix was shipped in upstream Laravel 8.12.3 (released October 29, 2020) before TuxCare began maintaining this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel framework 8.12.3-p5+tuxcare is not affected by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The vulnerability required using predictable sha1() hashes for cookie prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The target already contains the upstream security fix that replaced sha1() with hash_hmac() using the application's secret key, making cookie prefixes unguessable. This fix was shipped in upstream Laravel 8.12.3 (released October 29, 2020) before TuxCare began maintaining this version." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.3-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p6+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.3-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-14775 is fixed in version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2017-14775" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-16894 is fixed in version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2017-16894" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-15133 is fixed in version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 5.4.36-p5+tuxcare of laravel/framework. CVE-2019-9081 targets the PendingCommand class in Laravel Framework 5.7.x, which does not exist in the target version 5.4.36. The vulnerable component was introduced in version 5.7 and is not present in this earlier version. Exhaustive searches confirm no PendingCommand.php file exists in the codebase, and git history shows PendingCommand-related commits are tagged [5.7] or later. While similar classes (PendingDispatch, PendingBroadcast) exist with __destruct methods, they serve different purposes and are not the vulnerability target specified in CVE-2019-9081.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 targets the PendingCommand class in Laravel Framework 5.7.x, which does not exist in the target version 5.4.36. The vulnerable component was introduced in version 5.7 and is not present in this earlier version. Exhaustive searches confirm no PendingCommand.php file exists in the codebase, and git history shows PendingCommand-related commits are tagged [5.7] or later. While similar classes (PendingDispatch, PendingBroadcast) exist with __destruct methods, they serve different purposes and are not the vulnerability target specified in CVE-2019-9081." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.4.36-p5+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.4.36-p5+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.4.36-p5+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-29T20:17:00.109653+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.4.36-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 does not contain the vulnerable code. The CVE-2026-102279 vulnerability affects Laravel's custom exception renderer with Tippy.js tooltips (introduced in Laravel 11.x circa 2024). Version 5.4.36 (2017) uses Symfony's SymfonyExceptionHandler v3.4.47 for exception rendering, which does not use JavaScript tooltips and properly escapes all dynamic content via htmlspecialchars(). The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 does not contain the vulnerable code. The CVE-2026-102279 vulnerability affects Laravel's custom exception renderer with Tippy.js tooltips (introduced in Laravel 11.x circa 2024). Version 5.4.36 (2017) uses Symfony's SymfonyExceptionHandler v3.4.47 for exception rendering, which does not use JavaScript tooltips and properly escapes all dynamic content via htmlspecialchars(). The ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.4.36-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources subsystem (specifically in Illuminate\\Http\\Resources\\JsonApi\\Concerns\\ResolvesJsonApiElements), which was introduced in Laravel 12.x (circa 2024). Laravel 5.4.36 (released February 2017) predates this feature by approximately 7 years and 8 major versions. The vulnerable component does not exist...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources subsystem (specifically in Illuminate\\Http\\Resources\\JsonApi\\Concerns\\ResolvesJsonApiElements), which was introduced in Laravel 12.x (circa 2024). Laravel 5.4.36 (released February 2017) predates this feature by approximately 7 years and 8 major versions. The vulnerable component does not exist..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.4.36-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.4.36-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36-p4+tuxcare uses SwiftMailer, not Symfony Mailer. The CVE (GHSA-5vg9-5847-vvmq) is specific to 'how Symfony Mailer and Symfony Mime handle certain character sequences'. SwiftMailer has RFC 2822 grammar validation that should reject CRLF characters in email addresses (except as proper folding whitespace), providing a different defense mechanism than what the Laravel 12.x/13.x patch...", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36-p4+tuxcare uses SwiftMailer, not Symfony Mailer. The CVE (GHSA-5vg9-5847-vvmq) is specific to 'how Symfony Mailer and Symfony Mime handle certain character sequences'. SwiftMailer has RFC 2822 grammar validation that should reject CRLF characters in email addresses (except as proper folding whitespace), providing a different defense mechanism than what the Laravel 12.x/13.x patch..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr affects version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "action_statement": "Vulnerability GHSA-6jvx-8ch9-j2jr affects version 5.4.36-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 is fixed in version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.4.36-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability requires the LocalFilesystemAdapter with temporary signed URL support via temporarySignedRoute(), a feature introduced in Laravel 9+. Laravel 5.4 uses FilesystemAdapter which explicitly throws RuntimeException for local storage temporary URLs, stating 'This driver does not support creating temporary URLs.' The vulnerable c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability requires the LocalFilesystemAdapter with temporary signed URL support via temporarySignedRoute(), a feature introduced in Laravel 9+. Laravel 5.4 uses FilesystemAdapter which explicitly throws RuntimeException for local storage temporary URLs, stating 'This driver does not support creating temporary URLs.' The vulnerable c..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.4.36-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.4.36-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.4.36-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 9.52.21-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 9.52.21-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 9.52.21-p4+tuxcare is not affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 9.52.21, released years later, already contains this fix. Both DatabaseUserProvider.php and Eloque...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 9.52.21-p4+tuxcare is not affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 9.52.21, released years later, already contains this fix. Both DatabaseUserProvider.php and Eloque..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 9.52.21-p3+tuxcare of laravel/framework. The target Laravel framework version 9.52.21-p4+tuxcare is NOT AFFECTED by CVE-2018-15133. The vulnerability pattern (automatic PHP deserialization of decrypted cookie/header values) is not present because the upstream Laravel 9.52.21 release already shipped with the fix. The defense mechanism (passing `false` to the encrypter's decrypt method to prevent unserialize()) is active for both X-XSRF-TOKEN headers and encrypted cookies. All decrypt operations use `static::$serialize = false`, preventing the dangerous unserialize() call that would enable RCE through PHP object injection.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "The target Laravel framework version 9.52.21-p4+tuxcare is NOT AFFECTED by CVE-2018-15133. The vulnerability pattern (automatic PHP deserialization of decrypted cookie/header values) is not present because the upstream Laravel 9.52.21 release already shipped with the fix. The defense mechanism (passing `false` to the encrypter's decrypt method to prevent unserialize()) is active for both X-XSRF-TOKEN headers and encrypted cookies. All decrypt operations use `static::$serialize = false`, preventing the dangerous unserialize() call that would enable RCE through PHP object injection." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 9.52.21-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 9.52.21-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 9.52.21-p3+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before 5.8.17. Target version 9.52.21 already contains the upstream fix (escapeshellarg on both parameters in Filesystem.php::link()). The vulnerable code pattern is not present. The fix was shipped in upstream release v9.52.21, which was onboarded by TuxCare via snapshot commit ed9bb51c72.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before 5.8.17. Target version 9.52.21 already contains the upstream fix (escapeshellarg on both parameters in Filesystem.php::link()). The vulnerable code pattern is not present. The fix was shipped in upstream release v9.52.21, which was onboarded by TuxCare via snapshot commit ed9bb51c72." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:42:13.594930+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 9.52.21-p3+tuxcare of laravel/framework. CVE-2020-24941 does not affect this Laravel 9.52.21 installation. The vulnerability involved missing validation that attribute keys in mass-assignment correspond to actual database columns, allowing attackers to bypass $guarded protection using fake column names with JSON notation. The target code contains the complete upstream fix (isGuardableColumn method verifying against actual database columns) which was already present in Laravel v9.52.21 when TuxCare onboarded it in snapshot commit ed9bb51c. No TuxCare backport was needed as the fix shipped in the upstream release (original fix by Taylor Otwell in commit 897d107 for Laravel 6.x in August 2020, forward-ported to all subsequent versions including 9.x released February 2022).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 does not affect this Laravel 9.52.21 installation. The vulnerability involved missing validation that attribute keys in mass-assignment correspond to actual database columns, allowing attackers to bypass $guarded protection using fake column names with JSON notation. The target code contains the complete upstream fix (isGuardableColumn method verifying against actual database columns) which was already present in Laravel v9.52.21 when TuxCare onboarded it in snapshot commit ed9bb51c. No TuxCare backport was needed as the fix shipped in the upstream release (original fix by Taylor Otwell in commit 897d107 for Laravel 6.x in August 2020, forward-ported to all subsequent versions including 9.x released February 2022)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 9.52.21-p3+tuxcare of laravel/framework. Laravel framework v9.52.21 is not affected by CVE-2021-21263. The vulnerability affects versions <6.20.12, <7.30.3, and <8.22.1. Version 9.52.21 already contains the upstream fix that limits query bindings when array values are passed where scalar values are expected. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() method or array_slice() to restrict array inputs to expected element counts, preventing query binding exploitation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "Laravel framework v9.52.21 is not affected by CVE-2021-21263. The vulnerability affects versions <6.20.12, <7.30.3, and <8.22.1. Version 9.52.21 already contains the upstream fix that limits query bindings when array values are passed where scalar values are expected. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() method or array_slice() to restrict array inputs to expected element counts, preventing query binding exploitation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 9.52.21-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework 9.52.21 is not affected by CVE-2021-43808. The vulnerability fix (random per-request salt for parent placeholder hashing in Blade templates) was already present in the upstream Laravel 9.52.21 release when TuxCare onboarded it. The vulnerable pattern (predictable parent placeholder hash based solely on sha1($section)) is not present in the codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 The target Laravel Framework 9.52.21 is not affected by CVE-2021-43808. The vulnerability fix (random per-request salt for parent placeholder hashing in Blade templates) was already present in the upstream Laravel 9.52.21 release when TuxCare onboarded it. The vulnerable pattern (predictable parent placeholder hash based solely on sha1($section)) is not present in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 9.52.21-p3+tuxcare of laravel/framework. The target repository (Laravel framework 9.52.21) is NOT affected by CVE-2024-52301. The vulnerable code pattern that allowed environment manipulation via query strings is not present. The upstream Laravel team (Taylor Otwell) fixed this vulnerability in version 9.52.17 by adding a check to ensure $_SERVER['argv'] is only used when running in console mode (PHP_SAPI === 'cli' || PHP_SAPI === 'phpdbg'). This fix was already present in the upstream release 9.52.21 that TuxCare onboarded, making it an upstream fix rather than a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target repository (Laravel framework 9.52.21) is NOT affected by CVE-2024-52301. The vulnerable code pattern that allowed environment manipulation via query strings is not present. The upstream Laravel team (Taylor Otwell) fixed this vulnerability in version 9.52.17 by adding a check to ensure $_SERVER['argv'] is only used when running in console mode (PHP_SAPI === 'cli' || PHP_SAPI === 'phpdbg'). This fix was already present in the upstream release 9.52.21 that TuxCare onboarded, making it an upstream fix rather than a TuxCare backport." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 9.52.21-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-09-29T20:36:58.499788+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 9.52.21-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-102279. The vulnerability concerns XSS via Tippy.js tooltips with allowHTML:true in Laravel 12.x's new exception renderer component. This component does not exist in Laravel 9.52.21, which uses Whoops or Symfony's HtmlErrorRenderer for exception display instead. Exhaustive searches found no tippy.js, allowHTML, or formatted-source.blade.php in the tar...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-102279. The vulnerability concerns XSS via Tippy.js tooltips with allowHTML:true in Laravel 12.x's new exception renderer component. This component does not exist in Laravel 9.52.21, which uses Whoops or Symfony's HtmlErrorRenderer for exception display instead. Exhaustive searches found no tippy.js, allowHTML, or formatted-source.blade.php in the tar..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 9.52.21-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource implementation (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x. Version 9.52.21 predates this feature entirely\u2014the JsonApi namespace, related classes, and the vulnerable include parameter processing mechanism do not exist in this version. The target cannot...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource implementation (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x. Version 9.52.21 predates this feature entirely\u2014the JsonApi namespace, related classes, and the vulnerable include parameter processing mechanism do not exist in this version. The target cannot..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:20:48.512438+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 9.52.21-p3+tuxcare of laravel/framework, and is fixed in 9.52.21-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 9.52.21-p3+tuxcare of laravel/framework, and is fixed in 9.52.21-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 9.52.21-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "action_statement": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 9.52.21-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 9.52.21-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:04:11.478044+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 9.52.21-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-6jvx-8ch9-j2jr (CVE-2018-15133). The vulnerability involves PHP object injection through cookie deserialization. The upstream Laravel team fixed this in version 5.6.30 (August 2018) by disabling serialization for all cookies. Laravel 9.52.21, released years later, includes this fix via the EncryptCookies middleware's `$serialize = false` default. The vuln...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-6jvx-8ch9-j2jr (CVE-2018-15133). The vulnerability involves PHP object injection through cookie deserialization. The upstream Laravel team fixed this in version 5.6.30 (August 2018) by disabling serialization for all cookies. Laravel 9.52.21, released years later, includes this fix via the EncryptCookies middleware's `$serialize = false` default. The vuln..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 9.52.21-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework v9.52.21 is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decryption to return false instead of throwing an exception on manipulated payloads) was fixed by the upstream vendor in March 2018. The fix is present in the target at src/Illuminate/Encryption/Encrypter.php:246, where validPayload() validates that the base64-...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 Laravel Framework v9.52.21 is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decryption to return false instead of throwing an exception on manipulated payloads) was fixed by the upstream vendor in March 2018. The fix is present in the target at src/Illuminate/Encryption/Encrypter.php:246, where validPayload() validates that the base64-..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 9.52.21-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 9.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 9.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 9.52.21-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable code pattern (uncontrolled array inputs causing unexpected query bindings) is not present because the upstream Laravel 9.52.21 release already contained all necessary fixes before TuxCare's snapshot import. The target implements the same defenses as the vendor patches: flattenValue() method normalizes array inputs...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable code pattern (uncontrolled array inputs causing unexpected query bindings) is not present because the upstream Laravel 9.52.21 release already contained all necessary fixes before TuxCare's snapshot import. The target implements the same defenses as the vendor patches: flattenValue() method normalizes array inputs..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:19:00.105438+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 9.52.21-p3+tuxcare of laravel/framework. The target Laravel 9.52.21-p4+tuxcare is NOT vulnerable to GHSA-qm5c-m76r-2hfr (cookie session driver RCE via encryption oracle). The vulnerability was fixed in upstream Laravel 6.18.31 (July 2020) by replacing predictable SHA1-based cookie prefixes with HMAC-based validation requiring the encryption key. Laravel 9.52.21 (released 2023) already contains this fix. The target was onboarded from the upstream release via snapshot commit ed9bb51c72, which brought the pre-fixed version. No vulnerable code patterns exist in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel 9.52.21-p4+tuxcare is NOT vulnerable to GHSA-qm5c-m76r-2hfr (cookie session driver RCE via encryption oracle). The vulnerability was fixed in upstream Laravel 6.18.31 (July 2020) by replacing predictable SHA1-based cookie prefixes with HMAC-based validation requiring the encryption key. Laravel 9.52.21 (released 2023) already contains this fix. The target was onboarded from the upstream release via snapshot commit ed9bb51c72, which brought the pre-fixed version. No vulnerable code patterns exist in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 9.52.21-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v9.52.21-p4+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL injection via limit/offset in SQL Server). The vulnerability pattern is not present because the fix was already included in the upstream Laravel v9.52.21 release that TuxCare onboarded. All required protections are in place: integer casting in Builder.php limit()/offset() methods and SqlServerGrammar.ph...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel framework v9.52.21-p4+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL injection via limit/offset in SQL Server). The vulnerability pattern is not present because the fix was already included in the upstream Laravel v9.52.21 release that TuxCare onboarded. All required protections are in place: integer casting in Builder.php limit()/offset() methods and SqlServerGrammar.ph..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:42:13.594930+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 9.52.21-p3+tuxcare of laravel/framework. Target Laravel 9.52.21 is not affected by GHSA-x7p5-p2c9-phvg. The fix for this vulnerability was already present in the upstream Laravel 9.52.21 release that TuxCare onboarded. The target contains the `flattenValue()` helper method (line 3720-3723 in Builder.php) that flattens nested arrays and extracts the first scalar element, which is semantically identical to the vendor patches' `scalarValue()` helper. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use this helper to limit query bindings to expected counts, preventing the injection of unexpected bindings that could cause queries to return unexpected results.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "Target Laravel 9.52.21 is not affected by GHSA-x7p5-p2c9-phvg. The fix for this vulnerability was already present in the upstream Laravel 9.52.21 release that TuxCare onboarded. The target contains the `flattenValue()` helper method (line 3720-3723 in Builder.php) that flattens nested arrays and extracts the first scalar element, which is semantically identical to the vendor patches' `scalarValue()` helper. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use this helper to limit query bindings to expected counts, preventing the injection of unexpected bindings that could cause queries to return unexpected results." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-13T11:04:00.126719+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 12.58.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 12.58.0-p5+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 12.58.0-p5+tuxcare of laravel/framework. CVE-2018-15133 describes remote code execution via unsafe PHP object deserialization when decrypting X-XSRF-TOKEN cookies. The vulnerability required the attacker to know the application encryption key and craft a malicious serialized object payload. Laravel Framework fixed this in August 2018 by disabling PHP object serialization during cookie encryption/decryption (setting $serialize=false by default). The target repository (laravel/framework version 12.58.0-p6+tuxcare) contains the complete vendor fix, which was shipped in the upstream Laravel v12.58.0 release and imported via TuxCare snapshot commit 85d8011ca6. The vulnerable pattern (unsafe unserialize() calls on cookie data) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 describes remote code execution via unsafe PHP object deserialization when decrypting X-XSRF-TOKEN cookies. The vulnerability required the attacker to know the application encryption key and craft a malicious serialized object payload. Laravel Framework fixed this in August 2018 by disabling PHP object serialization during cookie encryption/decryption (setting $serialize=false by default). The target repository (laravel/framework version 12.58.0-p6+tuxcare) contains the complete vendor fix, which was shipped in the upstream Laravel v12.58.0 release and imported via TuxCare snapshot commit 85d8011ca6. The vulnerable pattern (unsafe unserialize() calls on cookie data) is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 12.58.0-p5+tuxcare of laravel/framework. CVE-2019-9081 describes a PHP object injection gadget chain in PendingCommand's __destruct method. While this gadget chain exists in version 12.58.0, the framework itself does not provide any production code path where user-controllable serialized data is unserialized and could trigger this gadget. PendingCommand is a testing utility instantiated only in test contexts. Laravel's production serialization (sessions, cookies, cache) uses encrypted/signed data or server-side storage, preventing arbitrary payload injection. The framework is not vulnerable when used as designed; exploitation requires downstream applications to explicitly unserialize untrusted user data without restrictions, which constitutes an application-level vulnerability, not a framework vulnerability.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 describes a PHP object injection gadget chain in PendingCommand's __destruct method. While this gadget chain exists in version 12.58.0, the framework itself does not provide any production code path where user-controllable serialized data is unserialized and could trigger this gadget. PendingCommand is a testing utility instantiated only in test contexts. Laravel's production serialization (sessions, cookies, cache) uses encrypted/signed data or server-side storage, preventing arbitrary payload injection. The framework is not vulnerable when used as designed; exploitation requires downstream applications to explicitly unserialize untrusted user data without restrictions, which constitutes an application-level vulnerability, not a framework vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 12.58.0-p5+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before v5.8.17 (May 2019). The target repository is Laravel Framework v12.58.0 (released late 2024), which already contains the upstream fix. The vulnerable code pattern (unescaped shell parameters in the link() method) is not present. Both exec() calls at lines 358 and 364 in src/Illuminate/Filesystem/Filesystem.php properly use escapeshellarg() on the $target and $link parameters, preventing OS command injection. This fix was shipped in the upstream v12.58.0 release that TuxCare imported via snapshot commit 85d8011ca6, not added as a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before v5.8.17 (May 2019). The target repository is Laravel Framework v12.58.0 (released late 2024), which already contains the upstream fix. The vulnerable code pattern (unescaped shell parameters in the link() method) is not present. Both exec() calls at lines 358 and 364 in src/Illuminate/Filesystem/Filesystem.php properly use escapeshellarg() on the $target and $link parameters, preventing OS command injection. This fix was shipped in the upstream v12.58.0 release that TuxCare imported via snapshot commit 85d8011ca6, not added as a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:41:57.354813+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 12.58.0-p5+tuxcare of laravel/framework. The target Laravel 12.58.0 is not affected by CVE-2020-24941. The vulnerability affected Laravel before 6.18.35 and 7.x before 7.24.0, where the $guarded property could be bypassed using JSON column nesting expressions or non-existent column names. The upstream fix (commit 897d107775, authored by Taylor Otwell on 2020-08-07) introduced the isGuardableColumn() method that validates attribute keys against actual database columns. This fix has been part of Laravel's codebase for years and was already present in the upstream v12.58.0 release that TuxCare onboarded in May 2026. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel 12.58.0 is not affected by CVE-2020-24941. The vulnerability affected Laravel before 6.18.35 and 7.x before 7.24.0, where the $guarded property could be bypassed using JSON column nesting expressions or non-existent column names. The upstream fix (commit 897d107775, authored by Taylor Otwell on 2020-08-07) introduced the isGuardableColumn() method that validates attribute keys against actual database columns. This fix has been part of Laravel's codebase for years and was already present in the upstream v12.58.0 release that TuxCare onboarded in May 2026. The vulnerable code pattern is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 12.58.0-p5+tuxcare of laravel/framework. Laravel v12.58.0 is not affected by CVE-2021-21263. The upstream release already contains the flattenValue() method which provides equivalent protection to the security patch. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) normalize array inputs to scalars before adding query bindings, preventing the query binding exploitation described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "Laravel v12.58.0 is not affected by CVE-2021-21263. The upstream release already contains the flattenValue() method which provides equivalent protection to the security patch. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) normalize array inputs to scalars before adding query bindings, preventing the query binding exploitation described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 12.58.0-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 12.58.0-p5+tuxcare of laravel/framework. CVE-2024-52301 (environment manipulation via query string) is NOT present in Laravel Framework v12.58.0-p6+tuxcare. The vulnerable pattern (unconditional use of $_SERVER['argv'] for environment detection) has been replaced with a SAPI-based guard that blocks web requests from using argv values. The fix was authored by Taylor Otwell and shipped in upstream Laravel v12.58.0 before TuxCare snapshotted this version. The current code at Application.php:791 checks runningInConsole() (which validates PHP_SAPI === 'cli') before accessing argv, preventing attackers from manipulating the framework environment via crafted query strings when register_argc_argv is enabled.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "CVE-2024-52301 (environment manipulation via query string) is NOT present in Laravel Framework v12.58.0-p6+tuxcare. The vulnerable pattern (unconditional use of $_SERVER['argv'] for environment detection) has been replaced with a SAPI-based guard that blocks web requests from using argv values. The fix was authored by Taylor Otwell and shipped in upstream Laravel v12.58.0 before TuxCare snapshotted this version. The current code at Application.php:791 checks runningInConsole() (which validates PHP_SAPI === 'cli') before accessing argv, preventing attackers from manipulating the framework environment via crafted query strings when register_argc_argv is enabled." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 12.58.0-p5+tuxcare of laravel/framework. not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-13T11:04:00.126719+00:00", "status_notes": "Vulnerability CVE-2026-102279 is fixed in version 12.58.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-102279" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2026-114508 affects version 12.58.0-p5+tuxcare of laravel/framework, and is fixed in 12.58.0-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-114508" }, "action_statement": "Vulnerability CVE-2026-114508 affects version 12.58.0-p5+tuxcare of laravel/framework, and is fixed in 12.58.0-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T12:31:25.113305+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 12.58.0-p5+tuxcare of laravel/framework, and is fixed in 12.58.0-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 12.58.0-p5+tuxcare of laravel/framework, and is fixed in 12.58.0-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T20:49:09.974795+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 12.58.0-p5+tuxcare of laravel/framework. not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-13T11:04:00.126719+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 12.58.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 12.58.0-p5+tuxcare of laravel/framework. not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 12.58.0-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-13T11:04:00.126719+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp is fixed in version 12.58.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T21:16:19.887305+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 12.58.0-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:18:00.235397+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 12.58.0-p5+tuxcare of laravel/framework. The target Laravel framework v12.58.0 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability (predictable SHA1-based cookie prefixes enabling encryption oracle attacks) was fixed in upstream Laravel 6.18.31 (July 2020). The fix uses HMAC-SHA1 with the secret key instead of plain SHA1, preventing attackers from crafting valid cookie prefixes. This fix was already present in the upstream Laravel 12.58.0 release that TuxCare onboarded, making the vulnerable code pattern absent from the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework v12.58.0 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability (predictable SHA1-based cookie prefixes enabling encryption oracle attacks) was fixed in upstream Laravel 6.18.31 (July 2020). The fix uses HMAC-SHA1 with the secret key instead of plain SHA1, preventing attackers from crafting valid cookie prefixes. This fix was already present in the upstream Laravel 12.58.0 release that TuxCare onboarded, making the vulnerable code pattern absent from the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 12.58.0-p5+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:41:57.354813+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 12.58.0-p5+tuxcare of laravel/framework. Laravel framework v12.58.0 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability affects Laravel 6.x (patched January 2021) where array values passed to query builder methods could inject unexpected bindings. The current version 12.58.0 already includes upstream protection via the flattenValue() helper method, which flattens array inputs to scalar values before binding. All 10 affected methods (where, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, whereBetween, havingBetween) use this protection. The fix was present in the upstream Laravel v12.58.0 release imported during onboarding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "Laravel framework v12.58.0 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability affects Laravel 6.x (patched January 2021) where array values passed to query builder methods could inject unexpected bindings. The current version 12.58.0 already includes upstream protection via the flattenValue() helper method, which flattens array inputs to scalar values before binding. All 10 affected methods (where, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, whereBetween, havingBetween) use this protection. The fix was present in the upstream Laravel v12.58.0 release imported during onboarding." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-14775 is fixed in version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2017-14775" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-16894 is fixed in version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2017-16894" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-15133 is fixed in version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 5.4.36-p2+tuxcare of laravel/framework. CVE-2019-9081 targets the PendingCommand class in Laravel Framework 5.7.x, which does not exist in the target version 5.4.36. The vulnerable component was introduced in version 5.7 and is not present in this earlier version. Exhaustive searches confirm no PendingCommand.php file exists in the codebase, and git history shows PendingCommand-related commits are tagged [5.7] or later. While similar classes (PendingDispatch, PendingBroadcast) exist with __destruct methods, they serve different purposes and are not the vulnerability target specified in CVE-2019-9081.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 targets the PendingCommand class in Laravel Framework 5.7.x, which does not exist in the target version 5.4.36. The vulnerable component was introduced in version 5.7 and is not present in this earlier version. Exhaustive searches confirm no PendingCommand.php file exists in the codebase, and git history shows PendingCommand-related commits are tagged [5.7] or later. While similar classes (PendingDispatch, PendingBroadcast) exist with __destruct methods, they serve different purposes and are not the vulnerability target specified in CVE-2019-9081." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.4.36-p2+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.4.36-p2+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.4.36-p2+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:17:00.109653+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.4.36-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 does not contain the vulnerable code. The CVE-2026-102279 vulnerability affects Laravel's custom exception renderer with Tippy.js tooltips (introduced in Laravel 11.x circa 2024). Version 5.4.36 (2017) uses Symfony's SymfonyExceptionHandler v3.4.47 for exception rendering, which does not use JavaScript tooltips and properly escapes all dynamic content via htmlspecialchars(). The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 does not contain the vulnerable code. The CVE-2026-102279 vulnerability affects Laravel's custom exception renderer with Tippy.js tooltips (introduced in Laravel 11.x circa 2024). Version 5.4.36 (2017) uses Symfony's SymfonyExceptionHandler v3.4.47 for exception rendering, which does not use JavaScript tooltips and properly escapes all dynamic content via htmlspecialchars(). The ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.4.36-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources subsystem (specifically in Illuminate\\Http\\Resources\\JsonApi\\Concerns\\ResolvesJsonApiElements), which was introduced in Laravel 12.x (circa 2024). Laravel 5.4.36 (released February 2017) predates this feature by approximately 7 years and 8 major versions. The vulnerable component does not exist...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources subsystem (specifically in Illuminate\\Http\\Resources\\JsonApi\\Concerns\\ResolvesJsonApiElements), which was introduced in Laravel 12.x (circa 2024). Laravel 5.4.36 (released February 2017) predates this feature by approximately 7 years and 8 major versions. The vulnerable component does not exist..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.4.36-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 5.4.36-p2+tuxcare of laravel/framework, and is fixed in 5.4.36-p3+tuxcare.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "action_statement": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 5.4.36-p2+tuxcare of laravel/framework, and is fixed in 5.4.36-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.4.36-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36-p4+tuxcare uses SwiftMailer, not Symfony Mailer. The CVE (GHSA-5vg9-5847-vvmq) is specific to 'how Symfony Mailer and Symfony Mime handle certain character sequences'. SwiftMailer has RFC 2822 grammar validation that should reject CRLF characters in email addresses (except as proper folding whitespace), providing a different defense mechanism than what the Laravel 12.x/13.x patch...", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36-p4+tuxcare uses SwiftMailer, not Symfony Mailer. The CVE (GHSA-5vg9-5847-vvmq) is specific to 'how Symfony Mailer and Symfony Mime handle certain character sequences'. SwiftMailer has RFC 2822 grammar validation that should reject CRLF characters in email addresses (except as proper folding whitespace), providing a different defense mechanism than what the Laravel 12.x/13.x patch..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr affects version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "action_statement": "Vulnerability GHSA-6jvx-8ch9-j2jr affects version 5.4.36-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 is fixed in version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.4.36-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability requires the LocalFilesystemAdapter with temporary signed URL support via temporarySignedRoute(), a feature introduced in Laravel 9+. Laravel 5.4 uses FilesystemAdapter which explicitly throws RuntimeException for local storage temporary URLs, stating 'This driver does not support creating temporary URLs.' The vulnerable c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability requires the LocalFilesystemAdapter with temporary signed URL support via temporarySignedRoute(), a feature introduced in Laravel 9+. Laravel 5.4 uses FilesystemAdapter which explicitly throws RuntimeException for local storage temporary URLs, stating 'This driver does not support creating temporary URLs.' The vulnerable c..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.4.36-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 5.4.36-p2+tuxcare of laravel/framework, and is fixed in 5.4.36-p4+tuxcare.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 5.4.36-p2+tuxcare of laravel/framework, and is fixed in 5.4.36-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.4.36-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.4.36-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:31:56.184046+00:00", "status_notes": "Vulnerability CVE-2021-3838 does not affect version 3.1.0-p1+tuxcare of dompdf/dompdf. Target version 3.1.0 is not affected by CVE-2021-3838 (PHAR deserialization vulnerability). The upstream fix for this vulnerability was already present in the upstream 3.1.0 release that TuxCare onboarded via snapshot commit 0c4ca96. The fix implements URI protocol validation with phar:// excluded from the default allowlist, preventing PHAR deserialization attacks. All critical file operation entry points (Image/Cache, Dompdf, Css/Stylesheet, FontMetrics) validate URI schemes against Options::getAllowedProtocols() before calling file_get_contents(), and phar:// is not included in the default allowed protocols.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-3838" }, "impact_statement": "Target version 3.1.0 is not affected by CVE-2021-3838 (PHAR deserialization vulnerability). The upstream fix for this vulnerability was already present in the upstream 3.1.0 release that TuxCare onboarded via snapshot commit 0c4ca96. The fix implements URI protocol validation with phar:// excluded from the default allowlist, preventing PHAR deserialization attacks. All critical file operation entry points (Image/Cache, Dompdf, Css/Stylesheet, FontMetrics) validate URI schemes against Options::getAllowedProtocols() before calling file_get_contents(), and phar:// is not included in the default allowed protocols." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:35:51.612990+00:00", "status_notes": "Vulnerability CVE-2021-3902 does not affect version 3.1.0-p1+tuxcare of dompdf/dompdf. CVE-2021-3902 (XXE/SSRF in SVG parser) is NOT present in dompdf 3.1.0-p1+tuxcare. The upstream fix that validates SVG image references and blocks embedded restricted resources was already included in the upstream 3.1.0 release that TuxCare imported. The target contains the complete defense logic (lines 141-185 in src/Image/Cache.php) with enhanced circular reference detection beyond the original patch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-3902" }, "impact_statement": "CVE-2021-3902 (XXE/SSRF in SVG parser) is NOT present in dompdf 3.1.0-p1+tuxcare. The upstream fix that validates SVG image references and blocks embedded restricted resources was already included in the upstream 3.1.0 release that TuxCare imported. The target contains the complete defense logic (lines 141-185 in src/Image/Cache.php) with enhanced circular reference detection beyond the original patch." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2022-0085 does not affect version 3.1.0-p1+tuxcare of dompdf/dompdf. not_affected \u2014 CVE-2022-0085 (SSRF via redirect following) is NOT present in dompdf 3.1.0. The fix was already included in the upstream 3.1.0 release. The target contains the mitigation (follow_location => false in HTTP context) at src/Options.php:374, which was part of the upstream release onboarded via the \"Snapshot of 3.1.0\" commit. The CVE affects versions prior to 2.0.0; version 3.1.0 is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-0085" }, "impact_statement": "not_affected \u2014 CVE-2022-0085 (SSRF via redirect following) is NOT present in dompdf 3.1.0. The fix was already included in the upstream 3.1.0 release. The target contains the mitigation (follow_location => false in HTTP context) at src/Options.php:374, which was part of the upstream release onboarded via the \"Snapshot of 3.1.0\" commit. The CVE affects versions prior to 2.0.0; version 3.1.0 is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:41:42.084809+00:00", "status_notes": "Vulnerability CVE-2022-2400 does not affect version 3.1.0-p1+tuxcare of dompdf/dompdf. not_affected \u2014 CVE-2022-2400 (chroot bypass vulnerability) was fixed by the upstream dompdf vendor in commit 99aeec1 (April 2022) and released in version 2.0.0 (June 2022). The target repository is version 3.1.0-p1+tuxcare, which is based on upstream 3.1.0 (January 2025) that inherited the fix. TuxCare's snapshot of 3.1.0 included the complete URI validation system (validateLocalUri, validateRemoteUri, valida...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-2400" }, "impact_statement": "not_affected \u2014 CVE-2022-2400 (chroot bypass vulnerability) was fixed by the upstream dompdf vendor in commit 99aeec1 (April 2022) and released in version 2.0.0 (June 2022). The target repository is version 3.1.0-p1+tuxcare, which is based on upstream 3.1.0 (January 2025) that inherited the fix. TuxCare's snapshot of 3.1.0 included the complete URI validation system (validateLocalUri, validateRemoteUri, valida..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:36:16.957056+00:00", "status_notes": "Vulnerability CVE-2022-28368 does not affect version 3.1.0-p1+tuxcare of dompdf/dompdf. CVE-2022-28368 is NOT present in dompdf 3.1.0-p1+tuxcare. The vulnerability allowed RCE via malicious file extensions in CSS @font-face src:url fields. The upstream fix (commit 4c70e1025bcd9b by Brian Sweeney) was already included in the upstream 3.1.0 release when TuxCare onboarded it via snapshot commit 0c4ca96. The vulnerable pattern (using URL extension for local files) is absent; the fix (determining extension from parsed font type) is present in src/FontMetrics.php:250-259.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28368" }, "impact_statement": "CVE-2022-28368 is NOT present in dompdf 3.1.0-p1+tuxcare. The vulnerability allowed RCE via malicious file extensions in CSS @font-face src:url fields. The upstream fix (commit 4c70e1025bcd9b by Brian Sweeney) was already included in the upstream 3.1.0 release when TuxCare onboarded it via snapshot commit 0c4ca96. The vulnerable pattern (using URL extension for local files) is absent; the fix (determining extension from parsed font type) is present in src/FontMetrics.php:250-259." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:35:24.909918+00:00", "status_notes": "Vulnerability CVE-2022-41343 does not affect version 3.1.0-p1+tuxcare of dompdf/dompdf. CVE-2022-41343 is NOT present in target dompdf 3.1.0-p1+tuxcare (commit 938c445). The vulnerability pattern (URI validation failures not halting font registration) is absent because the registerFont() method in src/FontMetrics.php properly returns false immediately after validation failures (lines 214, 221). This fix was introduced in upstream dompdf 2.0.1 by Brian Sweeney (August 2022) and was already present in the upstream 3.1.0 release that TuxCare onboarded via commit 0c4ca96 \"Snapshot of 3.1.0\". No TuxCare-specific backport of this CVE exists; the fix came with the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-41343" }, "impact_statement": "CVE-2022-41343 is NOT present in target dompdf 3.1.0-p1+tuxcare (commit 938c445). The vulnerability pattern (URI validation failures not halting font registration) is absent because the registerFont() method in src/FontMetrics.php properly returns false immediately after validation failures (lines 214, 221). This fix was introduced in upstream dompdf 2.0.1 by Brian Sweeney (August 2022) and was already present in the upstream 3.1.0 release that TuxCare onboarded via commit 0c4ca96 \"Snapshot of 3.1.0\". No TuxCare-specific backport of this CVE exists; the fix came with the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:34:56.294150+00:00", "status_notes": "Vulnerability CVE-2023-23924 does not affect version 3.1.0-p1+tuxcare of dompdf/dompdf. CVE-2023-23924 is NOT present in dompdf 3.1.0-p1+tuxcare. The vulnerability involved a case-sensitive tag name comparison in SVG parsing that allowed bypassing URI protocol validation using uppercase/mixed-case tags. The target repository contains the fix (strtolower normalization at line 147 of src/Image/Cache.php) which was already included in the upstream 3.1.0 release that TuxCare snapshotted.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23924" }, "impact_statement": "CVE-2023-23924 is NOT present in dompdf 3.1.0-p1+tuxcare. The vulnerability involved a case-sensitive tag name comparison in SVG parsing that allowed bypassing URI protocol validation using uppercase/mixed-case tags. The target repository contains the fix (strtolower normalization at line 147 of src/Image/Cache.php) which was already included in the upstream 3.1.0 release that TuxCare snapshotted." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:41:42.084809+00:00", "status_notes": "Vulnerability CVE-2023-50262 does not affect version 3.1.0-p1+tuxcare of dompdf/dompdf. not_affected \u2014 Target dompdf v3.1.0 is NOT AFFECTED by CVE-2023-50262. The circular SVG reference detection fix was already included in the upstream 3.1.0 release before TuxCare's onboarding. The fix adds a graph-based cycle detection mechanism ($svgRefs tracking array and detectCircularRef() method) that prevents infinite recursion when chained SVG image references would create a loop. The vulnerable pattern...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-50262" }, "impact_statement": "not_affected \u2014 Target dompdf v3.1.0 is NOT AFFECTED by CVE-2023-50262. The circular SVG reference detection fix was already included in the upstream 3.1.0 release before TuxCare's onboarding. The fix adds a graph-based cycle detection mechanism ($svgRefs tracking array and detectCircularRef() method) that prevents infinite recursion when chained SVG image references would create a loop. The vulnerable pattern..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55554 is fixed in version 3.1.0-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-55554" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55555 is fixed in version 3.1.0-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-55555" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56722 is fixed in version 3.1.0-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-56722" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59941 is fixed in version 3.1.0-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-59941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59942 is fixed in version 3.1.0-p1+tuxcare of dompdf/dompdf.", "vulnerability": { "name": "CVE-2026-59942" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/dompdf/dompdf@3.1.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59943 does not affect version 3.1.0-p1+tuxcare of dompdf/dompdf. not_affected \u2014 Dompdf 3.1.0 is not affected by CVE-2026-59943. The target repository contains comprehensive SVG image reference validation that prevents malicious file:// URIs in SVG elements from reaching the vulnerable code path in the php-svg-lib dependency. The defense mechanism validates all SVG image references against chroot restrictions before passing the SVG to php-svg-lib for rendering, effe...", "vulnerability": { "name": "CVE-2026-59943" }, "impact_statement": "not_affected \u2014 Dompdf 3.1.0 is not affected by CVE-2026-59943. The target repository contains comprehensive SVG image reference validation that prevents malicious file:// URIs in SVG elements from reaching the vulnerable code path in the php-svg-lib dependency. The defense mechanism validates all SVG image references against chroot restrictions before passing the SVG to php-svg-lib for rendering, effe..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T13:20:22.368161+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 9.52.21-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 9.52.21-p4+tuxcare is not affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 9.52.21, released years later, already contains this fix. Both DatabaseUserProvider.php and Eloque...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 9.52.21-p4+tuxcare is not affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 9.52.21, released years later, already contains this fix. Both DatabaseUserProvider.php and Eloque..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 9.52.21-p4+tuxcare of laravel/framework. The target Laravel framework version 9.52.21-p4+tuxcare is NOT AFFECTED by CVE-2018-15133. The vulnerability pattern (automatic PHP deserialization of decrypted cookie/header values) is not present because the upstream Laravel 9.52.21 release already shipped with the fix. The defense mechanism (passing `false` to the encrypter's decrypt method to prevent unserialize()) is active for both X-XSRF-TOKEN headers and encrypted cookies. All decrypt operations use `static::$serialize = false`, preventing the dangerous unserialize() call that would enable RCE through PHP object injection.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "The target Laravel framework version 9.52.21-p4+tuxcare is NOT AFFECTED by CVE-2018-15133. The vulnerability pattern (automatic PHP deserialization of decrypted cookie/header values) is not present because the upstream Laravel 9.52.21 release already shipped with the fix. The defense mechanism (passing `false` to the encrypter's decrypt method to prevent unserialize()) is active for both X-XSRF-TOKEN headers and encrypted cookies. All decrypt operations use `static::$serialize = false`, preventing the dangerous unserialize() call that would enable RCE through PHP object injection." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 9.52.21-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 9.52.21-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 9.52.21-p4+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before 5.8.17. Target version 9.52.21 already contains the upstream fix (escapeshellarg on both parameters in Filesystem.php::link()). The vulnerable code pattern is not present. The fix was shipped in upstream release v9.52.21, which was onboarded by TuxCare via snapshot commit ed9bb51c72.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before 5.8.17. Target version 9.52.21 already contains the upstream fix (escapeshellarg on both parameters in Filesystem.php::link()). The vulnerable code pattern is not present. The fix was shipped in upstream release v9.52.21, which was onboarded by TuxCare via snapshot commit ed9bb51c72." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:42:13.594930+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 9.52.21-p4+tuxcare of laravel/framework. CVE-2020-24941 does not affect this Laravel 9.52.21 installation. The vulnerability involved missing validation that attribute keys in mass-assignment correspond to actual database columns, allowing attackers to bypass $guarded protection using fake column names with JSON notation. The target code contains the complete upstream fix (isGuardableColumn method verifying against actual database columns) which was already present in Laravel v9.52.21 when TuxCare onboarded it in snapshot commit ed9bb51c. No TuxCare backport was needed as the fix shipped in the upstream release (original fix by Taylor Otwell in commit 897d107 for Laravel 6.x in August 2020, forward-ported to all subsequent versions including 9.x released February 2022).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 does not affect this Laravel 9.52.21 installation. The vulnerability involved missing validation that attribute keys in mass-assignment correspond to actual database columns, allowing attackers to bypass $guarded protection using fake column names with JSON notation. The target code contains the complete upstream fix (isGuardableColumn method verifying against actual database columns) which was already present in Laravel v9.52.21 when TuxCare onboarded it in snapshot commit ed9bb51c. No TuxCare backport was needed as the fix shipped in the upstream release (original fix by Taylor Otwell in commit 897d107 for Laravel 6.x in August 2020, forward-ported to all subsequent versions including 9.x released February 2022)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 9.52.21-p4+tuxcare of laravel/framework. Laravel framework v9.52.21 is not affected by CVE-2021-21263. The vulnerability affects versions <6.20.12, <7.30.3, and <8.22.1. Version 9.52.21 already contains the upstream fix that limits query bindings when array values are passed where scalar values are expected. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() method or array_slice() to restrict array inputs to expected element counts, preventing query binding exploitation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "Laravel framework v9.52.21 is not affected by CVE-2021-21263. The vulnerability affects versions <6.20.12, <7.30.3, and <8.22.1. Version 9.52.21 already contains the upstream fix that limits query bindings when array values are passed where scalar values are expected. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() method or array_slice() to restrict array inputs to expected element counts, preventing query binding exploitation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework 9.52.21 is not affected by CVE-2021-43808. The vulnerability fix (random per-request salt for parent placeholder hashing in Blade templates) was already present in the upstream Laravel 9.52.21 release when TuxCare onboarded it. The vulnerable pattern (predictable parent placeholder hash based solely on sha1($section)) is not present in the codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 The target Laravel Framework 9.52.21 is not affected by CVE-2021-43808. The vulnerability fix (random per-request salt for parent placeholder hashing in Blade templates) was already present in the upstream Laravel 9.52.21 release when TuxCare onboarded it. The vulnerable pattern (predictable parent placeholder hash based solely on sha1($section)) is not present in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 9.52.21-p4+tuxcare of laravel/framework. The target repository (Laravel framework 9.52.21) is NOT affected by CVE-2024-52301. The vulnerable code pattern that allowed environment manipulation via query strings is not present. The upstream Laravel team (Taylor Otwell) fixed this vulnerability in version 9.52.17 by adding a check to ensure $_SERVER['argv'] is only used when running in console mode (PHP_SAPI === 'cli' || PHP_SAPI === 'phpdbg'). This fix was already present in the upstream release 9.52.21 that TuxCare onboarded, making it an upstream fix rather than a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target repository (Laravel framework 9.52.21) is NOT affected by CVE-2024-52301. The vulnerable code pattern that allowed environment manipulation via query strings is not present. The upstream Laravel team (Taylor Otwell) fixed this vulnerability in version 9.52.17 by adding a check to ensure $_SERVER['argv'] is only used when running in console mode (PHP_SAPI === 'cli' || PHP_SAPI === 'phpdbg'). This fix was already present in the upstream release 9.52.21 that TuxCare onboarded, making it an upstream fix rather than a TuxCare backport." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T13:20:22.368161+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 9.52.21-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T13:20:22.368161+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-102279. The vulnerability concerns XSS via Tippy.js tooltips with allowHTML:true in Laravel 12.x's new exception renderer component. This component does not exist in Laravel 9.52.21, which uses Whoops or Symfony's HtmlErrorRenderer for exception display instead. Exhaustive searches found no tippy.js, allowHTML, or formatted-source.blade.php in the tar...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-102279. The vulnerability concerns XSS via Tippy.js tooltips with allowHTML:true in Laravel 12.x's new exception renderer component. This component does not exist in Laravel 9.52.21, which uses Whoops or Symfony's HtmlErrorRenderer for exception display instead. Exhaustive searches found no tippy.js, allowHTML, or formatted-source.blade.php in the tar..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource implementation (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x. Version 9.52.21 predates this feature entirely\u2014the JsonApi namespace, related classes, and the vulnerable include parameter processing mechanism do not exist in this version. The target cannot...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource implementation (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x. Version 9.52.21 predates this feature entirely\u2014the JsonApi namespace, related classes, and the vulnerable include parameter processing mechanism do not exist in this version. The target cannot..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T13:20:48.512438+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 9.52.21-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 9.52.21-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "action_statement": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 9.52.21-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T13:20:22.368161+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 9.52.21-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:04:11.478044+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-6jvx-8ch9-j2jr (CVE-2018-15133). The vulnerability involves PHP object injection through cookie deserialization. The upstream Laravel team fixed this in version 5.6.30 (August 2018) by disabling serialization for all cookies. Laravel 9.52.21, released years later, includes this fix via the EncryptCookies middleware's `$serialize = false` default. The vuln...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-6jvx-8ch9-j2jr (CVE-2018-15133). The vulnerability involves PHP object injection through cookie deserialization. The upstream Laravel team fixed this in version 5.6.30 (August 2018) by disabling serialization for all cookies. Laravel 9.52.21, released years later, includes this fix via the EncryptCookies middleware's `$serialize = false` default. The vuln..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework v9.52.21 is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decryption to return false instead of throwing an exception on manipulated payloads) was fixed by the upstream vendor in March 2018. The fix is present in the target at src/Illuminate/Encryption/Encrypter.php:246, where validPayload() validates that the base64-...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 Laravel Framework v9.52.21 is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decryption to return false instead of throwing an exception on manipulated payloads) was fixed by the upstream vendor in March 2018. The fix is present in the target at src/Illuminate/Encryption/Encrypter.php:246, where validPayload() validates that the base64-..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T13:20:22.368161+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 9.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 9.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable code pattern (uncontrolled array inputs causing unexpected query bindings) is not present because the upstream Laravel 9.52.21 release already contained all necessary fixes before TuxCare's snapshot import. The target implements the same defenses as the vendor patches: flattenValue() method normalizes array inputs...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable code pattern (uncontrolled array inputs causing unexpected query bindings) is not present because the upstream Laravel 9.52.21 release already contained all necessary fixes before TuxCare's snapshot import. The target implements the same defenses as the vendor patches: flattenValue() method normalizes array inputs..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:19:00.105438+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 9.52.21-p4+tuxcare of laravel/framework. The target Laravel 9.52.21-p4+tuxcare is NOT vulnerable to GHSA-qm5c-m76r-2hfr (cookie session driver RCE via encryption oracle). The vulnerability was fixed in upstream Laravel 6.18.31 (July 2020) by replacing predictable SHA1-based cookie prefixes with HMAC-based validation requiring the encryption key. Laravel 9.52.21 (released 2023) already contains this fix. The target was onboarded from the upstream release via snapshot commit ed9bb51c72, which brought the pre-fixed version. No vulnerable code patterns exist in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel 9.52.21-p4+tuxcare is NOT vulnerable to GHSA-qm5c-m76r-2hfr (cookie session driver RCE via encryption oracle). The vulnerability was fixed in upstream Laravel 6.18.31 (July 2020) by replacing predictable SHA1-based cookie prefixes with HMAC-based validation requiring the encryption key. Laravel 9.52.21 (released 2023) already contains this fix. The target was onboarded from the upstream release via snapshot commit ed9bb51c72, which brought the pre-fixed version. No vulnerable code patterns exist in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v9.52.21-p4+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL injection via limit/offset in SQL Server). The vulnerability pattern is not present because the fix was already included in the upstream Laravel v9.52.21 release that TuxCare onboarded. All required protections are in place: integer casting in Builder.php limit()/offset() methods and SqlServerGrammar.ph...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel framework v9.52.21-p4+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL injection via limit/offset in SQL Server). The vulnerability pattern is not present because the fix was already included in the upstream Laravel v9.52.21 release that TuxCare onboarded. All required protections are in place: integer casting in Builder.php limit()/offset() methods and SqlServerGrammar.ph..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:42:13.594930+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 9.52.21-p4+tuxcare of laravel/framework. Target Laravel 9.52.21 is not affected by GHSA-x7p5-p2c9-phvg. The fix for this vulnerability was already present in the upstream Laravel 9.52.21 release that TuxCare onboarded. The target contains the `flattenValue()` helper method (line 3720-3723 in Builder.php) that flattens nested arrays and extracts the first scalar element, which is semantically identical to the vendor patches' `scalarValue()` helper. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use this helper to limit query bindings to expected counts, preventing the injection of unexpected bindings that could cause queries to return unexpected results.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "Target Laravel 9.52.21 is not affected by GHSA-x7p5-p2c9-phvg. The fix for this vulnerability was already present in the upstream Laravel 9.52.21 release that TuxCare onboarded. The target contains the `flattenValue()` helper method (line 3720-3723 in Builder.php) that flattens nested arrays and extracts the first scalar element, which is semantically identical to the vendor patches' `scalarValue()` helper. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use this helper to limit query bindings to expected counts, preventing the injection of unexpected bindings that could cause queries to return unexpected results." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 12.58.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 12.58.0-p7+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 12.58.0-p7+tuxcare of laravel/framework. CVE-2018-15133 describes remote code execution via unsafe PHP object deserialization when decrypting X-XSRF-TOKEN cookies. The vulnerability required the attacker to know the application encryption key and craft a malicious serialized object payload. Laravel Framework fixed this in August 2018 by disabling PHP object serialization during cookie encryption/decryption (setting $serialize=false by default). The target repository (laravel/framework version 12.58.0-p6+tuxcare) contains the complete vendor fix, which was shipped in the upstream Laravel v12.58.0 release and imported via TuxCare snapshot commit 85d8011ca6. The vulnerable pattern (unsafe unserialize() calls on cookie data) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 describes remote code execution via unsafe PHP object deserialization when decrypting X-XSRF-TOKEN cookies. The vulnerability required the attacker to know the application encryption key and craft a malicious serialized object payload. Laravel Framework fixed this in August 2018 by disabling PHP object serialization during cookie encryption/decryption (setting $serialize=false by default). The target repository (laravel/framework version 12.58.0-p6+tuxcare) contains the complete vendor fix, which was shipped in the upstream Laravel v12.58.0 release and imported via TuxCare snapshot commit 85d8011ca6. The vulnerable pattern (unsafe unserialize() calls on cookie data) is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 12.58.0-p7+tuxcare of laravel/framework. CVE-2019-9081 describes a PHP object injection gadget chain in PendingCommand's __destruct method. While this gadget chain exists in version 12.58.0, the framework itself does not provide any production code path where user-controllable serialized data is unserialized and could trigger this gadget. PendingCommand is a testing utility instantiated only in test contexts. Laravel's production serialization (sessions, cookies, cache) uses encrypted/signed data or server-side storage, preventing arbitrary payload injection. The framework is not vulnerable when used as designed; exploitation requires downstream applications to explicitly unserialize untrusted user data without restrictions, which constitutes an application-level vulnerability, not a framework vulnerability.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 describes a PHP object injection gadget chain in PendingCommand's __destruct method. While this gadget chain exists in version 12.58.0, the framework itself does not provide any production code path where user-controllable serialized data is unserialized and could trigger this gadget. PendingCommand is a testing utility instantiated only in test contexts. Laravel's production serialization (sessions, cookies, cache) uses encrypted/signed data or server-side storage, preventing arbitrary payload injection. The framework is not vulnerable when used as designed; exploitation requires downstream applications to explicitly unserialize untrusted user data without restrictions, which constitutes an application-level vulnerability, not a framework vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 12.58.0-p7+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before v5.8.17 (May 2019). The target repository is Laravel Framework v12.58.0 (released late 2024), which already contains the upstream fix. The vulnerable code pattern (unescaped shell parameters in the link() method) is not present. Both exec() calls at lines 358 and 364 in src/Illuminate/Filesystem/Filesystem.php properly use escapeshellarg() on the $target and $link parameters, preventing OS command injection. This fix was shipped in the upstream v12.58.0 release that TuxCare imported via snapshot commit 85d8011ca6, not added as a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before v5.8.17 (May 2019). The target repository is Laravel Framework v12.58.0 (released late 2024), which already contains the upstream fix. The vulnerable code pattern (unescaped shell parameters in the link() method) is not present. Both exec() calls at lines 358 and 364 in src/Illuminate/Filesystem/Filesystem.php properly use escapeshellarg() on the $target and $link parameters, preventing OS command injection. This fix was shipped in the upstream v12.58.0 release that TuxCare imported via snapshot commit 85d8011ca6, not added as a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-31T20:41:57.354813+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 12.58.0-p7+tuxcare of laravel/framework. The target Laravel 12.58.0 is not affected by CVE-2020-24941. The vulnerability affected Laravel before 6.18.35 and 7.x before 7.24.0, where the $guarded property could be bypassed using JSON column nesting expressions or non-existent column names. The upstream fix (commit 897d107775, authored by Taylor Otwell on 2020-08-07) introduced the isGuardableColumn() method that validates attribute keys against actual database columns. This fix has been part of Laravel's codebase for years and was already present in the upstream v12.58.0 release that TuxCare onboarded in May 2026. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel 12.58.0 is not affected by CVE-2020-24941. The vulnerability affected Laravel before 6.18.35 and 7.x before 7.24.0, where the $guarded property could be bypassed using JSON column nesting expressions or non-existent column names. The upstream fix (commit 897d107775, authored by Taylor Otwell on 2020-08-07) introduced the isGuardableColumn() method that validates attribute keys against actual database columns. This fix has been part of Laravel's codebase for years and was already present in the upstream v12.58.0 release that TuxCare onboarded in May 2026. The vulnerable code pattern is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 12.58.0-p7+tuxcare of laravel/framework. Laravel v12.58.0 is not affected by CVE-2021-21263. The upstream release already contains the flattenValue() method which provides equivalent protection to the security patch. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) normalize array inputs to scalars before adding query bindings, preventing the query binding exploitation described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "Laravel v12.58.0 is not affected by CVE-2021-21263. The upstream release already contains the flattenValue() method which provides equivalent protection to the security patch. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) normalize array inputs to scalars before adding query bindings, preventing the query binding exploitation described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 12.58.0-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 12.58.0-p7+tuxcare of laravel/framework. CVE-2024-52301 (environment manipulation via query string) is NOT present in Laravel Framework v12.58.0-p6+tuxcare. The vulnerable pattern (unconditional use of $_SERVER['argv'] for environment detection) has been replaced with a SAPI-based guard that blocks web requests from using argv values. The fix was authored by Taylor Otwell and shipped in upstream Laravel v12.58.0 before TuxCare snapshotted this version. The current code at Application.php:791 checks runningInConsole() (which validates PHP_SAPI === 'cli') before accessing argv, preventing attackers from manipulating the framework environment via crafted query strings when register_argc_argv is enabled.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "CVE-2024-52301 (environment manipulation via query string) is NOT present in Laravel Framework v12.58.0-p6+tuxcare. The vulnerable pattern (unconditional use of $_SERVER['argv'] for environment detection) has been replaced with a SAPI-based guard that blocks web requests from using argv values. The fix was authored by Taylor Otwell and shipped in upstream Laravel v12.58.0 before TuxCare snapshotted this version. The current code at Application.php:791 checks runningInConsole() (which validates PHP_SAPI === 'cli') before accessing argv, preventing attackers from manipulating the framework environment via crafted query strings when register_argc_argv is enabled." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 12.58.0-p7+tuxcare of laravel/framework. not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2026-102279 is fixed in version 12.58.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-102279" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2026-114508 is fixed in version 12.58.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114508" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 12.58.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 12.58.0-p7+tuxcare of laravel/framework. not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 12.58.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 12.58.0-p7+tuxcare of laravel/framework. not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 12.58.0-p7+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp is fixed in version 12.58.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 12.58.0-p7+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-31T20:18:00.235397+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 12.58.0-p7+tuxcare of laravel/framework. The target Laravel framework v12.58.0 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability (predictable SHA1-based cookie prefixes enabling encryption oracle attacks) was fixed in upstream Laravel 6.18.31 (July 2020). The fix uses HMAC-SHA1 with the secret key instead of plain SHA1, preventing attackers from crafting valid cookie prefixes. This fix was already present in the upstream Laravel 12.58.0 release that TuxCare onboarded, making the vulnerable code pattern absent from the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework v12.58.0 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability (predictable SHA1-based cookie prefixes enabling encryption oracle attacks) was fixed in upstream Laravel 6.18.31 (July 2020). The fix uses HMAC-SHA1 with the secret key instead of plain SHA1, preventing attackers from crafting valid cookie prefixes. This fix was already present in the upstream Laravel 12.58.0 release that TuxCare onboarded, making the vulnerable code pattern absent from the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 12.58.0-p7+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p7+tuxcare" } } ], "timestamp": "2026-10-31T20:41:57.354813+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 12.58.0-p7+tuxcare of laravel/framework. Laravel framework v12.58.0 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability affects Laravel 6.x (patched January 2021) where array values passed to query builder methods could inject unexpected bindings. The current version 12.58.0 already includes upstream protection via the flattenValue() helper method, which flattens array inputs to scalar values before binding. All 10 affected methods (where, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, whereBetween, havingBetween) use this protection. The fix was present in the upstream Laravel v12.58.0 release imported during onboarding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "Laravel framework v12.58.0 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability affects Laravel 6.x (patched January 2021) where array values passed to query builder methods could inject unexpected bindings. The current version 12.58.0 already includes upstream protection via the flattenValue() helper method, which flattens array inputs to scalar values before binding. All 10 affected methods (where, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, whereBetween, havingBetween) use this protection. The fix was present in the upstream Laravel v12.58.0 release imported during onboarding." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-14775 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare.", "vulnerability": { "name": "CVE-2017-14775" }, "action_statement": "Vulnerability CVE-2017-14775 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-16894 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare.", "vulnerability": { "name": "CVE-2017-16894" }, "action_statement": "Vulnerability CVE-2017-16894 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 5.4.36-p1+tuxcare of laravel/framework. CVE-2019-9081 targets the PendingCommand class in Laravel Framework 5.7.x, which does not exist in the target version 5.4.36. The vulnerable component was introduced in version 5.7 and is not present in this earlier version. Exhaustive searches confirm no PendingCommand.php file exists in the codebase, and git history shows PendingCommand-related commits are tagged [5.7] or later. While similar classes (PendingDispatch, PendingBroadcast) exist with __destruct methods, they serve different purposes and are not the vulnerability target specified in CVE-2019-9081.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 targets the PendingCommand class in Laravel Framework 5.7.x, which does not exist in the target version 5.4.36. The vulnerable component was introduced in version 5.7 and is not present in this earlier version. Exhaustive searches confirm no PendingCommand.php file exists in the codebase, and git history shows PendingCommand-related commits are tagged [5.7] or later. While similar classes (PendingDispatch, PendingBroadcast) exist with __destruct methods, they serve different purposes and are not the vulnerability target specified in CVE-2019-9081." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.4.36-p1+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.4.36-p1+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.4.36-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.4.36-p1+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare.", "vulnerability": { "name": "CVE-2025-27515" }, "action_statement": "Vulnerability CVE-2025-27515 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:17:00.109653+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.4.36-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 does not contain the vulnerable code. The CVE-2026-102279 vulnerability affects Laravel's custom exception renderer with Tippy.js tooltips (introduced in Laravel 11.x circa 2024). Version 5.4.36 (2017) uses Symfony's SymfonyExceptionHandler v3.4.47 for exception rendering, which does not use JavaScript tooltips and properly escapes all dynamic content via htmlspecialchars(). The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 does not contain the vulnerable code. The CVE-2026-102279 vulnerability affects Laravel's custom exception renderer with Tippy.js tooltips (introduced in Laravel 11.x circa 2024). Version 5.4.36 (2017) uses Symfony's SymfonyExceptionHandler v3.4.47 for exception rendering, which does not use JavaScript tooltips and properly escapes all dynamic content via htmlspecialchars(). The ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.4.36-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources subsystem (specifically in Illuminate\\Http\\Resources\\JsonApi\\Concerns\\ResolvesJsonApiElements), which was introduced in Laravel 12.x (circa 2024). Laravel 5.4.36 (released February 2017) predates this feature by approximately 7 years and 8 major versions. The vulnerable component does not exist...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources subsystem (specifically in Illuminate\\Http\\Resources\\JsonApi\\Concerns\\ResolvesJsonApiElements), which was introduced in Laravel 12.x (circa 2024). Laravel 5.4.36 (released February 2017) predates this feature by approximately 7 years and 8 major versions. The vulnerable component does not exist..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.4.36-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.4.36-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p3+tuxcare.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "action_statement": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.4.36-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36-p4+tuxcare uses SwiftMailer, not Symfony Mailer. The CVE (GHSA-5vg9-5847-vvmq) is specific to 'how Symfony Mailer and Symfony Mime handle certain character sequences'. SwiftMailer has RFC 2822 grammar validation that should reject CRLF characters in email addresses (except as proper folding whitespace), providing a different defense mechanism than what the Laravel 12.x/13.x patch...", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36-p4+tuxcare uses SwiftMailer, not Symfony Mailer. The CVE (GHSA-5vg9-5847-vvmq) is specific to 'how Symfony Mailer and Symfony Mime handle certain character sequences'. SwiftMailer has RFC 2822 grammar validation that should reject CRLF characters in email addresses (except as proper folding whitespace), providing a different defense mechanism than what the Laravel 12.x/13.x patch..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr affects version 5.4.36-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "action_statement": "Vulnerability GHSA-6jvx-8ch9-j2jr affects version 5.4.36-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare.", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "action_statement": "Vulnerability GHSA-7852-w36x-6mf6 affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.4.36-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability requires the LocalFilesystemAdapter with temporary signed URL support via temporarySignedRoute(), a feature introduced in Laravel 9+. Laravel 5.4 uses FilesystemAdapter which explicitly throws RuntimeException for local storage temporary URLs, stating 'This driver does not support creating temporary URLs.' The vulnerable c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability requires the LocalFilesystemAdapter with temporary signed URL support via temporarySignedRoute(), a feature introduced in Laravel 9+. Laravel 5.4 uses FilesystemAdapter which explicitly throws RuntimeException for local storage temporary URLs, stating 'This driver does not support creating temporary URLs.' The vulnerable c..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.4.36-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.4.36-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p4+tuxcare.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.4.36-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.4.36-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 5.4.36-p1+tuxcare of laravel/framework, and is fixed in 5.4.36-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/livewire/livewire@v3.6.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/livewire/livewire@v3.6.4-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:31:06.412502+00:00", "status_notes": "Vulnerability CVE-2025-54068 does not affect version v3.6.4-p1+tuxcare of livewire/livewire. The target repository (livewire/livewire v3.6.4-p2+tuxcare) is not affected by CVE-2025-54068. The vulnerability was fixed by the upstream vendor in v3.6.4 (commit ef04be75 by Josh Hanley). TuxCare onboarded the already-patched v3.6.4 release via snapshot commit ac0e1f76. The fix adds a hydratePropertyUpdate() method that prevents nested property removal markers (__rm__) from being hydrated through synthesizers, blocking the RCE attack vector.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-54068" }, "impact_statement": "The target repository (livewire/livewire v3.6.4-p2+tuxcare) is not affected by CVE-2025-54068. The vulnerability was fixed by the upstream vendor in v3.6.4 (commit ef04be75 by Josh Hanley). TuxCare onboarded the already-patched v3.6.4 release via snapshot commit ac0e1f76. The fix adds a hydratePropertyUpdate() method that prevents nested property removal markers (__rm__) from being hydrated through synthesizers, blocking the RCE attack vector." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/livewire/livewire@v3.6.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/livewire/livewire@v3.6.4-p1+tuxcare" } } ], "timestamp": "2026-10-01T15:31:40.708330+00:00", "status_notes": "Vulnerability CVE-2026-81887 is fixed in version v3.6.4-p1+tuxcare of livewire/livewire.", "vulnerability": { "name": "CVE-2026-81887" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-14775 is fixed in version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2017-14775" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-16894 is fixed in version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2017-16894" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-15133 is fixed in version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 5.4.36-p3+tuxcare of laravel/framework. CVE-2019-9081 targets the PendingCommand class in Laravel Framework 5.7.x, which does not exist in the target version 5.4.36. The vulnerable component was introduced in version 5.7 and is not present in this earlier version. Exhaustive searches confirm no PendingCommand.php file exists in the codebase, and git history shows PendingCommand-related commits are tagged [5.7] or later. While similar classes (PendingDispatch, PendingBroadcast) exist with __destruct methods, they serve different purposes and are not the vulnerability target specified in CVE-2019-9081.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 targets the PendingCommand class in Laravel Framework 5.7.x, which does not exist in the target version 5.4.36. The vulnerable component was introduced in version 5.7 and is not present in this earlier version. Exhaustive searches confirm no PendingCommand.php file exists in the codebase, and git history shows PendingCommand-related commits are tagged [5.7] or later. While similar classes (PendingDispatch, PendingBroadcast) exist with __destruct methods, they serve different purposes and are not the vulnerability target specified in CVE-2019-9081." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.4.36-p3+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.4.36-p3+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.4.36-p3+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-29T20:17:00.109653+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.4.36-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 does not contain the vulnerable code. The CVE-2026-102279 vulnerability affects Laravel's custom exception renderer with Tippy.js tooltips (introduced in Laravel 11.x circa 2024). Version 5.4.36 (2017) uses Symfony's SymfonyExceptionHandler v3.4.47 for exception rendering, which does not use JavaScript tooltips and properly escapes all dynamic content via htmlspecialchars(). The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 does not contain the vulnerable code. The CVE-2026-102279 vulnerability affects Laravel's custom exception renderer with Tippy.js tooltips (introduced in Laravel 11.x circa 2024). Version 5.4.36 (2017) uses Symfony's SymfonyExceptionHandler v3.4.47 for exception rendering, which does not use JavaScript tooltips and properly escapes all dynamic content via htmlspecialchars(). The ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.4.36-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources subsystem (specifically in Illuminate\\Http\\Resources\\JsonApi\\Concerns\\ResolvesJsonApiElements), which was introduced in Laravel 12.x (circa 2024). Laravel 5.4.36 (released February 2017) predates this feature by approximately 7 years and 8 major versions. The vulnerable component does not exist...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources subsystem (specifically in Illuminate\\Http\\Resources\\JsonApi\\Concerns\\ResolvesJsonApiElements), which was introduced in Laravel 12.x (circa 2024). Laravel 5.4.36 (released February 2017) predates this feature by approximately 7 years and 8 major versions. The vulnerable component does not exist..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.4.36-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.4.36-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36-p4+tuxcare uses SwiftMailer, not Symfony Mailer. The CVE (GHSA-5vg9-5847-vvmq) is specific to 'how Symfony Mailer and Symfony Mime handle certain character sequences'. SwiftMailer has RFC 2822 grammar validation that should reject CRLF characters in email addresses (except as proper folding whitespace), providing a different defense mechanism than what the Laravel 12.x/13.x patch...", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36-p4+tuxcare uses SwiftMailer, not Symfony Mailer. The CVE (GHSA-5vg9-5847-vvmq) is specific to 'how Symfony Mailer and Symfony Mime handle certain character sequences'. SwiftMailer has RFC 2822 grammar validation that should reject CRLF characters in email addresses (except as proper folding whitespace), providing a different defense mechanism than what the Laravel 12.x/13.x patch..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr affects version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "action_statement": "Vulnerability GHSA-6jvx-8ch9-j2jr affects version 5.4.36-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 is fixed in version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.4.36-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability requires the LocalFilesystemAdapter with temporary signed URL support via temporarySignedRoute(), a feature introduced in Laravel 9+. Laravel 5.4 uses FilesystemAdapter which explicitly throws RuntimeException for local storage temporary URLs, stating 'This driver does not support creating temporary URLs.' The vulnerable c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability requires the LocalFilesystemAdapter with temporary signed URL support via temporarySignedRoute(), a feature introduced in Laravel 9+. Laravel 5.4 uses FilesystemAdapter which explicitly throws RuntimeException for local storage temporary URLs, stating 'This driver does not support creating temporary URLs.' The vulnerable c..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.4.36-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 5.4.36-p3+tuxcare of laravel/framework, and is fixed in 5.4.36-p4+tuxcare.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 5.4.36-p3+tuxcare of laravel/framework, and is fixed in 5.4.36-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.4.36-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.4.36-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 10.50.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before version 5.5.10 due to timing-attack vulnerability in remember-me token verification. The target repository contains Laravel 10.50.2, which is approximately 7 years newer than the fixed version. The fix (constant-time token comparison using hash_equals) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. Both DatabaseUserProvi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before version 5.5.10 due to timing-attack vulnerability in remember-me token verification. The target repository contains Laravel 10.50.2, which is approximately 7 years newer than the fixed version. The fix (constant-time token comparison using hash_equals) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. Both DatabaseUserProvi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 10.50.2-p3+tuxcare of laravel/framework. Laravel 10.50.2 is not affected by CVE-2018-15133 (PHP object injection via unserialized cookies). The vulnerability affected Laravel 5.5.x/5.6.x in 2018 and was fixed upstream by disabling automatic unserialization in cookie decryption. Version 10.50.2 (released in 2024) was built on the fixed codebase and contains the defense by default: `protected static $serialize = false` ensures all decrypt() calls pass `false` for the unserialize parameter, preventing dangerous unserialize() from being called on attacker-controlled cookie data. The fix was authored by Taylor Otwell (upstream Laravel maintainer) and shipped in the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "Laravel 10.50.2 is not affected by CVE-2018-15133 (PHP object injection via unserialized cookies). The vulnerability affected Laravel 5.5.x/5.6.x in 2018 and was fixed upstream by disabling automatic unserialization in cookie decryption. Version 10.50.2 (released in 2024) was built on the fixed codebase and contains the defense by default: `protected static $serialize = false` ensures all decrypt() calls pass `false` for the unserialize parameter, preventing dangerous unserialize() from being called on attacker-controlled cookie data. The fix was authored by Taylor Otwell (upstream Laravel maintainer) and shipped in the upstream release that TuxCare onboarded." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 10.50.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 10.50.2-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 10.50.2-p3+tuxcare of laravel/framework. CVE-2020-19316 (OS command injection via unsanitized mklink parameters) does not affect Laravel Framework 10.50.2. The upstream fix (escapeshellarg on both $link and $target parameters) was introduced in Laravel 5.8.17 (May 2019) by Taylor Otwell and is present in the target version. Target version 10.50.2 is 5+ major versions after the fix, confirming it shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 (OS command injection via unsanitized mklink parameters) does not affect Laravel Framework 10.50.2. The upstream fix (escapeshellarg on both $link and $target parameters) was introduced in Laravel 5.8.17 (May 2019) by Taylor Otwell and is present in the target version. Target version 10.50.2 is 5+ major versions after the fix, confirming it shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:42:04.797220+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 10.50.2-p3+tuxcare of laravel/framework. CVE-2020-24941 is NOT present in Laravel 10.50.2-p4+tuxcare. The vulnerability involves bypassing the $guarded property using non-existent column names or JSON nesting expressions. The target contains the complete upstream fix: the isGuarded() method validates that column names exist in the database schema via isGuardableColumn(), treating non-existent columns as automatically guarded. This fix was included in the upstream Laravel 10.50.2 release and imported via TuxCare's onboarding commit (snapshot without history).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 is NOT present in Laravel 10.50.2-p4+tuxcare. The vulnerability involves bypassing the $guarded property using non-existent column names or JSON nesting expressions. The target contains the complete upstream fix: the isGuarded() method validates that column names exist in the database schema via isGuardableColumn(), treating non-existent columns as automatically guarded. This fix was included in the upstream Laravel 10.50.2 release and imported via TuxCare's onboarding commit (snapshot without history)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 10.50.2-p3+tuxcare of laravel/framework. Laravel 10.50.2 is not affected by CVE-2021-21263. The vulnerability targeted Laravel versions < 6.20.12, < 7.30.3, and < 8.22.1, and was patched in January 2021. The target version (10.50.2, released in 2024) already contains the fix from the upstream release. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) now use the flattenValue() method which prevents array values from adding unexpected query bindings. This fix was present in the upstream Laravel 10.50.2 release before TuxCare's onboarding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "Laravel 10.50.2 is not affected by CVE-2021-21263. The vulnerability targeted Laravel versions < 6.20.12, < 7.30.3, and < 8.22.1, and was patched in January 2021. The target version (10.50.2, released in 2024) already contains the fix from the upstream release. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) now use the flattenValue() method which prevents array values from adding unexpected query bindings. This fix was present in the upstream Laravel 10.50.2 release before TuxCare's onboarding." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is NOT present in Laravel 10.50.2. The vulnerability was fixed upstream in December 2021 (Laravel 6.x/7.x/8.x), and the fix was already included when Laravel 10.x was released in February 2023. The target code shows all three components of the security fix: (1) ManagesLayouts.php generates parent placeholders using a random 40-charac...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is NOT present in Laravel 10.50.2. The vulnerability was fixed upstream in December 2021 (Laravel 6.x/7.x/8.x), and the fix was already included when Laravel 10.x was released in February 2023. The target code shows all three components of the security fix: (1) ManagesLayouts.php generates parent placeholders using a random 40-charac..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 10.50.2-p3+tuxcare of laravel/framework. The target repository (laravel/framework 10.50.2) is NOT affected by CVE-2024-52301. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when register_argc_argv was enabled. The fix\u2014checking runningInConsole() before using $_SERVER['argv'] for environment detection\u2014was already present in the upstream Laravel 10.50.2 release (Nov 12, 2024) and was imported by TuxCare via the onboarding snapshot commit. The vulnerable pattern (unconditional use of $_SERVER['argv']) is absent in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target repository (laravel/framework 10.50.2) is NOT affected by CVE-2024-52301. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when register_argc_argv was enabled. The fix\u2014checking runningInConsole() before using $_SERVER['argv'] for environment detection\u2014was already present in the upstream Laravel 10.50.2 release (Nov 12, 2024) and was imported by TuxCare via the onboarding snapshot commit. The vulnerable pattern (unconditional use of $_SERVER['argv']) is absent in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 10.50.2-p4+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. The fix modifies the Validator class to preserve internal placeholder encoding when passing attribute names to File/Email/Password custom rules, preventing attackers from bypassing wildcard valid...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target repository (laravel/framework 10.50.2-p4+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. The fix modifies the Validator class to preserve internal placeholder encoding when passing attribute names to File/Email/Password custom rules, preventing attackers from bypassing wildcard valid..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-09-29T20:33:09.068963+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.50.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's new exception renderer feature that uses Tippy.js tooltips with allowHTML:true. Laravel 10.x uses a completely different exception handling system (Whoops library) and does not contain the vulnerable code pattern. The exception renderer with Tippy.js was introduced in Laravel 12.x and does not exist i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 10.50.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's new exception renderer feature that uses Tippy.js tooltips with allowHTML:true. Laravel 10.x uses a completely different exception handling system (Whoops library) and does not contain the vulnerable code pattern. The exception renderer with Tippy.js was introduced in Laravel 12.x and does not exist i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework 10.50.2-p4+tuxcare is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in the JsonApi resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x (December 2025). Laravel 10.x does not contain any JsonApi resource functionality. Exhaustive searches across all 2522 files in the repository found no JsonApi-related co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target Laravel Framework 10.50.2-p4+tuxcare is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in the JsonApi resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x (December 2025). Laravel 10.x does not contain any JsonApi resource functionality. Exhaustive searches across all 2522 files in the repository found no JsonApi-related co..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T15:16:50.127733+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 10.50.2-p3+tuxcare of laravel/framework, and is fixed in 10.50.2-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 10.50.2-p3+tuxcare of laravel/framework, and is fixed in 10.50.2-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:46:45.854078+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 The target (Laravel 10.50.2-p4+tuxcare) is NOT AFFECTED by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input to limit/offset/skip/take functions on SQL Server. The fix (integer casting) was already present in upstream Laravel 10.50.2 when TuxCare onboarded it on 2026-05-05. Defense exists at two layers: (1) Builder methods cast inputs via (int) before stor...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The target (Laravel 10.50.2-p4+tuxcare) is NOT AFFECTED by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input to limit/offset/skip/take functions on SQL Server. The fix (integer casting) was already present in upstream Laravel 10.50.2 when TuxCare onboarded it on 2026-05-05. Defense exists at two layers: (1) Builder methods cast inputs via (int) before stor..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 10.50.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:02:56.515055+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.50.2-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling serialization for cookies. Laravel 10.50.2 inherits this fix from upstream with a static $serialize = false property that prevents all cookie serialization. The vulnerable pattern (serialization enabled by default) is...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 10.50.2-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling serialization for cookies. Laravel 10.50.2 inherits this fix from upstream with a static $serialize = false property that prevents all cookie serialization. The vulnerable pattern (serialization enabled by default) is..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 10.50.2 is NOT AFFECTED by GHSA-7852-w36x-6mf6 (Encrypter IV length validation vulnerability). The fix for this vulnerability was already present in the upstream Laravel 10.50.2 release when TuxCare onboarded it. The vulnerable code pattern (missing IV length validation in validPayload method) is not present in the current HEAD. The defense validates that the base64...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework 10.50.2 is NOT AFFECTED by GHSA-7852-w36x-6mf6 (Encrypter IV length validation vulnerability). The fix for this vulnerability was already present in the upstream Laravel 10.50.2 release when TuxCare onboarded it. The vulnerable code pattern (missing IV length validation in validPayload method) is not present in the current HEAD. The defense validates that the base64..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.50.2 does not contain the vulnerable local filesystem temporary signed URL feature. The LocalFilesystemAdapter class and its associated temporaryUrl()/temporaryUploadUrl() methods were introduced in Laravel 11.x. The vulnerable code path does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 10.50.2 does not contain the vulnerable local filesystem temporary signed URL feature. The LocalFilesystemAdapter class and its associated temporaryUrl()/temporaryUploadUrl() methods were introduced in Laravel 11.x. The vulnerable code path does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:19:00.657885+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability involves crafting HTTP request parameters as arrays (including nested arrays) where scalar values are expected, causing unexpected SQL query bindings. The fix (flattenValue method using Arr::flatten()) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. All vulnerable ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability involves crafting HTTP request parameters as arrays (including nested arrays) where scalar values are expected, causing unexpected SQL query bindings. The fix (flattenValue method using Arr::flatten()) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. All vulnerable ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:19:00.105438+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 10.50.2-p3+tuxcare of laravel/framework. Laravel Framework version 10.50.2 is not affected by GHSA-qm5c-m76r-2hfr (cookie session encryption oracle RCE vulnerability). The vulnerability was fixed upstream in Laravel 6.18.31 (July 2020) by replacing predictable sha1() cookie prefixes with HMAC-based prefixes using the secret key. Version 10.50.2 (released in 2024) already contains this fix as part of the upstream release. The target uses CookieValuePrefix class with hash_hmac for cookie prefixing, matching the patched version. No TuxCare backport was necessary for this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel Framework version 10.50.2 is not affected by GHSA-qm5c-m76r-2hfr (cookie session encryption oracle RCE vulnerability). The vulnerability was fixed upstream in Laravel 6.18.31 (July 2020) by replacing predictable sha1() cookie prefixes with HMAC-based prefixes using the secret key. Version 10.50.2 (released in 2024) already contains this fix as part of the upstream release. The target uses CookieValuePrefix class with hash_hmac for cookie prefixing, matching the patched version. No TuxCare backport was necessary for this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 10.50.2-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). All required integer casting defenses are present in the codebase. The fix was already included in the upstream Laravel 10.50.2 release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable pattern (unvalidated user input in limit/offset parameters reaching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). All required integer casting defenses are present in the codebase. The fix was already included in the upstream Laravel 10.50.2 release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable pattern (unvalidated user input in limit/offset parameters reaching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:42:13.594930+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 10.50.2-p3+tuxcare of laravel/framework. The target Laravel framework 10.50.2 is NOT AFFECTED by GHSA-x7p5-p2c9-phvg. The vulnerability pattern (unchecked array-to-binding expansion) is not present because the fix was already included in the upstream Laravel 10.50.2 release. All affected query builder methods (where, having, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, whereBetween, havingBetween) implement array flattening and binding limits via the `flattenValue()` helper method and `array_slice()` guards. The fix was present in the initial TuxCare snapshot commit that onboarded Laravel 10.50.2 from upstream, indicating it shipped with the upstream release rather than being backported by TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "The target Laravel framework 10.50.2 is NOT AFFECTED by GHSA-x7p5-p2c9-phvg. The vulnerability pattern (unchecked array-to-binding expansion) is not present because the fix was already included in the upstream Laravel 10.50.2 release. All affected query builder methods (where, having, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, whereBetween, havingBetween) implement array flattening and binding limits via the `flattenValue()` helper method and `array_slice()` guards. The fix was present in the initial TuxCare snapshot commit that onboarded Laravel 10.50.2 from upstream, indicating it shipped with the upstream release rather than being backported by TuxCare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-14775 is fixed in version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2017-14775" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-16894 is fixed in version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2017-16894" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-15133 is fixed in version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 5.4.36-p4+tuxcare of laravel/framework. CVE-2019-9081 targets the PendingCommand class in Laravel Framework 5.7.x, which does not exist in the target version 5.4.36. The vulnerable component was introduced in version 5.7 and is not present in this earlier version. Exhaustive searches confirm no PendingCommand.php file exists in the codebase, and git history shows PendingCommand-related commits are tagged [5.7] or later. While similar classes (PendingDispatch, PendingBroadcast) exist with __destruct methods, they serve different purposes and are not the vulnerability target specified in CVE-2019-9081.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 targets the PendingCommand class in Laravel Framework 5.7.x, which does not exist in the target version 5.4.36. The vulnerable component was introduced in version 5.7 and is not present in this earlier version. Exhaustive searches confirm no PendingCommand.php file exists in the codebase, and git history shows PendingCommand-related commits are tagged [5.7] or later. While similar classes (PendingDispatch, PendingBroadcast) exist with __destruct methods, they serve different purposes and are not the vulnerability target specified in CVE-2019-9081." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.4.36-p4+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.4.36-p4+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.4.36-p4+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-29T20:17:00.109653+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.4.36-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 does not contain the vulnerable code. The CVE-2026-102279 vulnerability affects Laravel's custom exception renderer with Tippy.js tooltips (introduced in Laravel 11.x circa 2024). Version 5.4.36 (2017) uses Symfony's SymfonyExceptionHandler v3.4.47 for exception rendering, which does not use JavaScript tooltips and properly escapes all dynamic content via htmlspecialchars(). The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 does not contain the vulnerable code. The CVE-2026-102279 vulnerability affects Laravel's custom exception renderer with Tippy.js tooltips (introduced in Laravel 11.x circa 2024). Version 5.4.36 (2017) uses Symfony's SymfonyExceptionHandler v3.4.47 for exception rendering, which does not use JavaScript tooltips and properly escapes all dynamic content via htmlspecialchars(). The ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.4.36-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources subsystem (specifically in Illuminate\\Http\\Resources\\JsonApi\\Concerns\\ResolvesJsonApiElements), which was introduced in Laravel 12.x (circa 2024). Laravel 5.4.36 (released February 2017) predates this feature by approximately 7 years and 8 major versions. The vulnerable component does not exist...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources subsystem (specifically in Illuminate\\Http\\Resources\\JsonApi\\Concerns\\ResolvesJsonApiElements), which was introduced in Laravel 12.x (circa 2024). Laravel 5.4.36 (released February 2017) predates this feature by approximately 7 years and 8 major versions. The vulnerable component does not exist..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.4.36-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.4.36-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36-p4+tuxcare uses SwiftMailer, not Symfony Mailer. The CVE (GHSA-5vg9-5847-vvmq) is specific to 'how Symfony Mailer and Symfony Mime handle certain character sequences'. SwiftMailer has RFC 2822 grammar validation that should reject CRLF characters in email addresses (except as proper folding whitespace), providing a different defense mechanism than what the Laravel 12.x/13.x patch...", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36-p4+tuxcare uses SwiftMailer, not Symfony Mailer. The CVE (GHSA-5vg9-5847-vvmq) is specific to 'how Symfony Mailer and Symfony Mime handle certain character sequences'. SwiftMailer has RFC 2822 grammar validation that should reject CRLF characters in email addresses (except as proper folding whitespace), providing a different defense mechanism than what the Laravel 12.x/13.x patch..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr affects version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "action_statement": "Vulnerability GHSA-6jvx-8ch9-j2jr affects version 5.4.36-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 is fixed in version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.4.36-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.4.36 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability requires the LocalFilesystemAdapter with temporary signed URL support via temporarySignedRoute(), a feature introduced in Laravel 9+. Laravel 5.4 uses FilesystemAdapter which explicitly throws RuntimeException for local storage temporary URLs, stating 'This driver does not support creating temporary URLs.' The vulnerable c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.4.36 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability requires the LocalFilesystemAdapter with temporary signed URL support via temporarySignedRoute(), a feature introduced in Laravel 9+. Laravel 5.4 uses FilesystemAdapter which explicitly throws RuntimeException for local storage temporary URLs, stating 'This driver does not support creating temporary URLs.' The vulnerable c..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.4.36-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.4.36-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.4.36-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.4.36-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 12.58.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 12.58.0-p1+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 12.58.0-p1+tuxcare of laravel/framework. CVE-2018-15133 describes remote code execution via unsafe PHP object deserialization when decrypting X-XSRF-TOKEN cookies. The vulnerability required the attacker to know the application encryption key and craft a malicious serialized object payload. Laravel Framework fixed this in August 2018 by disabling PHP object serialization during cookie encryption/decryption (setting $serialize=false by default). The target repository (laravel/framework version 12.58.0-p6+tuxcare) contains the complete vendor fix, which was shipped in the upstream Laravel v12.58.0 release and imported via TuxCare snapshot commit 85d8011ca6. The vulnerable pattern (unsafe unserialize() calls on cookie data) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 describes remote code execution via unsafe PHP object deserialization when decrypting X-XSRF-TOKEN cookies. The vulnerability required the attacker to know the application encryption key and craft a malicious serialized object payload. Laravel Framework fixed this in August 2018 by disabling PHP object serialization during cookie encryption/decryption (setting $serialize=false by default). The target repository (laravel/framework version 12.58.0-p6+tuxcare) contains the complete vendor fix, which was shipped in the upstream Laravel v12.58.0 release and imported via TuxCare snapshot commit 85d8011ca6. The vulnerable pattern (unsafe unserialize() calls on cookie data) is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 12.58.0-p1+tuxcare of laravel/framework. CVE-2019-9081 describes a PHP object injection gadget chain in PendingCommand's __destruct method. While this gadget chain exists in version 12.58.0, the framework itself does not provide any production code path where user-controllable serialized data is unserialized and could trigger this gadget. PendingCommand is a testing utility instantiated only in test contexts. Laravel's production serialization (sessions, cookies, cache) uses encrypted/signed data or server-side storage, preventing arbitrary payload injection. The framework is not vulnerable when used as designed; exploitation requires downstream applications to explicitly unserialize untrusted user data without restrictions, which constitutes an application-level vulnerability, not a framework vulnerability.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 describes a PHP object injection gadget chain in PendingCommand's __destruct method. While this gadget chain exists in version 12.58.0, the framework itself does not provide any production code path where user-controllable serialized data is unserialized and could trigger this gadget. PendingCommand is a testing utility instantiated only in test contexts. Laravel's production serialization (sessions, cookies, cache) uses encrypted/signed data or server-side storage, preventing arbitrary payload injection. The framework is not vulnerable when used as designed; exploitation requires downstream applications to explicitly unserialize untrusted user data without restrictions, which constitutes an application-level vulnerability, not a framework vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 12.58.0-p1+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before v5.8.17 (May 2019). The target repository is Laravel Framework v12.58.0 (released late 2024), which already contains the upstream fix. The vulnerable code pattern (unescaped shell parameters in the link() method) is not present. Both exec() calls at lines 358 and 364 in src/Illuminate/Filesystem/Filesystem.php properly use escapeshellarg() on the $target and $link parameters, preventing OS command injection. This fix was shipped in the upstream v12.58.0 release that TuxCare imported via snapshot commit 85d8011ca6, not added as a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before v5.8.17 (May 2019). The target repository is Laravel Framework v12.58.0 (released late 2024), which already contains the upstream fix. The vulnerable code pattern (unescaped shell parameters in the link() method) is not present. Both exec() calls at lines 358 and 364 in src/Illuminate/Filesystem/Filesystem.php properly use escapeshellarg() on the $target and $link parameters, preventing OS command injection. This fix was shipped in the upstream v12.58.0 release that TuxCare imported via snapshot commit 85d8011ca6, not added as a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:41:57.354813+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 12.58.0-p1+tuxcare of laravel/framework. The target Laravel 12.58.0 is not affected by CVE-2020-24941. The vulnerability affected Laravel before 6.18.35 and 7.x before 7.24.0, where the $guarded property could be bypassed using JSON column nesting expressions or non-existent column names. The upstream fix (commit 897d107775, authored by Taylor Otwell on 2020-08-07) introduced the isGuardableColumn() method that validates attribute keys against actual database columns. This fix has been part of Laravel's codebase for years and was already present in the upstream v12.58.0 release that TuxCare onboarded in May 2026. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel 12.58.0 is not affected by CVE-2020-24941. The vulnerability affected Laravel before 6.18.35 and 7.x before 7.24.0, where the $guarded property could be bypassed using JSON column nesting expressions or non-existent column names. The upstream fix (commit 897d107775, authored by Taylor Otwell on 2020-08-07) introduced the isGuardableColumn() method that validates attribute keys against actual database columns. This fix has been part of Laravel's codebase for years and was already present in the upstream v12.58.0 release that TuxCare onboarded in May 2026. The vulnerable code pattern is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 12.58.0-p1+tuxcare of laravel/framework. Laravel v12.58.0 is not affected by CVE-2021-21263. The upstream release already contains the flattenValue() method which provides equivalent protection to the security patch. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) normalize array inputs to scalars before adding query bindings, preventing the query binding exploitation described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "Laravel v12.58.0 is not affected by CVE-2021-21263. The upstream release already contains the flattenValue() method which provides equivalent protection to the security patch. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) normalize array inputs to scalars before adding query bindings, preventing the query binding exploitation described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 12.58.0-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 12.58.0-p1+tuxcare of laravel/framework. CVE-2024-52301 (environment manipulation via query string) is NOT present in Laravel Framework v12.58.0-p6+tuxcare. The vulnerable pattern (unconditional use of $_SERVER['argv'] for environment detection) has been replaced with a SAPI-based guard that blocks web requests from using argv values. The fix was authored by Taylor Otwell and shipped in upstream Laravel v12.58.0 before TuxCare snapshotted this version. The current code at Application.php:791 checks runningInConsole() (which validates PHP_SAPI === 'cli') before accessing argv, preventing attackers from manipulating the framework environment via crafted query strings when register_argc_argv is enabled.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "CVE-2024-52301 (environment manipulation via query string) is NOT present in Laravel Framework v12.58.0-p6+tuxcare. The vulnerable pattern (unconditional use of $_SERVER['argv'] for environment detection) has been replaced with a SAPI-based guard that blocks web requests from using argv values. The fix was authored by Taylor Otwell and shipped in upstream Laravel v12.58.0 before TuxCare snapshotted this version. The current code at Application.php:791 checks runningInConsole() (which validates PHP_SAPI === 'cli') before accessing argv, preventing attackers from manipulating the framework environment via crafted query strings when register_argc_argv is enabled." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 12.58.0-p1+tuxcare of laravel/framework. not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-01T15:26:55.316610+00:00", "status_notes": "Vulnerability CVE-2026-102279 affects version 12.58.0-p1+tuxcare of laravel/framework, and is fixed in 12.58.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-102279" }, "action_statement": "Vulnerability CVE-2026-102279 affects version 12.58.0-p1+tuxcare of laravel/framework, and is fixed in 12.58.0-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2026-114508 affects version 12.58.0-p1+tuxcare of laravel/framework, and is fixed in 12.58.0-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-114508" }, "action_statement": "Vulnerability CVE-2026-114508 affects version 12.58.0-p1+tuxcare of laravel/framework, and is fixed in 12.58.0-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T12:31:25.113305+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 12.58.0-p1+tuxcare of laravel/framework, and is fixed in 12.58.0-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 12.58.0-p1+tuxcare of laravel/framework, and is fixed in 12.58.0-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:49:09.974795+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 12.58.0-p1+tuxcare of laravel/framework. not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 12.58.0-p1+tuxcare of laravel/framework, and is fixed in 12.58.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 12.58.0-p1+tuxcare of laravel/framework, and is fixed in 12.58.0-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 12.58.0-p1+tuxcare of laravel/framework. not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 12.58.0-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp affects version 12.58.0-p1+tuxcare of laravel/framework, and is fixed in 12.58.0-p3+tuxcare.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "action_statement": "Vulnerability GHSA-crmm-hgp2-wgrp affects version 12.58.0-p1+tuxcare of laravel/framework, and is fixed in 12.58.0-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:16:19.887305+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 12.58.0-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:18:00.235397+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 12.58.0-p1+tuxcare of laravel/framework. The target Laravel framework v12.58.0 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability (predictable SHA1-based cookie prefixes enabling encryption oracle attacks) was fixed in upstream Laravel 6.18.31 (July 2020). The fix uses HMAC-SHA1 with the secret key instead of plain SHA1, preventing attackers from crafting valid cookie prefixes. This fix was already present in the upstream Laravel 12.58.0 release that TuxCare onboarded, making the vulnerable code pattern absent from the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework v12.58.0 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability (predictable SHA1-based cookie prefixes enabling encryption oracle attacks) was fixed in upstream Laravel 6.18.31 (July 2020). The fix uses HMAC-SHA1 with the secret key instead of plain SHA1, preventing attackers from crafting valid cookie prefixes. This fix was already present in the upstream Laravel 12.58.0 release that TuxCare onboarded, making the vulnerable code pattern absent from the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 12.58.0-p1+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:41:57.354813+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 12.58.0-p1+tuxcare of laravel/framework. Laravel framework v12.58.0 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability affects Laravel 6.x (patched January 2021) where array values passed to query builder methods could inject unexpected bindings. The current version 12.58.0 already includes upstream protection via the flattenValue() helper method, which flattens array inputs to scalar values before binding. All 10 affected methods (where, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, whereBetween, havingBetween) use this protection. The fix was present in the upstream Laravel v12.58.0 release imported during onboarding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "Laravel framework v12.58.0 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability affects Laravel 6.x (patched January 2021) where array values passed to query builder methods could inject unexpected bindings. The current version 12.58.0 already includes upstream protection via the flattenValue() helper method, which flattens array inputs to scalar values before binding. All 10 affected methods (where, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, whereBetween, havingBetween) use this protection. The fix was present in the upstream Laravel v12.58.0 release imported during onboarding." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 concerns timing attacks on remember_me token verification due to non-constant-time comparison in DatabaseUserProvider. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database WHERE clause comparison with PHP's hash_equals(). Target version 10.48.29 was released years later and already includes this upstream fix. Both DatabaseUserProvider (line 76) and...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 concerns timing attacks on remember_me token verification due to non-constant-time comparison in DatabaseUserProvider. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database WHERE clause comparison with PHP's hash_equals(). Target version 10.48.29 was released years later and already includes this upstream fix. Both DatabaseUserProvider (line 76) and..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 10.48.29-p2+tuxcare of laravel/framework. CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29 via unsafe deserialization of X-XSRF-TOKEN cookie values. The target repository (Laravel 10.48.29) is NOT AFFECTED because the fix was already present in the upstream release that TuxCare onboarded. The vulnerable pattern (unserialized cookie decryption) does not exist in this version - all cookie encryption/decryption operations explicitly disable serialization by default (static::$serialize = false), preventing the unserialize() attack vector entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29 via unsafe deserialization of X-XSRF-TOKEN cookie values. The target repository (Laravel 10.48.29) is NOT AFFECTED because the fix was already present in the upstream release that TuxCare onboarded. The vulnerable pattern (unserialized cookie decryption) does not exist in this version - all cookie encryption/decryption operations explicitly disable serialization by default (static::$serialize = false), preventing the unserialize() attack vector entirely." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 10.48.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 10.48.29-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 10.48.29-p2+tuxcare of laravel/framework. CVE-2020-19316 is not present in this target. The OS command injection vulnerability in the Filesystem::link() method was fixed in upstream Laravel 5.8.17 (May 2019) by adding escapeshellarg() to both $target and $link parameters. The target version (10.48.29) is from years later and already includes this fix. TuxCare onboarded version 10.48.29 in July 2026 via snapshot commit a11ca48cf7, which already contained the fix from the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 is not present in this target. The OS command injection vulnerability in the Filesystem::link() method was fixed in upstream Laravel 5.8.17 (May 2019) by adding escapeshellarg() to both $target and $link parameters. The target version (10.48.29) is from years later and already includes this fix. TuxCare onboarded version 10.48.29 in July 2026 via snapshot commit a11ca48cf7, which already contained the fix from the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:41:35.131174+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 10.48.29-p2+tuxcare of laravel/framework. CVE-2020-24941 does not affect Laravel Framework v10.48.29. The vulnerability involved bypassing the $guarded property using non-existent column names (including JSON nesting expressions). The fix adds isGuardableColumn() validation that treats non-existent columns as guarded. This fix was introduced upstream by Taylor Otwell in August 2020 (commit 897d107775) and has been present in all Laravel versions since then. The target version 10.48.29, released in 2024, shipped with this fix already integrated into the upstream codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 does not affect Laravel Framework v10.48.29. The vulnerability involved bypassing the $guarded property using non-existent column names (including JSON nesting expressions). The fix adds isGuardableColumn() validation that treats non-existent columns as guarded. This fix was introduced upstream by Taylor Otwell in August 2020 (commit 897d107775) and has been present in all Laravel versions since then. The target version 10.48.29, released in 2024, shipped with this fix already integrated into the upstream codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 10.48.29-p2+tuxcare of laravel/framework. The target Laravel framework v10.48.29 is not affected by CVE-2021-21263. The vulnerability involves query binding exploitation where array values passed to query builder methods lead to unexpected query bindings. The fix, which limits array inputs using the `flattenValue()` helper method, was already present in the upstream Laravel v10.48.29 release that TuxCare onboarded. All nine vulnerable methods identified in the upstream patch (`where`, `whereBetween`, `whereDate`, `whereTime`, `whereDay`, `whereMonth`, `whereYear`, `whereJsonLength`, `having`) have equivalent or superior protections in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "The target Laravel framework v10.48.29 is not affected by CVE-2021-21263. The vulnerability involves query binding exploitation where array values passed to query builder methods lead to unexpected query bindings. The fix, which limits array inputs using the `flattenValue()` helper method, was already present in the upstream Laravel v10.48.29 release that TuxCare onboarded. All nine vulnerable methods identified in the upstream patch (`where`, `whereBetween`, `whereDate`, `whereTime`, `whereDay`, `whereMonth`, `whereYear`, `whereJsonLength`, `having`) have equivalent or superior protections in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:25:11.687376+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 is not present in laravel/framework 10.48.29. The vulnerability involved predictable parent placeholder hashes in Blade templates that allowed XSS attacks. The fix (using per-request random salt in placeholder generation) was already present in upstream Laravel v10.48.29 when TuxCare onboarded this version. The target code contains the complete defense: ManagesLayouts.php has par...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 is not present in laravel/framework 10.48.29. The vulnerability involved predictable parent placeholder hashes in Blade templates that allowed XSS attacks. The fix (using per-request random salt in placeholder generation) was already present in upstream Laravel v10.48.29 when TuxCare onboarded this version. The target code contains the complete defense: ManagesLayouts.php has par..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 10.48.29-p2+tuxcare of laravel/framework. The target Laravel framework version 10.48.29-p2+tuxcare is not affected by CVE-2024-52301. The vulnerable pattern (using $_SERVER['argv'] without checking if running in console mode) is not present in the target code. The fix was already included in the upstream Laravel 10.48.29 release that TuxCare onboarded. The detectEnvironment() method at src/Illuminate/Foundation/Application.php:720-727 properly checks $this->runningInConsole() before using $_SERVER['argv'], preventing environment manipulation via query strings when register_argc_argv is enabled.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target Laravel framework version 10.48.29-p2+tuxcare is not affected by CVE-2024-52301. The vulnerable pattern (using $_SERVER['argv'] without checking if running in console mode) is not present in the target code. The fix was already included in the upstream Laravel 10.48.29 release that TuxCare onboarded. The detectEnvironment() method at src/Illuminate/Foundation/Application.php:720-727 properly checks $this->runningInConsole() before using $_SERVER['argv'], preventing environment manipulation via query strings when register_argc_argv is enabled." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 10.48.29-p2+tuxcare) is NOT affected by CVE-2025-27515. The vulnerability\u2014a wildcard validation bypass where attackers could use special array keys ('0', '.', '*', '__asterisk__') to bypass validation rules\u2014was fixed in upstream Laravel commit a4f7a8f9b83e (2025-03-11) and shipped in the upstream v10.48.29 release (2025-03-12). TuxCare onboarded this alr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target repository (laravel/framework 10.48.29-p2+tuxcare) is NOT affected by CVE-2025-27515. The vulnerability\u2014a wildcard validation bypass where attackers could use special array keys ('0', '.', '*', '__asterisk__') to bypass validation rules\u2014was fixed in upstream Laravel commit a4f7a8f9b83e (2025-03-11) and shipped in the upstream v10.48.29 release (2025-03-12). TuxCare onboarded this alr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T12:26:34.355968+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.29 is not affected by CVE-2026-102279. This XSS vulnerability is specific to Laravel's custom exception renderer that uses Tippy.js tooltips with `allowHTML: true`, a feature introduced in Laravel 11+. The target version uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture without Tippy.js integration. Exhaustive search confi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 10.48.29 is not affected by CVE-2026-102279. This XSS vulnerability is specific to Laravel's custom exception renderer that uses Tippy.js tooltips with `allowHTML: true`, a feature introduced in Laravel 11+. The target version uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture without Tippy.js integration. Exhaustive search confi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.29 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resources feature, which processes relationship inclusion parameters (e.g., `?include=comments.truncate`) and was exploitable due to insufficient validation allowing arbitrary method execution. This feature was introduced in Laravel 12.x (PR #57571) and does not exist in Laravel 10.x. The target v...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 10.48.29 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resources feature, which processes relationship inclusion parameters (e.g., `?include=comments.truncate`) and was exploitable due to insufficient validation allowing arbitrary method execution. This feature was introduced in Laravel 12.x (PR #57571) and does not exist in Laravel 10.x. The target v..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T12:26:43.737844+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 10.48.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:46:09.826489+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel framework version 10.48.29 is not affected by GHSA-4mg9-vhxq-vm7j (SQL Server limit/offset SQL injection). The vulnerability was fixed in upstream Laravel 8.40.0 (released May 2021), and version 10.48.29 already contains the fix from upstream. All limit/offset input is validated with integer casts at both the query builder method level and SQL compilation level.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Laravel framework version 10.48.29 is not affected by GHSA-4mg9-vhxq-vm7j (SQL Server limit/offset SQL injection). The vulnerability was fixed in upstream Laravel 8.40.0 (released May 2021), and version 10.48.29 already contains the fix from upstream. All limit/offset input is validated with integer casts at both the query builder method level and SQL compilation level." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T12:26:34.355968+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 10.48.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.29-p2+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie deserialization). The vulnerability was fixed in upstream Laravel 5.6.30 (August 2018) by disabling cookie serialization. Laravel 10.x inherited this fix and never had the vulnerable pattern. The target code has `protected static $serialize = false` in EncryptCookies middleware (line 34), and all...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 10.48.29-p2+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie deserialization). The vulnerability was fixed in upstream Laravel 5.6.30 (August 2018) by disabling cookie serialization. Laravel 10.x inherited this fix and never had the vulnerable pattern. The target code has `protected static $serialize = false` in EncryptCookies middleware (line 34), and all..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 The target is not affected. The vulnerability (decryption returning false instead of throwing an exception on manipulated IV lengths) is not present because the upstream fix was already included in Laravel v10.48.29 when TuxCare onboarded it. The fix validates that base64-decoded IV length matches the cipher's required length at line 250 of Encrypter.php, ensuring DecryptException is thrown for...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target is not affected. The vulnerability (decryption returning false instead of throwing an exception on manipulated IV lengths) is not present because the upstream fix was already included in Laravel v10.48.29 when TuxCare onboarded it. The fix validates that base64-decoded IV length matches the cipher's required length at line 250 of Encrypter.php, ensuring DecryptException is thrown for..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T12:26:34.355968+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 10.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 10.48.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 10.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:13:18.978013+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework version 10.48.29 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability involves crafted array values being passed to query builder methods where scalar values are expected, leading to unexpected query bindings. However, the target already contains comprehensive protections against this vulnerability through a `flattenValue()` method that normalizes array inputs ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel Framework version 10.48.29 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability involves crafted array values being passed to query builder methods where scalar values are expected, leading to unexpected query bindings. However, the target already contains comprehensive protections against this vulnerability through a `flattenValue()` method that normalizes array inputs ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:18:00.235397+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 10.48.29-p2+tuxcare of laravel/framework. Target Laravel framework version 10.48.29-p2+tuxcare is not affected by GHSA-qm5c-m76r-2hfr. The vulnerable code pattern (using predictable sha1() hash for cookie prefix validation) is not present. The target uses hash_hmac() with the encryption key, which is the fixed version. This fix was shipped in upstream Laravel v10.48.29 before TuxCare onboarded the version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Target Laravel framework version 10.48.29-p2+tuxcare is not affected by GHSA-qm5c-m76r-2hfr. The vulnerable code pattern (using predictable sha1() hash for cookie prefix validation) is not present. The target uses hash_hmac() with the encryption key, which is the fixed version. This fix was shipped in upstream Laravel v10.48.29 before TuxCare onboarded the version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 10.48.29 is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 in 2021. Laravel 10.48.29 (released in 2024) already contains these fixes from upstream. The defense is present at multiple layers: Builder.php casts limit/offset to integers when storing (lines 2602, 2...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel 10.48.29 is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 in 2021. Laravel 10.48.29 (released in 2024) already contains these fixes from upstream. The defense is present at multiple layers: Builder.php casts limit/offset to integers when storing (lines 2602, 2..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:41:49.287227+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 10.48.29-p2+tuxcare of laravel/framework. The target Laravel framework 10.48.29 is NOT affected by GHSA-x7p5-p2c9-phvg. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) are protected with the flattenValue() defense that normalizes array inputs to scalar values, exactly matching the upstream security patches from January 2021. The fix was already present in the upstream Laravel 10.48.29 release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "The target Laravel framework 10.48.29 is NOT affected by GHSA-x7p5-p2c9-phvg. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) are protected with the flattenValue() defense that normalizes array inputs to scalar values, exactly matching the upstream security patches from January 2021. The fix was already present in the upstream Laravel 10.48.29 release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 10.48.29-p1+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 concerns timing attacks on remember_me token verification due to non-constant-time comparison in DatabaseUserProvider. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database WHERE clause comparison with PHP's hash_equals(). Target version 10.48.29 was released years later and already includes this upstream fix. Both DatabaseUserProvider (line 76) and...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 concerns timing attacks on remember_me token verification due to non-constant-time comparison in DatabaseUserProvider. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database WHERE clause comparison with PHP's hash_equals(). Target version 10.48.29 was released years later and already includes this upstream fix. Both DatabaseUserProvider (line 76) and..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 10.48.29-p1+tuxcare of laravel/framework. CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29 via unsafe deserialization of X-XSRF-TOKEN cookie values. The target repository (Laravel 10.48.29) is NOT AFFECTED because the fix was already present in the upstream release that TuxCare onboarded. The vulnerable pattern (unserialized cookie decryption) does not exist in this version - all cookie encryption/decryption operations explicitly disable serialization by default (static::$serialize = false), preventing the unserialize() attack vector entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29 via unsafe deserialization of X-XSRF-TOKEN cookie values. The target repository (Laravel 10.48.29) is NOT AFFECTED because the fix was already present in the upstream release that TuxCare onboarded. The vulnerable pattern (unserialized cookie decryption) does not exist in this version - all cookie encryption/decryption operations explicitly disable serialization by default (static::$serialize = false), preventing the unserialize() attack vector entirely." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 10.48.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 10.48.29-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 10.48.29-p1+tuxcare of laravel/framework. CVE-2020-19316 is not present in this target. The OS command injection vulnerability in the Filesystem::link() method was fixed in upstream Laravel 5.8.17 (May 2019) by adding escapeshellarg() to both $target and $link parameters. The target version (10.48.29) is from years later and already includes this fix. TuxCare onboarded version 10.48.29 in July 2026 via snapshot commit a11ca48cf7, which already contained the fix from the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 is not present in this target. The OS command injection vulnerability in the Filesystem::link() method was fixed in upstream Laravel 5.8.17 (May 2019) by adding escapeshellarg() to both $target and $link parameters. The target version (10.48.29) is from years later and already includes this fix. TuxCare onboarded version 10.48.29 in July 2026 via snapshot commit a11ca48cf7, which already contained the fix from the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:41:35.131174+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 10.48.29-p1+tuxcare of laravel/framework. CVE-2020-24941 does not affect Laravel Framework v10.48.29. The vulnerability involved bypassing the $guarded property using non-existent column names (including JSON nesting expressions). The fix adds isGuardableColumn() validation that treats non-existent columns as guarded. This fix was introduced upstream by Taylor Otwell in August 2020 (commit 897d107775) and has been present in all Laravel versions since then. The target version 10.48.29, released in 2024, shipped with this fix already integrated into the upstream codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 does not affect Laravel Framework v10.48.29. The vulnerability involved bypassing the $guarded property using non-existent column names (including JSON nesting expressions). The fix adds isGuardableColumn() validation that treats non-existent columns as guarded. This fix was introduced upstream by Taylor Otwell in August 2020 (commit 897d107775) and has been present in all Laravel versions since then. The target version 10.48.29, released in 2024, shipped with this fix already integrated into the upstream codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 10.48.29-p1+tuxcare of laravel/framework. The target Laravel framework v10.48.29 is not affected by CVE-2021-21263. The vulnerability involves query binding exploitation where array values passed to query builder methods lead to unexpected query bindings. The fix, which limits array inputs using the `flattenValue()` helper method, was already present in the upstream Laravel v10.48.29 release that TuxCare onboarded. All nine vulnerable methods identified in the upstream patch (`where`, `whereBetween`, `whereDate`, `whereTime`, `whereDay`, `whereMonth`, `whereYear`, `whereJsonLength`, `having`) have equivalent or superior protections in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "The target Laravel framework v10.48.29 is not affected by CVE-2021-21263. The vulnerability involves query binding exploitation where array values passed to query builder methods lead to unexpected query bindings. The fix, which limits array inputs using the `flattenValue()` helper method, was already present in the upstream Laravel v10.48.29 release that TuxCare onboarded. All nine vulnerable methods identified in the upstream patch (`where`, `whereBetween`, `whereDate`, `whereTime`, `whereDay`, `whereMonth`, `whereYear`, `whereJsonLength`, `having`) have equivalent or superior protections in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:25:11.687376+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 10.48.29-p1+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 is not present in laravel/framework 10.48.29. The vulnerability involved predictable parent placeholder hashes in Blade templates that allowed XSS attacks. The fix (using per-request random salt in placeholder generation) was already present in upstream Laravel v10.48.29 when TuxCare onboarded this version. The target code contains the complete defense: ManagesLayouts.php has par...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 is not present in laravel/framework 10.48.29. The vulnerability involved predictable parent placeholder hashes in Blade templates that allowed XSS attacks. The fix (using per-request random salt in placeholder generation) was already present in upstream Laravel v10.48.29 when TuxCare onboarded this version. The target code contains the complete defense: ManagesLayouts.php has par..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 10.48.29-p1+tuxcare of laravel/framework. The target Laravel framework version 10.48.29-p2+tuxcare is not affected by CVE-2024-52301. The vulnerable pattern (using $_SERVER['argv'] without checking if running in console mode) is not present in the target code. The fix was already included in the upstream Laravel 10.48.29 release that TuxCare onboarded. The detectEnvironment() method at src/Illuminate/Foundation/Application.php:720-727 properly checks $this->runningInConsole() before using $_SERVER['argv'], preventing environment manipulation via query strings when register_argc_argv is enabled.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target Laravel framework version 10.48.29-p2+tuxcare is not affected by CVE-2024-52301. The vulnerable pattern (using $_SERVER['argv'] without checking if running in console mode) is not present in the target code. The fix was already included in the upstream Laravel 10.48.29 release that TuxCare onboarded. The detectEnvironment() method at src/Illuminate/Foundation/Application.php:720-727 properly checks $this->runningInConsole() before using $_SERVER['argv'], preventing environment manipulation via query strings when register_argc_argv is enabled." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 10.48.29-p1+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 10.48.29-p2+tuxcare) is NOT affected by CVE-2025-27515. The vulnerability\u2014a wildcard validation bypass where attackers could use special array keys ('0', '.', '*', '__asterisk__') to bypass validation rules\u2014was fixed in upstream Laravel commit a4f7a8f9b83e (2025-03-11) and shipped in the upstream v10.48.29 release (2025-03-12). TuxCare onboarded this alr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target repository (laravel/framework 10.48.29-p2+tuxcare) is NOT affected by CVE-2025-27515. The vulnerability\u2014a wildcard validation bypass where attackers could use special array keys ('0', '.', '*', '__asterisk__') to bypass validation rules\u2014was fixed in upstream Laravel commit a4f7a8f9b83e (2025-03-11) and shipped in the upstream v10.48.29 release (2025-03-12). TuxCare onboarded this alr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:27:02.675922+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 10.48.29-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.29 is not affected by CVE-2026-102279. This XSS vulnerability is specific to Laravel's custom exception renderer that uses Tippy.js tooltips with `allowHTML: true`, a feature introduced in Laravel 11+. The target version uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture without Tippy.js integration. Exhaustive search confi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 10.48.29 is not affected by CVE-2026-102279. This XSS vulnerability is specific to Laravel's custom exception renderer that uses Tippy.js tooltips with `allowHTML: true`, a feature introduced in Laravel 11+. The target version uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture without Tippy.js integration. Exhaustive search confi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 10.48.29-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.29 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resources feature, which processes relationship inclusion parameters (e.g., `?include=comments.truncate`) and was exploitable due to insufficient validation allowing arbitrary method execution. This feature was introduced in Laravel 12.x (PR #57571) and does not exist in Laravel 10.x. The target v...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 10.48.29 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resources feature, which processes relationship inclusion parameters (e.g., `?include=comments.truncate`) and was exploitable due to insufficient validation allowing arbitrary method execution. This feature was introduced in Laravel 12.x (PR #57571) and does not exist in Laravel 10.x. The target v..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T12:26:43.737844+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 10.48.29-p1+tuxcare of laravel/framework, and is fixed in 10.48.29-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 10.48.29-p1+tuxcare of laravel/framework, and is fixed in 10.48.29-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:46:09.826489+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 10.48.29-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel framework version 10.48.29 is not affected by GHSA-4mg9-vhxq-vm7j (SQL Server limit/offset SQL injection). The vulnerability was fixed in upstream Laravel 8.40.0 (released May 2021), and version 10.48.29 already contains the fix from upstream. All limit/offset input is validated with integer casts at both the query builder method level and SQL compilation level.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Laravel framework version 10.48.29 is not affected by GHSA-4mg9-vhxq-vm7j (SQL Server limit/offset SQL injection). The vulnerability was fixed in upstream Laravel 8.40.0 (released May 2021), and version 10.48.29 already contains the fix from upstream. All limit/offset input is validated with integer casts at both the query builder method level and SQL compilation level." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 10.48.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 10.48.29-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.29-p2+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie deserialization). The vulnerability was fixed in upstream Laravel 5.6.30 (August 2018) by disabling cookie serialization. Laravel 10.x inherited this fix and never had the vulnerable pattern. The target code has `protected static $serialize = false` in EncryptCookies middleware (line 34), and all...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 10.48.29-p2+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie deserialization). The vulnerability was fixed in upstream Laravel 5.6.30 (August 2018) by disabling cookie serialization. Laravel 10.x inherited this fix and never had the vulnerable pattern. The target code has `protected static $serialize = false` in EncryptCookies middleware (line 34), and all..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 10.48.29-p1+tuxcare of laravel/framework. not_affected \u2014 The target is not affected. The vulnerability (decryption returning false instead of throwing an exception on manipulated IV lengths) is not present because the upstream fix was already included in Laravel v10.48.29 when TuxCare onboarded it. The fix validates that base64-decoded IV length matches the cipher's required length at line 250 of Encrypter.php, ensuring DecryptException is thrown for...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target is not affected. The vulnerability (decryption returning false instead of throwing an exception on manipulated IV lengths) is not present because the upstream fix was already included in Laravel v10.48.29 when TuxCare onboarded it. The fix validates that base64-decoded IV length matches the cipher's required length at line 250 of Encrypter.php, ensuring DecryptException is thrown for..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 10.48.29-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 10.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 10.48.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 10.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:13:18.978013+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 10.48.29-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework version 10.48.29 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability involves crafted array values being passed to query builder methods where scalar values are expected, leading to unexpected query bindings. However, the target already contains comprehensive protections against this vulnerability through a `flattenValue()` method that normalizes array inputs ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel Framework version 10.48.29 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability involves crafted array values being passed to query builder methods where scalar values are expected, leading to unexpected query bindings. However, the target already contains comprehensive protections against this vulnerability through a `flattenValue()` method that normalizes array inputs ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:18:00.235397+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 10.48.29-p1+tuxcare of laravel/framework. Target Laravel framework version 10.48.29-p2+tuxcare is not affected by GHSA-qm5c-m76r-2hfr. The vulnerable code pattern (using predictable sha1() hash for cookie prefix validation) is not present. The target uses hash_hmac() with the encryption key, which is the fixed version. This fix was shipped in upstream Laravel v10.48.29 before TuxCare onboarded the version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Target Laravel framework version 10.48.29-p2+tuxcare is not affected by GHSA-qm5c-m76r-2hfr. The vulnerable code pattern (using predictable sha1() hash for cookie prefix validation) is not present. The target uses hash_hmac() with the encryption key, which is the fixed version. This fix was shipped in upstream Laravel v10.48.29 before TuxCare onboarded the version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 10.48.29-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 10.48.29 is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 in 2021. Laravel 10.48.29 (released in 2024) already contains these fixes from upstream. The defense is present at multiple layers: Builder.php casts limit/offset to integers when storing (lines 2602, 2...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel 10.48.29 is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 in 2021. Laravel 10.48.29 (released in 2024) already contains these fixes from upstream. The defense is present at multiple layers: Builder.php casts limit/offset to integers when storing (lines 2602, 2..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.29-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:41:49.287227+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 10.48.29-p1+tuxcare of laravel/framework. The target Laravel framework 10.48.29 is NOT affected by GHSA-x7p5-p2c9-phvg. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) are protected with the flattenValue() defense that normalizes array inputs to scalar values, exactly matching the upstream security patches from January 2021. The fix was already present in the upstream Laravel 10.48.29 release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "The target Laravel framework 10.48.29 is NOT affected by GHSA-x7p5-p2c9-phvg. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) are protected with the flattenValue() defense that normalizes array inputs to scalar values, exactly matching the upstream security patches from January 2021. The fix was already present in the upstream Laravel 10.48.29 release that TuxCare onboarded." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 10.50.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before version 5.5.10 due to timing-attack vulnerability in remember-me token verification. The target repository contains Laravel 10.50.2, which is approximately 7 years newer than the fixed version. The fix (constant-time token comparison using hash_equals) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. Both DatabaseUserProvi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before version 5.5.10 due to timing-attack vulnerability in remember-me token verification. The target repository contains Laravel 10.50.2, which is approximately 7 years newer than the fixed version. The fix (constant-time token comparison using hash_equals) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. Both DatabaseUserProvi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 10.50.2-p1+tuxcare of laravel/framework. Laravel 10.50.2 is not affected by CVE-2018-15133 (PHP object injection via unserialized cookies). The vulnerability affected Laravel 5.5.x/5.6.x in 2018 and was fixed upstream by disabling automatic unserialization in cookie decryption. Version 10.50.2 (released in 2024) was built on the fixed codebase and contains the defense by default: `protected static $serialize = false` ensures all decrypt() calls pass `false` for the unserialize parameter, preventing dangerous unserialize() from being called on attacker-controlled cookie data. The fix was authored by Taylor Otwell (upstream Laravel maintainer) and shipped in the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "Laravel 10.50.2 is not affected by CVE-2018-15133 (PHP object injection via unserialized cookies). The vulnerability affected Laravel 5.5.x/5.6.x in 2018 and was fixed upstream by disabling automatic unserialization in cookie decryption. Version 10.50.2 (released in 2024) was built on the fixed codebase and contains the defense by default: `protected static $serialize = false` ensures all decrypt() calls pass `false` for the unserialize parameter, preventing dangerous unserialize() from being called on attacker-controlled cookie data. The fix was authored by Taylor Otwell (upstream Laravel maintainer) and shipped in the upstream release that TuxCare onboarded." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 10.50.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 10.50.2-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 10.50.2-p1+tuxcare of laravel/framework. CVE-2020-19316 (OS command injection via unsanitized mklink parameters) does not affect Laravel Framework 10.50.2. The upstream fix (escapeshellarg on both $link and $target parameters) was introduced in Laravel 5.8.17 (May 2019) by Taylor Otwell and is present in the target version. Target version 10.50.2 is 5+ major versions after the fix, confirming it shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 (OS command injection via unsanitized mklink parameters) does not affect Laravel Framework 10.50.2. The upstream fix (escapeshellarg on both $link and $target parameters) was introduced in Laravel 5.8.17 (May 2019) by Taylor Otwell and is present in the target version. Target version 10.50.2 is 5+ major versions after the fix, confirming it shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:42:04.797220+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 10.50.2-p1+tuxcare of laravel/framework. CVE-2020-24941 is NOT present in Laravel 10.50.2-p4+tuxcare. The vulnerability involves bypassing the $guarded property using non-existent column names or JSON nesting expressions. The target contains the complete upstream fix: the isGuarded() method validates that column names exist in the database schema via isGuardableColumn(), treating non-existent columns as automatically guarded. This fix was included in the upstream Laravel 10.50.2 release and imported via TuxCare's onboarding commit (snapshot without history).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 is NOT present in Laravel 10.50.2-p4+tuxcare. The vulnerability involves bypassing the $guarded property using non-existent column names or JSON nesting expressions. The target contains the complete upstream fix: the isGuarded() method validates that column names exist in the database schema via isGuardableColumn(), treating non-existent columns as automatically guarded. This fix was included in the upstream Laravel 10.50.2 release and imported via TuxCare's onboarding commit (snapshot without history)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 10.50.2-p1+tuxcare of laravel/framework. Laravel 10.50.2 is not affected by CVE-2021-21263. The vulnerability targeted Laravel versions < 6.20.12, < 7.30.3, and < 8.22.1, and was patched in January 2021. The target version (10.50.2, released in 2024) already contains the fix from the upstream release. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) now use the flattenValue() method which prevents array values from adding unexpected query bindings. This fix was present in the upstream Laravel 10.50.2 release before TuxCare's onboarding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "Laravel 10.50.2 is not affected by CVE-2021-21263. The vulnerability targeted Laravel versions < 6.20.12, < 7.30.3, and < 8.22.1, and was patched in January 2021. The target version (10.50.2, released in 2024) already contains the fix from the upstream release. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) now use the flattenValue() method which prevents array values from adding unexpected query bindings. This fix was present in the upstream Laravel 10.50.2 release before TuxCare's onboarding." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is NOT present in Laravel 10.50.2. The vulnerability was fixed upstream in December 2021 (Laravel 6.x/7.x/8.x), and the fix was already included when Laravel 10.x was released in February 2023. The target code shows all three components of the security fix: (1) ManagesLayouts.php generates parent placeholders using a random 40-charac...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is NOT present in Laravel 10.50.2. The vulnerability was fixed upstream in December 2021 (Laravel 6.x/7.x/8.x), and the fix was already included when Laravel 10.x was released in February 2023. The target code shows all three components of the security fix: (1) ManagesLayouts.php generates parent placeholders using a random 40-charac..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 10.50.2-p1+tuxcare of laravel/framework. The target repository (laravel/framework 10.50.2) is NOT affected by CVE-2024-52301. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when register_argc_argv was enabled. The fix\u2014checking runningInConsole() before using $_SERVER['argv'] for environment detection\u2014was already present in the upstream Laravel 10.50.2 release (Nov 12, 2024) and was imported by TuxCare via the onboarding snapshot commit. The vulnerable pattern (unconditional use of $_SERVER['argv']) is absent in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target repository (laravel/framework 10.50.2) is NOT affected by CVE-2024-52301. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when register_argc_argv was enabled. The fix\u2014checking runningInConsole() before using $_SERVER['argv'] for environment detection\u2014was already present in the upstream Laravel 10.50.2 release (Nov 12, 2024) and was imported by TuxCare via the onboarding snapshot commit. The vulnerable pattern (unconditional use of $_SERVER['argv']) is absent in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 10.50.2-p4+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. The fix modifies the Validator class to preserve internal placeholder encoding when passing attribute names to File/Email/Password custom rules, preventing attackers from bypassing wildcard valid...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target repository (laravel/framework 10.50.2-p4+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. The fix modifies the Validator class to preserve internal placeholder encoding when passing attribute names to File/Email/Password custom rules, preventing attackers from bypassing wildcard valid..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:33:09.068963+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.50.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's new exception renderer feature that uses Tippy.js tooltips with allowHTML:true. Laravel 10.x uses a completely different exception handling system (Whoops library) and does not contain the vulnerable code pattern. The exception renderer with Tippy.js was introduced in Laravel 12.x and does not exist i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 10.50.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's new exception renderer feature that uses Tippy.js tooltips with allowHTML:true. Laravel 10.x uses a completely different exception handling system (Whoops library) and does not contain the vulnerable code pattern. The exception renderer with Tippy.js was introduced in Laravel 12.x and does not exist i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework 10.50.2-p4+tuxcare is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in the JsonApi resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x (December 2025). Laravel 10.x does not contain any JsonApi resource functionality. Exhaustive searches across all 2522 files in the repository found no JsonApi-related co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target Laravel Framework 10.50.2-p4+tuxcare is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in the JsonApi resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x (December 2025). Laravel 10.x does not contain any JsonApi resource functionality. Exhaustive searches across all 2522 files in the repository found no JsonApi-related co..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T15:16:50.127733+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 10.50.2-p1+tuxcare of laravel/framework, and is fixed in 10.50.2-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 10.50.2-p1+tuxcare of laravel/framework, and is fixed in 10.50.2-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:46:45.854078+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 The target (Laravel 10.50.2-p4+tuxcare) is NOT AFFECTED by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input to limit/offset/skip/take functions on SQL Server. The fix (integer casting) was already present in upstream Laravel 10.50.2 when TuxCare onboarded it on 2026-05-05. Defense exists at two layers: (1) Builder methods cast inputs via (int) before stor...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The target (Laravel 10.50.2-p4+tuxcare) is NOT AFFECTED by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input to limit/offset/skip/take functions on SQL Server. The fix (integer casting) was already present in upstream Laravel 10.50.2 when TuxCare onboarded it on 2026-05-05. Defense exists at two layers: (1) Builder methods cast inputs via (int) before stor..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 10.50.2-p1+tuxcare of laravel/framework, and is fixed in 10.50.2-p3+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 10.50.2-p1+tuxcare of laravel/framework, and is fixed in 10.50.2-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:02:56.515055+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.50.2-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling serialization for cookies. Laravel 10.50.2 inherits this fix from upstream with a static $serialize = false property that prevents all cookie serialization. The vulnerable pattern (serialization enabled by default) is...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 10.50.2-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling serialization for cookies. Laravel 10.50.2 inherits this fix from upstream with a static $serialize = false property that prevents all cookie serialization. The vulnerable pattern (serialization enabled by default) is..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 10.50.2 is NOT AFFECTED by GHSA-7852-w36x-6mf6 (Encrypter IV length validation vulnerability). The fix for this vulnerability was already present in the upstream Laravel 10.50.2 release when TuxCare onboarded it. The vulnerable code pattern (missing IV length validation in validPayload method) is not present in the current HEAD. The defense validates that the base64...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework 10.50.2 is NOT AFFECTED by GHSA-7852-w36x-6mf6 (Encrypter IV length validation vulnerability). The fix for this vulnerability was already present in the upstream Laravel 10.50.2 release when TuxCare onboarded it. The vulnerable code pattern (missing IV length validation in validPayload method) is not present in the current HEAD. The defense validates that the base64..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.50.2 does not contain the vulnerable local filesystem temporary signed URL feature. The LocalFilesystemAdapter class and its associated temporaryUrl()/temporaryUploadUrl() methods were introduced in Laravel 11.x. The vulnerable code path does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 10.50.2 does not contain the vulnerable local filesystem temporary signed URL feature. The LocalFilesystemAdapter class and its associated temporaryUrl()/temporaryUploadUrl() methods were introduced in Laravel 11.x. The vulnerable code path does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:19:00.657885+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability involves crafting HTTP request parameters as arrays (including nested arrays) where scalar values are expected, causing unexpected SQL query bindings. The fix (flattenValue method using Arr::flatten()) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. All vulnerable ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability involves crafting HTTP request parameters as arrays (including nested arrays) where scalar values are expected, causing unexpected SQL query bindings. The fix (flattenValue method using Arr::flatten()) was already present in the upstream Laravel 10.50.2 release that TuxCare onboarded. All vulnerable ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:19:00.105438+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 10.50.2-p1+tuxcare of laravel/framework. Laravel Framework version 10.50.2 is not affected by GHSA-qm5c-m76r-2hfr (cookie session encryption oracle RCE vulnerability). The vulnerability was fixed upstream in Laravel 6.18.31 (July 2020) by replacing predictable sha1() cookie prefixes with HMAC-based prefixes using the secret key. Version 10.50.2 (released in 2024) already contains this fix as part of the upstream release. The target uses CookieValuePrefix class with hash_hmac for cookie prefixing, matching the patched version. No TuxCare backport was necessary for this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel Framework version 10.50.2 is not affected by GHSA-qm5c-m76r-2hfr (cookie session encryption oracle RCE vulnerability). The vulnerability was fixed upstream in Laravel 6.18.31 (July 2020) by replacing predictable sha1() cookie prefixes with HMAC-based prefixes using the secret key. Version 10.50.2 (released in 2024) already contains this fix as part of the upstream release. The target uses CookieValuePrefix class with hash_hmac for cookie prefixing, matching the patched version. No TuxCare backport was necessary for this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 10.50.2-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). All required integer casting defenses are present in the codebase. The fix was already included in the upstream Laravel 10.50.2 release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable pattern (unvalidated user input in limit/offset parameters reaching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel 10.50.2-p4+tuxcare is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). All required integer casting defenses are present in the codebase. The fix was already included in the upstream Laravel 10.50.2 release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable pattern (unvalidated user input in limit/offset parameters reaching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.50.2-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:42:13.594930+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 10.50.2-p1+tuxcare of laravel/framework. The target Laravel framework 10.50.2 is NOT AFFECTED by GHSA-x7p5-p2c9-phvg. The vulnerability pattern (unchecked array-to-binding expansion) is not present because the fix was already included in the upstream Laravel 10.50.2 release. All affected query builder methods (where, having, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, whereBetween, havingBetween) implement array flattening and binding limits via the `flattenValue()` helper method and `array_slice()` guards. The fix was present in the initial TuxCare snapshot commit that onboarded Laravel 10.50.2 from upstream, indicating it shipped with the upstream release rather than being backported by TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "The target Laravel framework 10.50.2 is NOT AFFECTED by GHSA-x7p5-p2c9-phvg. The vulnerability pattern (unchecked array-to-binding expansion) is not present because the fix was already included in the upstream Laravel 10.50.2 release. All affected query builder methods (where, having, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, whereBetween, havingBetween) implement array flattening and binding limits via the `flattenValue()` helper method and `array_slice()` guards. The fix was present in the initial TuxCare snapshot commit that onboarded Laravel 10.50.2 from upstream, indicating it shipped with the upstream release rather than being backported by TuxCare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/flysystem@3.33.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/flysystem@3.33.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:28:48.746415+00:00", "status_notes": "Vulnerability CVE-2021-32708 does not affect version 3.33.0-p1+tuxcare of league/flysystem. CVE-2021-32708: Target version 3.33.0-p1+tuxcare is not affected. The vulnerable pattern (silently removing unicode whitespace characters from file paths via preg_replace) is not present in the target. The upstream vendor (Frank de Jonge) fixed this vulnerability in commit a3c694de (June 2021) by replacing the removeFunkyWhiteSpace() method with rejectFunkyWhiteSpace() that throws a CorruptedPathDetected exception. This fix was included in upstream release 3.33.0, which TuxCare onboarded via snapshot commit a0e9abdc in May 2026. No TuxCare backport was required for the 3.x branch as the upstream release already contained the fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32708" }, "impact_statement": "CVE-2021-32708: Target version 3.33.0-p1+tuxcare is not affected. The vulnerable pattern (silently removing unicode whitespace characters from file paths via preg_replace) is not present in the target. The upstream vendor (Frank de Jonge) fixed this vulnerability in commit a3c694de (June 2021) by replacing the removeFunkyWhiteSpace() method with rejectFunkyWhiteSpace() that throws a CorruptedPathDetected exception. This fix was included in upstream release 3.33.0, which TuxCare onboarded via snapshot commit a0e9abdc in May 2026. No TuxCare backport was required for the 3.x branch as the upstream release already contained the fix." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/flysystem@3.33.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/flysystem@3.33.0-p1+tuxcare" } } ], "timestamp": "2026-10-01T15:25:17.861384+00:00", "status_notes": "Vulnerability CVE-2026-102601 is fixed in version 3.33.0-p1+tuxcare of league/flysystem.", "vulnerability": { "name": "CVE-2026-102601" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.3-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2017-14775. The vulnerability concerned non-constant-time token comparison in remember_me token verification, which was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.3 (released in 2021) already includes the upstream fix using hash_equals() for constant-time comparison in both DatabaseUserProvider and EloquentUserProvider. The fix came w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2017-14775. The vulnerability concerned non-constant-time token comparison in remember_me token verification, which was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.3 (released in 2021) already includes the upstream fix using hash_equals() for constant-time comparison in both DatabaseUserProvider and EloquentUserProvider. The fix came w..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.3-p4+tuxcare of laravel/framework. CVE-2018-15133 is NOT present in this target. The vulnerability involved remote code execution via PHP object injection when decrypted cookie values (especially X-XSRF-TOKEN) were passed through unserialize(). The upstream Laravel fix (August 2018, commit 97467e3ca by Taylor Otwell) disabled serialization for all cookies by setting `protected static $serialize = false` and passing `false` to all decrypt() calls. This fix was already included in Laravel v8.12.3 (December 2020) when TuxCare onboarded it via snapshot commit 90eb977a3b. The target code at HEAD (8.12.3-p5+tuxcare) contains this upstream fix: EncryptCookies.php line 34 sets `$serialize = false`, and Encrypter.php line 151 returns decrypted values directly without calling unserialize() when the flag is false. The vulnerable pattern (unserialization of decrypted cookies) does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 is NOT present in this target. The vulnerability involved remote code execution via PHP object injection when decrypted cookie values (especially X-XSRF-TOKEN) were passed through unserialize(). The upstream Laravel fix (August 2018, commit 97467e3ca by Taylor Otwell) disabled serialization for all cookies by setting `protected static $serialize = false` and passing `false` to all decrypt() calls. This fix was already included in Laravel v8.12.3 (December 2020) when TuxCare onboarded it via snapshot commit 90eb977a3b. The target code at HEAD (8.12.3-p5+tuxcare) contains this upstream fix: EncryptCookies.php line 34 sets `$serialize = false`, and Encrypter.php line 151 returns decrypted values directly without calling unserialize() when the flag is false. The vulnerable pattern (unserialization of decrypted cookies) does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 8.12.3-p4+tuxcare of laravel/framework. Laravel Framework 8.12.3 is not affected by CVE-2019-9081. While the PendingCommand class with its __destruct method exists and can execute commands when unserialized, there is no reachable attack path in Laravel's own code where attacker-controlled serialized data reaches unserialize(). The framework's unserialize() calls (e.g., Session/Store.php:98) operate on server-side data that is not directly controllable by attackers in default configuration. This is a gadget-chain component that requires an application-level unserialize vulnerability to be exploitable, not a framework vulnerability.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "Laravel Framework 8.12.3 is not affected by CVE-2019-9081. While the PendingCommand class with its __destruct method exists and can execute commands when unserialized, there is no reachable attack path in Laravel's own code where attacker-controlled serialized data reaches unserialize(). The framework's unserialize() calls (e.g., Session/Store.php:98) operate on server-side data that is not directly controllable by attackers in default configuration. This is a gadget-chain component that requires an application-level unserialize vulnerability to be exploitable, not a framework vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.3-p4+tuxcare of laravel/framework. The target Laravel Framework 8.12.3 is NOT AFFECTED by CVE-2020-19316 (OS command injection in Filesystem.php link() function). The vulnerability was fixed upstream by Taylor Otwell in commit 44c3feb604 (May 2019, Laravel 5.8.17). The fix wraps both $link and $target parameters with escapeshellarg() before passing to the Windows mklink shell command. Laravel 8.12.3 (released December 2020) already includes this fix. Line 320 of src/Illuminate/Filesystem/Filesystem.php shows: exec(\"mklink /{$mode} \".escapeshellarg($link).' '.escapeshellarg($target)); This protection prevents shell metacharacters from being interpreted as command injection sequences. The fix shipped in the upstream release that TuxCare onboarded via snapshot commit 90eb977a3b.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target Laravel Framework 8.12.3 is NOT AFFECTED by CVE-2020-19316 (OS command injection in Filesystem.php link() function). The vulnerability was fixed upstream by Taylor Otwell in commit 44c3feb604 (May 2019, Laravel 5.8.17). The fix wraps both $link and $target parameters with escapeshellarg() before passing to the Windows mklink shell command. Laravel 8.12.3 (released December 2020) already includes this fix. Line 320 of src/Illuminate/Filesystem/Filesystem.php shows: exec(\"mklink /{$mode} \".escapeshellarg($link).' '.escapeshellarg($target)); This protection prevents shell metacharacters from being interpreted as command injection sequences. The fix shipped in the upstream release that TuxCare onboarded via snapshot commit 90eb977a3b." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:41:18.186955+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.3-p4+tuxcare of laravel/framework. CVE-2020-24941 affects Laravel versions before 6.18.35 and 7.x before 7.24.0. The target repository is Laravel 8.12.3-p5+tuxcare, which was released after the CVE was fixed upstream (August 2020). The vulnerability pattern is not present in the target because the fix was already included in the upstream Laravel 8.12.3 release that TuxCare snapshotted. The GuardsAttributes.php file contains the isGuardableColumn() method and the fixed isGuarded() logic that validates attribute keys against actual database columns, preventing the mass-assignment bypass that the CVE describes.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 affects Laravel versions before 6.18.35 and 7.x before 7.24.0. The target repository is Laravel 8.12.3-p5+tuxcare, which was released after the CVE was fixed upstream (August 2020). The vulnerability pattern is not present in the target because the fix was already included in the upstream Laravel 8.12.3 release that TuxCare snapshotted. The GuardsAttributes.php file contains the isGuardableColumn() method and the fixed isGuarded() logic that validates attribute keys against actual database columns, preventing the mass-assignment bypass that the CVE describes." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.3-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.3-p4+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.3-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.3-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.3-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-09-29T20:27:02.675922+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.3-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.3-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-114508. The vulnerable JsonApi resources feature was introduced in Laravel 12.45.0, approximately 4 major versions after the target version. The entire JsonApi resources module, including the ResolvesJsonApiElements trait and sparseIncluded() method processing, does not exist in Laravel 8.x. The vulnerability requires processing HTTP query parameters w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-114508. The vulnerable JsonApi resources feature was introduced in Laravel 12.45.0, approximately 4 major versions after the target version. The entire JsonApi resources module, including the ResolvesJsonApiElements trait and sparseIncluded() method processing, does not exist in Laravel 8.x. The vulnerability requires processing HTTP query parameters w..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.3-p4+tuxcare of laravel/framework, and is fixed in 8.12.3-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.3-p4+tuxcare of laravel/framework, and is fixed in 8.12.3-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.3-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.3-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.3-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 8.12.3 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie unserialization). The vulnerability affected Laravel 5.6.30 (August 2018) and was fixed by disabling PHP object serialization in cookie encryption. Laravel 8.12.3 (December 2020) shipped with this protection already in place: EncryptCookies uses `static $serialize = false` to prevent object unseria...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel 8.12.3 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie unserialization). The vulnerability affected Laravel 5.6.30 (August 2018) and was fixed by disabling PHP object serialization in cookie encryption. Laravel 8.12.3 (December 2020) shipped with this protection already in place: EncryptCookies uses `static $serialize = false` to prevent object unseria..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.3-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v8.12.3 is not affected by GHSA-7852-w36x-6mf6 (Laravel Encrypter IV length validation bypass). The vulnerability pattern is absent because the upstream fix was already present in Laravel v8.12.3 when TuxCare onboarded it. The validPayload() method includes IV length validation that prevents manipulated payloads from causing false-return decryption failures exploita...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework v8.12.3 is not affected by GHSA-7852-w36x-6mf6 (Laravel Encrypter IV length validation bypass). The vulnerability pattern is absent because the upstream fix was already present in Laravel v8.12.3 when TuxCare onboarded it. The validPayload() method includes IV length validation that prevents manipulated payloads from causing false-return decryption failures exploita..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.3-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.3-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:15:18.533137+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.3-p4+tuxcare of laravel/framework. Laravel framework 8.12.3-p5+tuxcare is not affected by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The vulnerability required using predictable sha1() hashes for cookie prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The target already contains the upstream security fix that replaced sha1() with hash_hmac() using the application's secret key, making cookie prefixes unguessable. This fix was shipped in upstream Laravel 8.12.3 (released October 29, 2020) before TuxCare began maintaining this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel framework 8.12.3-p5+tuxcare is not affected by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The vulnerability required using predictable sha1() hashes for cookie prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The target already contains the upstream security fix that replaced sha1() with hash_hmac() using the application's secret key, making cookie prefixes unguessable. This fix was shipped in upstream Laravel 8.12.3 (released October 29, 2020) before TuxCare began maintaining this version." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.3-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.3-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T12:31:16.408200+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 12.58.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 12.58.0-p6+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 12.58.0-p6+tuxcare of laravel/framework. CVE-2018-15133 describes remote code execution via unsafe PHP object deserialization when decrypting X-XSRF-TOKEN cookies. The vulnerability required the attacker to know the application encryption key and craft a malicious serialized object payload. Laravel Framework fixed this in August 2018 by disabling PHP object serialization during cookie encryption/decryption (setting $serialize=false by default). The target repository (laravel/framework version 12.58.0-p6+tuxcare) contains the complete vendor fix, which was shipped in the upstream Laravel v12.58.0 release and imported via TuxCare snapshot commit 85d8011ca6. The vulnerable pattern (unsafe unserialize() calls on cookie data) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 describes remote code execution via unsafe PHP object deserialization when decrypting X-XSRF-TOKEN cookies. The vulnerability required the attacker to know the application encryption key and craft a malicious serialized object payload. Laravel Framework fixed this in August 2018 by disabling PHP object serialization during cookie encryption/decryption (setting $serialize=false by default). The target repository (laravel/framework version 12.58.0-p6+tuxcare) contains the complete vendor fix, which was shipped in the upstream Laravel v12.58.0 release and imported via TuxCare snapshot commit 85d8011ca6. The vulnerable pattern (unsafe unserialize() calls on cookie data) is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 12.58.0-p6+tuxcare of laravel/framework. CVE-2019-9081 describes a PHP object injection gadget chain in PendingCommand's __destruct method. While this gadget chain exists in version 12.58.0, the framework itself does not provide any production code path where user-controllable serialized data is unserialized and could trigger this gadget. PendingCommand is a testing utility instantiated only in test contexts. Laravel's production serialization (sessions, cookies, cache) uses encrypted/signed data or server-side storage, preventing arbitrary payload injection. The framework is not vulnerable when used as designed; exploitation requires downstream applications to explicitly unserialize untrusted user data without restrictions, which constitutes an application-level vulnerability, not a framework vulnerability.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 describes a PHP object injection gadget chain in PendingCommand's __destruct method. While this gadget chain exists in version 12.58.0, the framework itself does not provide any production code path where user-controllable serialized data is unserialized and could trigger this gadget. PendingCommand is a testing utility instantiated only in test contexts. Laravel's production serialization (sessions, cookies, cache) uses encrypted/signed data or server-side storage, preventing arbitrary payload injection. The framework is not vulnerable when used as designed; exploitation requires downstream applications to explicitly unserialize untrusted user data without restrictions, which constitutes an application-level vulnerability, not a framework vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 12.58.0-p6+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before v5.8.17 (May 2019). The target repository is Laravel Framework v12.58.0 (released late 2024), which already contains the upstream fix. The vulnerable code pattern (unescaped shell parameters in the link() method) is not present. Both exec() calls at lines 358 and 364 in src/Illuminate/Filesystem/Filesystem.php properly use escapeshellarg() on the $target and $link parameters, preventing OS command injection. This fix was shipped in the upstream v12.58.0 release that TuxCare imported via snapshot commit 85d8011ca6, not added as a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before v5.8.17 (May 2019). The target repository is Laravel Framework v12.58.0 (released late 2024), which already contains the upstream fix. The vulnerable code pattern (unescaped shell parameters in the link() method) is not present. Both exec() calls at lines 358 and 364 in src/Illuminate/Filesystem/Filesystem.php properly use escapeshellarg() on the $target and $link parameters, preventing OS command injection. This fix was shipped in the upstream v12.58.0 release that TuxCare imported via snapshot commit 85d8011ca6, not added as a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:41:57.354813+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 12.58.0-p6+tuxcare of laravel/framework. The target Laravel 12.58.0 is not affected by CVE-2020-24941. The vulnerability affected Laravel before 6.18.35 and 7.x before 7.24.0, where the $guarded property could be bypassed using JSON column nesting expressions or non-existent column names. The upstream fix (commit 897d107775, authored by Taylor Otwell on 2020-08-07) introduced the isGuardableColumn() method that validates attribute keys against actual database columns. This fix has been part of Laravel's codebase for years and was already present in the upstream v12.58.0 release that TuxCare onboarded in May 2026. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel 12.58.0 is not affected by CVE-2020-24941. The vulnerability affected Laravel before 6.18.35 and 7.x before 7.24.0, where the $guarded property could be bypassed using JSON column nesting expressions or non-existent column names. The upstream fix (commit 897d107775, authored by Taylor Otwell on 2020-08-07) introduced the isGuardableColumn() method that validates attribute keys against actual database columns. This fix has been part of Laravel's codebase for years and was already present in the upstream v12.58.0 release that TuxCare onboarded in May 2026. The vulnerable code pattern is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 12.58.0-p6+tuxcare of laravel/framework. Laravel v12.58.0 is not affected by CVE-2021-21263. The upstream release already contains the flattenValue() method which provides equivalent protection to the security patch. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) normalize array inputs to scalars before adding query bindings, preventing the query binding exploitation described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "Laravel v12.58.0 is not affected by CVE-2021-21263. The upstream release already contains the flattenValue() method which provides equivalent protection to the security patch. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) normalize array inputs to scalars before adding query bindings, preventing the query binding exploitation described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 12.58.0-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 12.58.0-p6+tuxcare of laravel/framework. CVE-2024-52301 (environment manipulation via query string) is NOT present in Laravel Framework v12.58.0-p6+tuxcare. The vulnerable pattern (unconditional use of $_SERVER['argv'] for environment detection) has been replaced with a SAPI-based guard that blocks web requests from using argv values. The fix was authored by Taylor Otwell and shipped in upstream Laravel v12.58.0 before TuxCare snapshotted this version. The current code at Application.php:791 checks runningInConsole() (which validates PHP_SAPI === 'cli') before accessing argv, preventing attackers from manipulating the framework environment via crafted query strings when register_argc_argv is enabled.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "CVE-2024-52301 (environment manipulation via query string) is NOT present in Laravel Framework v12.58.0-p6+tuxcare. The vulnerable pattern (unconditional use of $_SERVER['argv'] for environment detection) has been replaced with a SAPI-based guard that blocks web requests from using argv values. The fix was authored by Taylor Otwell and shipped in upstream Laravel v12.58.0 before TuxCare snapshotted this version. The current code at Application.php:791 checks runningInConsole() (which validates PHP_SAPI === 'cli') before accessing argv, preventing attackers from manipulating the framework environment via crafted query strings when register_argc_argv is enabled." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 12.58.0-p6+tuxcare of laravel/framework. not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T12:31:16.408200+00:00", "status_notes": "Vulnerability CVE-2026-102279 is fixed in version 12.58.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-102279" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2026-114508 affects version 12.58.0-p6+tuxcare of laravel/framework, and is fixed in 12.58.0-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-114508" }, "action_statement": "Vulnerability CVE-2026-114508 affects version 12.58.0-p6+tuxcare of laravel/framework, and is fixed in 12.58.0-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T12:31:25.113305+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 12.58.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T20:49:09.974795+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 12.58.0-p6+tuxcare of laravel/framework. not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T12:31:16.408200+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 12.58.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 12.58.0-p6+tuxcare of laravel/framework. not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 12.58.0-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T12:31:16.408200+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp is fixed in version 12.58.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T21:16:19.887305+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 12.58.0-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:18:00.235397+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 12.58.0-p6+tuxcare of laravel/framework. The target Laravel framework v12.58.0 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability (predictable SHA1-based cookie prefixes enabling encryption oracle attacks) was fixed in upstream Laravel 6.18.31 (July 2020). The fix uses HMAC-SHA1 with the secret key instead of plain SHA1, preventing attackers from crafting valid cookie prefixes. This fix was already present in the upstream Laravel 12.58.0 release that TuxCare onboarded, making the vulnerable code pattern absent from the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework v12.58.0 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability (predictable SHA1-based cookie prefixes enabling encryption oracle attacks) was fixed in upstream Laravel 6.18.31 (July 2020). The fix uses HMAC-SHA1 with the secret key instead of plain SHA1, preventing attackers from crafting valid cookie prefixes. This fix was already present in the upstream Laravel 12.58.0 release that TuxCare onboarded, making the vulnerable code pattern absent from the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 12.58.0-p6+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:41:57.354813+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 12.58.0-p6+tuxcare of laravel/framework. Laravel framework v12.58.0 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability affects Laravel 6.x (patched January 2021) where array values passed to query builder methods could inject unexpected bindings. The current version 12.58.0 already includes upstream protection via the flattenValue() helper method, which flattens array inputs to scalar values before binding. All 10 affected methods (where, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, whereBetween, havingBetween) use this protection. The fix was present in the upstream Laravel v12.58.0 release imported during onboarding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "Laravel framework v12.58.0 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability affects Laravel 6.x (patched January 2021) where array values passed to query builder methods could inject unexpected bindings. The current version 12.58.0 already includes upstream protection via the flattenValue() helper method, which flattens array inputs to scalar values before binding. All 10 affected methods (where, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, whereBetween, havingBetween) use this protection. The fix was present in the upstream Laravel v12.58.0 release imported during onboarding." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 9.52.21-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 9.52.21-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 9.52.21-p4+tuxcare is not affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 9.52.21, released years later, already contains this fix. Both DatabaseUserProvider.php and Eloque...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 9.52.21-p4+tuxcare is not affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 9.52.21, released years later, already contains this fix. Both DatabaseUserProvider.php and Eloque..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 9.52.21-p2+tuxcare of laravel/framework. The target Laravel framework version 9.52.21-p4+tuxcare is NOT AFFECTED by CVE-2018-15133. The vulnerability pattern (automatic PHP deserialization of decrypted cookie/header values) is not present because the upstream Laravel 9.52.21 release already shipped with the fix. The defense mechanism (passing `false` to the encrypter's decrypt method to prevent unserialize()) is active for both X-XSRF-TOKEN headers and encrypted cookies. All decrypt operations use `static::$serialize = false`, preventing the dangerous unserialize() call that would enable RCE through PHP object injection.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "The target Laravel framework version 9.52.21-p4+tuxcare is NOT AFFECTED by CVE-2018-15133. The vulnerability pattern (automatic PHP deserialization of decrypted cookie/header values) is not present because the upstream Laravel 9.52.21 release already shipped with the fix. The defense mechanism (passing `false` to the encrypter's decrypt method to prevent unserialize()) is active for both X-XSRF-TOKEN headers and encrypted cookies. All decrypt operations use `static::$serialize = false`, preventing the dangerous unserialize() call that would enable RCE through PHP object injection." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 9.52.21-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 9.52.21-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 9.52.21-p2+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before 5.8.17. Target version 9.52.21 already contains the upstream fix (escapeshellarg on both parameters in Filesystem.php::link()). The vulnerable code pattern is not present. The fix was shipped in upstream release v9.52.21, which was onboarded by TuxCare via snapshot commit ed9bb51c72.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before 5.8.17. Target version 9.52.21 already contains the upstream fix (escapeshellarg on both parameters in Filesystem.php::link()). The vulnerable code pattern is not present. The fix was shipped in upstream release v9.52.21, which was onboarded by TuxCare via snapshot commit ed9bb51c72." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:42:13.594930+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 9.52.21-p2+tuxcare of laravel/framework. CVE-2020-24941 does not affect this Laravel 9.52.21 installation. The vulnerability involved missing validation that attribute keys in mass-assignment correspond to actual database columns, allowing attackers to bypass $guarded protection using fake column names with JSON notation. The target code contains the complete upstream fix (isGuardableColumn method verifying against actual database columns) which was already present in Laravel v9.52.21 when TuxCare onboarded it in snapshot commit ed9bb51c. No TuxCare backport was needed as the fix shipped in the upstream release (original fix by Taylor Otwell in commit 897d107 for Laravel 6.x in August 2020, forward-ported to all subsequent versions including 9.x released February 2022).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 does not affect this Laravel 9.52.21 installation. The vulnerability involved missing validation that attribute keys in mass-assignment correspond to actual database columns, allowing attackers to bypass $guarded protection using fake column names with JSON notation. The target code contains the complete upstream fix (isGuardableColumn method verifying against actual database columns) which was already present in Laravel v9.52.21 when TuxCare onboarded it in snapshot commit ed9bb51c. No TuxCare backport was needed as the fix shipped in the upstream release (original fix by Taylor Otwell in commit 897d107 for Laravel 6.x in August 2020, forward-ported to all subsequent versions including 9.x released February 2022)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 9.52.21-p2+tuxcare of laravel/framework. Laravel framework v9.52.21 is not affected by CVE-2021-21263. The vulnerability affects versions <6.20.12, <7.30.3, and <8.22.1. Version 9.52.21 already contains the upstream fix that limits query bindings when array values are passed where scalar values are expected. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() method or array_slice() to restrict array inputs to expected element counts, preventing query binding exploitation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "Laravel framework v9.52.21 is not affected by CVE-2021-21263. The vulnerability affects versions <6.20.12, <7.30.3, and <8.22.1. Version 9.52.21 already contains the upstream fix that limits query bindings when array values are passed where scalar values are expected. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() method or array_slice() to restrict array inputs to expected element counts, preventing query binding exploitation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 9.52.21-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework 9.52.21 is not affected by CVE-2021-43808. The vulnerability fix (random per-request salt for parent placeholder hashing in Blade templates) was already present in the upstream Laravel 9.52.21 release when TuxCare onboarded it. The vulnerable pattern (predictable parent placeholder hash based solely on sha1($section)) is not present in the codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 The target Laravel Framework 9.52.21 is not affected by CVE-2021-43808. The vulnerability fix (random per-request salt for parent placeholder hashing in Blade templates) was already present in the upstream Laravel 9.52.21 release when TuxCare onboarded it. The vulnerable pattern (predictable parent placeholder hash based solely on sha1($section)) is not present in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 9.52.21-p2+tuxcare of laravel/framework. The target repository (Laravel framework 9.52.21) is NOT affected by CVE-2024-52301. The vulnerable code pattern that allowed environment manipulation via query strings is not present. The upstream Laravel team (Taylor Otwell) fixed this vulnerability in version 9.52.17 by adding a check to ensure $_SERVER['argv'] is only used when running in console mode (PHP_SAPI === 'cli' || PHP_SAPI === 'phpdbg'). This fix was already present in the upstream release 9.52.21 that TuxCare onboarded, making it an upstream fix rather than a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target repository (Laravel framework 9.52.21) is NOT affected by CVE-2024-52301. The vulnerable code pattern that allowed environment manipulation via query strings is not present. The upstream Laravel team (Taylor Otwell) fixed this vulnerability in version 9.52.17 by adding a check to ensure $_SERVER['argv'] is only used when running in console mode (PHP_SAPI === 'cli' || PHP_SAPI === 'phpdbg'). This fix was already present in the upstream release 9.52.21 that TuxCare onboarded, making it an upstream fix rather than a TuxCare backport." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 9.52.21-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:36:58.499788+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 9.52.21-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-102279. The vulnerability concerns XSS via Tippy.js tooltips with allowHTML:true in Laravel 12.x's new exception renderer component. This component does not exist in Laravel 9.52.21, which uses Whoops or Symfony's HtmlErrorRenderer for exception display instead. Exhaustive searches found no tippy.js, allowHTML, or formatted-source.blade.php in the tar...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-102279. The vulnerability concerns XSS via Tippy.js tooltips with allowHTML:true in Laravel 12.x's new exception renderer component. This component does not exist in Laravel 9.52.21, which uses Whoops or Symfony's HtmlErrorRenderer for exception display instead. Exhaustive searches found no tippy.js, allowHTML, or formatted-source.blade.php in the tar..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 9.52.21-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource implementation (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x. Version 9.52.21 predates this feature entirely\u2014the JsonApi namespace, related classes, and the vulnerable include parameter processing mechanism do not exist in this version. The target cannot...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource implementation (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x. Version 9.52.21 predates this feature entirely\u2014the JsonApi namespace, related classes, and the vulnerable include parameter processing mechanism do not exist in this version. The target cannot..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-28T13:20:48.512438+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 9.52.21-p2+tuxcare of laravel/framework, and is fixed in 9.52.21-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 9.52.21-p2+tuxcare of laravel/framework, and is fixed in 9.52.21-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 9.52.21-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "action_statement": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 9.52.21-p2+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 9.52.21-p2+tuxcare of laravel/framework, and is fixed in 9.52.21-p3+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 9.52.21-p2+tuxcare of laravel/framework, and is fixed in 9.52.21-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:04:11.478044+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 9.52.21-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-6jvx-8ch9-j2jr (CVE-2018-15133). The vulnerability involves PHP object injection through cookie deserialization. The upstream Laravel team fixed this in version 5.6.30 (August 2018) by disabling serialization for all cookies. Laravel 9.52.21, released years later, includes this fix via the EncryptCookies middleware's `$serialize = false` default. The vuln...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-6jvx-8ch9-j2jr (CVE-2018-15133). The vulnerability involves PHP object injection through cookie deserialization. The upstream Laravel team fixed this in version 5.6.30 (August 2018) by disabling serialization for all cookies. Laravel 9.52.21, released years later, includes this fix via the EncryptCookies middleware's `$serialize = false` default. The vuln..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 9.52.21-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework v9.52.21 is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decryption to return false instead of throwing an exception on manipulated payloads) was fixed by the upstream vendor in March 2018. The fix is present in the target at src/Illuminate/Encryption/Encrypter.php:246, where validPayload() validates that the base64-...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 Laravel Framework v9.52.21 is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decryption to return false instead of throwing an exception on manipulated payloads) was fixed by the upstream vendor in March 2018. The fix is present in the target at src/Illuminate/Encryption/Encrypter.php:246, where validPayload() validates that the base64-..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 9.52.21-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 9.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 9.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 9.52.21-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable code pattern (uncontrolled array inputs causing unexpected query bindings) is not present because the upstream Laravel 9.52.21 release already contained all necessary fixes before TuxCare's snapshot import. The target implements the same defenses as the vendor patches: flattenValue() method normalizes array inputs...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 Laravel 9.52.21-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable code pattern (uncontrolled array inputs causing unexpected query bindings) is not present because the upstream Laravel 9.52.21 release already contained all necessary fixes before TuxCare's snapshot import. The target implements the same defenses as the vendor patches: flattenValue() method normalizes array inputs..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:19:00.105438+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 9.52.21-p2+tuxcare of laravel/framework. The target Laravel 9.52.21-p4+tuxcare is NOT vulnerable to GHSA-qm5c-m76r-2hfr (cookie session driver RCE via encryption oracle). The vulnerability was fixed in upstream Laravel 6.18.31 (July 2020) by replacing predictable SHA1-based cookie prefixes with HMAC-based validation requiring the encryption key. Laravel 9.52.21 (released 2023) already contains this fix. The target was onboarded from the upstream release via snapshot commit ed9bb51c72, which brought the pre-fixed version. No vulnerable code patterns exist in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel 9.52.21-p4+tuxcare is NOT vulnerable to GHSA-qm5c-m76r-2hfr (cookie session driver RCE via encryption oracle). The vulnerability was fixed in upstream Laravel 6.18.31 (July 2020) by replacing predictable SHA1-based cookie prefixes with HMAC-based validation requiring the encryption key. Laravel 9.52.21 (released 2023) already contains this fix. The target was onboarded from the upstream release via snapshot commit ed9bb51c72, which brought the pre-fixed version. No vulnerable code patterns exist in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 9.52.21-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v9.52.21-p4+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL injection via limit/offset in SQL Server). The vulnerability pattern is not present because the fix was already included in the upstream Laravel v9.52.21 release that TuxCare onboarded. All required protections are in place: integer casting in Builder.php limit()/offset() methods and SqlServerGrammar.ph...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel framework v9.52.21-p4+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL injection via limit/offset in SQL Server). The vulnerability pattern is not present because the fix was already included in the upstream Laravel v9.52.21 release that TuxCare onboarded. All required protections are in place: integer casting in Builder.php limit()/offset() methods and SqlServerGrammar.ph..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@9.52.21-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:42:13.594930+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 9.52.21-p2+tuxcare of laravel/framework. Target Laravel 9.52.21 is not affected by GHSA-x7p5-p2c9-phvg. The fix for this vulnerability was already present in the upstream Laravel 9.52.21 release that TuxCare onboarded. The target contains the `flattenValue()` helper method (line 3720-3723 in Builder.php) that flattens nested arrays and extracts the first scalar element, which is semantically identical to the vendor patches' `scalarValue()` helper. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use this helper to limit query bindings to expected counts, preventing the injection of unexpected bindings that could cause queries to return unexpected results.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "Target Laravel 9.52.21 is not affected by GHSA-x7p5-p2c9-phvg. The fix for this vulnerability was already present in the upstream Laravel 9.52.21 release that TuxCare onboarded. The target contains the `flattenValue()` helper method (line 3720-3723 in Builder.php) that flattens nested arrays and extracts the first scalar element, which is semantically identical to the vendor patches' `scalarValue()` helper. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use this helper to limit query bindings to expected counts, preventing the injection of unexpected bindings that could cause queries to return unexpected results." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.3-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2017-14775. The vulnerability concerned non-constant-time token comparison in remember_me token verification, which was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.3 (released in 2021) already includes the upstream fix using hash_equals() for constant-time comparison in both DatabaseUserProvider and EloquentUserProvider. The fix came w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2017-14775. The vulnerability concerned non-constant-time token comparison in remember_me token verification, which was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.3 (released in 2021) already includes the upstream fix using hash_equals() for constant-time comparison in both DatabaseUserProvider and EloquentUserProvider. The fix came w..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.3-p5+tuxcare of laravel/framework. CVE-2018-15133 is NOT present in this target. The vulnerability involved remote code execution via PHP object injection when decrypted cookie values (especially X-XSRF-TOKEN) were passed through unserialize(). The upstream Laravel fix (August 2018, commit 97467e3ca by Taylor Otwell) disabled serialization for all cookies by setting `protected static $serialize = false` and passing `false` to all decrypt() calls. This fix was already included in Laravel v8.12.3 (December 2020) when TuxCare onboarded it via snapshot commit 90eb977a3b. The target code at HEAD (8.12.3-p5+tuxcare) contains this upstream fix: EncryptCookies.php line 34 sets `$serialize = false`, and Encrypter.php line 151 returns decrypted values directly without calling unserialize() when the flag is false. The vulnerable pattern (unserialization of decrypted cookies) does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 is NOT present in this target. The vulnerability involved remote code execution via PHP object injection when decrypted cookie values (especially X-XSRF-TOKEN) were passed through unserialize(). The upstream Laravel fix (August 2018, commit 97467e3ca by Taylor Otwell) disabled serialization for all cookies by setting `protected static $serialize = false` and passing `false` to all decrypt() calls. This fix was already included in Laravel v8.12.3 (December 2020) when TuxCare onboarded it via snapshot commit 90eb977a3b. The target code at HEAD (8.12.3-p5+tuxcare) contains this upstream fix: EncryptCookies.php line 34 sets `$serialize = false`, and Encrypter.php line 151 returns decrypted values directly without calling unserialize() when the flag is false. The vulnerable pattern (unserialization of decrypted cookies) does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 8.12.3-p5+tuxcare of laravel/framework. Laravel Framework 8.12.3 is not affected by CVE-2019-9081. While the PendingCommand class with its __destruct method exists and can execute commands when unserialized, there is no reachable attack path in Laravel's own code where attacker-controlled serialized data reaches unserialize(). The framework's unserialize() calls (e.g., Session/Store.php:98) operate on server-side data that is not directly controllable by attackers in default configuration. This is a gadget-chain component that requires an application-level unserialize vulnerability to be exploitable, not a framework vulnerability.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "Laravel Framework 8.12.3 is not affected by CVE-2019-9081. While the PendingCommand class with its __destruct method exists and can execute commands when unserialized, there is no reachable attack path in Laravel's own code where attacker-controlled serialized data reaches unserialize(). The framework's unserialize() calls (e.g., Session/Store.php:98) operate on server-side data that is not directly controllable by attackers in default configuration. This is a gadget-chain component that requires an application-level unserialize vulnerability to be exploitable, not a framework vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.3-p5+tuxcare of laravel/framework. The target Laravel Framework 8.12.3 is NOT AFFECTED by CVE-2020-19316 (OS command injection in Filesystem.php link() function). The vulnerability was fixed upstream by Taylor Otwell in commit 44c3feb604 (May 2019, Laravel 5.8.17). The fix wraps both $link and $target parameters with escapeshellarg() before passing to the Windows mklink shell command. Laravel 8.12.3 (released December 2020) already includes this fix. Line 320 of src/Illuminate/Filesystem/Filesystem.php shows: exec(\"mklink /{$mode} \".escapeshellarg($link).' '.escapeshellarg($target)); This protection prevents shell metacharacters from being interpreted as command injection sequences. The fix shipped in the upstream release that TuxCare onboarded via snapshot commit 90eb977a3b.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target Laravel Framework 8.12.3 is NOT AFFECTED by CVE-2020-19316 (OS command injection in Filesystem.php link() function). The vulnerability was fixed upstream by Taylor Otwell in commit 44c3feb604 (May 2019, Laravel 5.8.17). The fix wraps both $link and $target parameters with escapeshellarg() before passing to the Windows mklink shell command. Laravel 8.12.3 (released December 2020) already includes this fix. Line 320 of src/Illuminate/Filesystem/Filesystem.php shows: exec(\"mklink /{$mode} \".escapeshellarg($link).' '.escapeshellarg($target)); This protection prevents shell metacharacters from being interpreted as command injection sequences. The fix shipped in the upstream release that TuxCare onboarded via snapshot commit 90eb977a3b." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:41:18.186955+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.3-p5+tuxcare of laravel/framework. CVE-2020-24941 affects Laravel versions before 6.18.35 and 7.x before 7.24.0. The target repository is Laravel 8.12.3-p5+tuxcare, which was released after the CVE was fixed upstream (August 2020). The vulnerability pattern is not present in the target because the fix was already included in the upstream Laravel 8.12.3 release that TuxCare snapshotted. The GuardsAttributes.php file contains the isGuardableColumn() method and the fixed isGuarded() logic that validates attribute keys against actual database columns, preventing the mass-assignment bypass that the CVE describes.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 affects Laravel versions before 6.18.35 and 7.x before 7.24.0. The target repository is Laravel 8.12.3-p5+tuxcare, which was released after the CVE was fixed upstream (August 2020). The vulnerability pattern is not present in the target because the fix was already included in the upstream Laravel 8.12.3 release that TuxCare snapshotted. The GuardsAttributes.php file contains the isGuardableColumn() method and the fixed isGuarded() logic that validates attribute keys against actual database columns, preventing the mass-assignment bypass that the CVE describes." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:40:00.060787+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.3-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:40:00.060787+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.3-p5+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:40:00.060787+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.3-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:40:00.060787+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.3-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:40:00.060787+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.3-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:40:00.060787+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.3-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.3-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-114508. The vulnerable JsonApi resources feature was introduced in Laravel 12.45.0, approximately 4 major versions after the target version. The entire JsonApi resources module, including the ResolvesJsonApiElements trait and sparseIncluded() method processing, does not exist in Laravel 8.x. The vulnerability requires processing HTTP query parameters w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-114508. The vulnerable JsonApi resources feature was introduced in Laravel 12.45.0, approximately 4 major versions after the target version. The entire JsonApi resources module, including the ResolvesJsonApiElements trait and sparseIncluded() method processing, does not exist in Laravel 8.x. The vulnerability requires processing HTTP query parameters w..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-29T11:49:41.488261+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.3-p5+tuxcare of laravel/framework, and is fixed in 8.12.3-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.3-p5+tuxcare of laravel/framework, and is fixed in 8.12.3-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:40:00.060787+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.3-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:40:00.060787+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.3-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.3-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 8.12.3 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie unserialization). The vulnerability affected Laravel 5.6.30 (August 2018) and was fixed by disabling PHP object serialization in cookie encryption. Laravel 8.12.3 (December 2020) shipped with this protection already in place: EncryptCookies uses `static $serialize = false` to prevent object unseria...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel 8.12.3 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie unserialization). The vulnerability affected Laravel 5.6.30 (August 2018) and was fixed by disabling PHP object serialization in cookie encryption. Laravel 8.12.3 (December 2020) shipped with this protection already in place: EncryptCookies uses `static $serialize = false` to prevent object unseria..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.3-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v8.12.3 is not affected by GHSA-7852-w36x-6mf6 (Laravel Encrypter IV length validation bypass). The vulnerability pattern is absent because the upstream fix was already present in Laravel v8.12.3 when TuxCare onboarded it. The validPayload() method includes IV length validation that prevents manipulated payloads from causing false-return decryption failures exploita...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework v8.12.3 is not affected by GHSA-7852-w36x-6mf6 (Laravel Encrypter IV length validation bypass). The vulnerability pattern is absent because the upstream fix was already present in Laravel v8.12.3 when TuxCare onboarded it. The validPayload() method includes IV length validation that prevents manipulated payloads from causing false-return decryption failures exploita..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:40:00.060787+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.3-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:40:00.060787+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.3-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:15:18.533137+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.3-p5+tuxcare of laravel/framework. Laravel framework 8.12.3-p5+tuxcare is not affected by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The vulnerability required using predictable sha1() hashes for cookie prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The target already contains the upstream security fix that replaced sha1() with hash_hmac() using the application's secret key, making cookie prefixes unguessable. This fix was shipped in upstream Laravel 8.12.3 (released October 29, 2020) before TuxCare began maintaining this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel framework 8.12.3-p5+tuxcare is not affected by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The vulnerability required using predictable sha1() hashes for cookie prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The target already contains the upstream security fix that replaced sha1() with hash_hmac() using the application's secret key, making cookie prefixes unguessable. This fix was shipped in upstream Laravel 8.12.3 (released October 29, 2020) before TuxCare began maintaining this version." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:40:00.060787+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.3-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:40:00.060787+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.3-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab...", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th...", "vulnerability": { "name": "CVE-2025-57811" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68454" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 is a false positive for verbb/feed-me 3.1.17-p1+tuxcare. false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron...", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n...", "vulnerability": { "name": "CVE-2026-29113" }, "impact_statement": "not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t...", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core...", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra...", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil...", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability.", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 is a false positive for verbb/feed-me 3.1.17-p1+tuxcare. false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase.", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do...", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.1.17-p1+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab...", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2025-57811 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th...", "vulnerability": { "name": "CVE-2025-57811" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2025-68454 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68454" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-25494 is a false positive for verbb/feed-me 3.1.17-p8+tuxcare. false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron...", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-29113 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n...", "vulnerability": { "name": "CVE-2026-29113" }, "impact_statement": "not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t...", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core...", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra...", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil...", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability.", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-33161 is a false positive for verbb/feed-me 3.1.17-p8+tuxcare. false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase.", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do...", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p8+tuxcare" } } ], "timestamp": "2026-10-12T07:03:00.140438+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.1.17-p8+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab...", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th...", "vulnerability": { "name": "CVE-2025-57811" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68454" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 is a false positive for verbb/feed-me 3.1.17-p7+tuxcare. false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron...", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n...", "vulnerability": { "name": "CVE-2026-29113" }, "impact_statement": "not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t...", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core...", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra...", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil...", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability.", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 is a false positive for verbb/feed-me 3.1.17-p7+tuxcare. false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase.", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do...", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.1.17-p7+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 affects version 8.83.29-p1+tuxcare of laravel/framework, and is fixed in 8.83.29-p2+tuxcare.", "vulnerability": { "name": "AIKIDO-2026-10659" }, "action_statement": "Vulnerability AIKIDO-2026-10659 affects version 8.83.29-p1+tuxcare of laravel/framework, and is fixed in 8.83.29-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.83.29-p1+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 does not affect this target. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.83.29, released years later, inherited this fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use PHP's hash_equals() for constant-time token comparison at line 77. The TuxCare onbo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 does not affect this target. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.83.29, released years later, inherited this fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use PHP's hash_equals() for constant-time token comparison at line 77. The TuxCare onbo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.83.29-p1+tuxcare of laravel/framework. CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29 via unserialize on untrusted X-XSRF-TOKEN values. The target (Laravel 8.83.29) ships with the upstream fix already present. The defense (static::$serialize = false; static::serialized() returning false) disables automatic unserialization after cookie/CSRF token decryption, preventing PHP object injection attacks. The fix was introduced by Taylor Otwell in upstream patches 240d9046 and c0eb9073 (Aug 2018) and is present in all Laravel 8.x releases. The vulnerable pattern (decrypt with unserialize enabled by default) does not exist in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29 via unserialize on untrusted X-XSRF-TOKEN values. The target (Laravel 8.83.29) ships with the upstream fix already present. The defense (static::$serialize = false; static::serialized() returning false) disables automatic unserialization after cookie/CSRF token decryption, preventing PHP object injection attacks. The fix was introduced by Taylor Otwell in upstream patches 240d9046 and c0eb9073 (Aug 2018) and is present in all Laravel 8.x releases. The vulnerable pattern (decrypt with unserialize enabled by default) does not exist in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.83.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.83.29-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.83.29-p1+tuxcare of laravel/framework. Laravel Framework 8.83.29 is not affected by CVE-2020-19316. The OS command injection vulnerability in the Filesystem::link() function was fixed upstream in May 2019 (commit 44c3feb604) for Laravel 5.8.17. Version 8.83.29 was released much later and already included this fix when it was onboarded into the TuxCare repository. The current code at src/Illuminate/Filesystem/Filesystem.php:337 properly applies escapeshellarg() to both $link and $target parameters before passing them to the exec() function, preventing command injection.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "Laravel Framework 8.83.29 is not affected by CVE-2020-19316. The OS command injection vulnerability in the Filesystem::link() function was fixed upstream in May 2019 (commit 44c3feb604) for Laravel 5.8.17. Version 8.83.29 was released much later and already included this fix when it was onboarded into the TuxCare repository. The current code at src/Illuminate/Filesystem/Filesystem.php:337 properly applies escapeshellarg() to both $link and $target parameters before passing them to the exec() function, preventing command injection." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:41:26.189153+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.83.29-p1+tuxcare of laravel/framework. CVE-2020-24941 does not affect Laravel 8.83.29. The vulnerability (mass assignment bypass via non-column attribute keys) was fixed in Laravel 6.18.35 and 7.24.0 (August 2020). Laravel 8.x was released in September 2020, after the fix, so all 8.x versions including 8.83.29 shipped with the fix already present. The target repository's GuardsAttributes.php contains the complete fix: the isGuardableColumn() method validates attribute keys against actual database columns, and non-column keys are automatically treated as guarded (blocked). This fix came from upstream Laravel, not from a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 does not affect Laravel 8.83.29. The vulnerability (mass assignment bypass via non-column attribute keys) was fixed in Laravel 6.18.35 and 7.24.0 (August 2020). Laravel 8.x was released in September 2020, after the fix, so all 8.x versions including 8.83.29 shipped with the fix already present. The target repository's GuardsAttributes.php contains the complete fix: the isGuardableColumn() method validates attribute keys against actual database columns, and non-column keys are automatically treated as guarded (blocked). This fix came from upstream Laravel, not from a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 8.83.29-p1+tuxcare of laravel/framework. CVE-2021-21263 is not present in laravel/framework 8.83.29-p6+tuxcare. The vulnerability (query binding exploitation via unchecked array inputs) was fixed in upstream Laravel 8.22.1, and the target version 8.83.29 already contains the fix as shipped in the upstream release. The fix uses a flattenValue() helper method that limits array inputs to their first element, preventing unexpected query bindings in where(), whereBetween(), whereDate/Time/Day/Month/Year(), whereJsonLength(), and having() methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "CVE-2021-21263 is not present in laravel/framework 8.83.29-p6+tuxcare. The vulnerability (query binding exploitation via unchecked array inputs) was fixed in upstream Laravel 8.22.1, and the target version 8.83.29 already contains the fix as shipped in the upstream release. The fix uses a flattenValue() helper method that limits array inputs to their first element, preventing unexpected query bindings in where(), whereBetween(), whereDate/Time/Day/Month/Year(), whereJsonLength(), and having() methods." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 8.83.29-p1+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 does not affect this target. The vulnerability (predictable parent placeholder hashes in Blade templates allowing XSS) was fixed by the upstream Laravel team before version 8.83.29 was released. The complete fix\u2014including random per-request salt generation, runtime placeholder creation, and cache invalidation\u2014is present in all three affected files. TuxCare onboarded an already-fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 does not affect this target. The vulnerability (predictable parent placeholder hashes in Blade templates allowing XSS) was fixed by the upstream Laravel team before version 8.83.29 was released. The complete fix\u2014including random per-request salt generation, runtime placeholder creation, and cache invalidation\u2014is present in all three affected files. TuxCare onboarded an already-fi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 8.83.29-p1+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 8.83.29-p1+tuxcare of laravel/framework. CVE-2024-52301 is NOT present in Laravel 8.83.29-p6+tuxcare. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when register_argc_argv is enabled. The fix (checking runningInConsole() before using $_SERVER['argv']) was already present in the upstream code when TuxCare onboarded version 8.83.29 on Aug 25, 2025. The upstream fix was authored by Taylor Otwell and applied to all maintained Laravel branches in November 2024.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "CVE-2024-52301 is NOT present in Laravel 8.83.29-p6+tuxcare. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when register_argc_argv is enabled. The fix (checking runningInConsole() before using $_SERVER['argv']) was already present in the upstream code when TuxCare onboarded version 8.83.29 on Aug 25, 2025. The upstream fix was authored by Taylor Otwell and applied to all maintained Laravel branches in November 2024." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.83.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:27:02.675922+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.83.29-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-102279. The vulnerability exists in the new exception renderer with Tippy.js tooltips (allowHTML: true) introduced in Laravel 12.x. The target version uses Whoops library's PrettyPageHandler for debug exception rendering instead, which does not have Tippy.js or any tooltip system that could be exploited via attacker-controlled HTML content.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-102279. The vulnerability exists in the new exception renderer with Tippy.js tooltips (allowHTML: true) introduced in Laravel 12.x. The target version uses Whoops library's PrettyPageHandler for debug exception rendering instead, which does not have Tippy.js or any tooltip system that could be exploited via attacker-controlled HTML content." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.83.29-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource relationship inclusion processing feature, which was introduced in Laravel 12.x (commit 2f30936319193371fc1ac338d171a5b92be9976de5). This feature is completely absent from Laravel 8.x. The vulnerable code path in ResolvesJsonApiElements.php does not exist in this version. The standard JsonResou...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource relationship inclusion processing feature, which was introduced in Laravel 12.x (commit 2f30936319193371fc1ac338d171a5b92be9976de5). This feature is completely absent from Laravel 8.x. The vulnerable code path in ResolvesJsonApiElements.php does not exist in this version. The standard JsonResou..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T12:27:44.661604+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.83.29-p1+tuxcare of laravel/framework, and is fixed in 8.83.29-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.83.29-p1+tuxcare of laravel/framework, and is fixed in 8.83.29-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:45:27.177095+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 8.83.29-p1+tuxcare of laravel/framework. not_affected \u2014 The SQL injection vulnerability (GHSA-4mg9-vhxq-vm7j) affecting Laravel's SQL Server driver when user input is passed to limit/offset/skip/take functions is NOT present in this target. The vulnerability was fixed in upstream Laravel 8.40.0, and the target version 8.83.29 already contains the fix. Integer casting defenses are present in both Builder.php (lines 2140, 2167) and SqlServerGrammar.ph...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The SQL injection vulnerability (GHSA-4mg9-vhxq-vm7j) affecting Laravel's SQL Server driver when user input is passed to limit/offset/skip/take functions is NOT present in this target. The vulnerability was fixed in upstream Laravel 8.40.0, and the target version 8.83.29 already contains the fix. Integer casting defenses are present in both Builder.php (lines 2140, 2167) and SqlServerGrammar.ph..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.83.29-p1+tuxcare of laravel/framework, and is fixed in 8.83.29-p3+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.83.29-p1+tuxcare of laravel/framework, and is fixed in 8.83.29-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:58:09.118737+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.83.29-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The vulnerable pattern was fixed by upstream Laravel in version 5.6.30 (August 2018), and Laravel 8.83.29 (released September 2022) inherited this fix. The target uses `protected static $serialize = false` to disable PHP object serialization for all cookies, preventing CWE-502 deserialization attacks....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The vulnerable pattern was fixed by upstream Laravel in version 5.6.30 (August 2018), and Laravel 8.83.29 (released September 2022) inherited this fix. The target uses `protected static $serialize = false` to disable PHP object serialization for all cookies, preventing CWE-502 deserialization attacks...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.83.29-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 8.83.29-p6+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability pattern (missing IV length validation in Encrypter::validPayload) is not present in the target. The fix was already included in the upstream Laravel 8.83.29 release when TuxCare onboarded it in August 2025. The IV length validation check (strlen(base64_decode($payload['iv'], true)) === open...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework 8.83.29-p6+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability pattern (missing IV length validation in Encrypter::validPayload) is not present in the target. The fix was already included in the upstream Laravel 8.83.29 release when TuxCare onboarded it in August 2025. The IV length validation check (strlen(base64_decode($payload['iv'], true)) === open..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.83.29-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerable component (LocalFilesystemAdapter with local filesystem signed URL serving) was introduced in Laravel 11.x/12.x and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerable component (LocalFilesystemAdapter with local filesystem signed URL serving) was introduced in Laravel 11.x/12.x and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:13:49.604159+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 8.83.29-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.83.29 is NOT AFFECTED by GHSA-jwvj-pwww-3mj5. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalars. The upstream Laravel 8.83.29 release (November 2024) already contains the complete fix via the flattenValue() method and array flattening+slicing logic applied to all vulnerable methods ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.83.29 is NOT AFFECTED by GHSA-jwvj-pwww-3mj5. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalars. The upstream Laravel 8.83.29 release (November 2024) already contains the complete fix via the flattenValue() method and array flattening+slicing logic applied to all vulnerable methods ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:15:18.533137+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.83.29-p1+tuxcare of laravel/framework. The target Laravel 8.83.29 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The fix replacing predictable SHA1 cookie prefixes with HMAC-keyed prefixes was already present in the upstream Laravel 8.83.29 release when TuxCare onboarded it (commit 838fe2b62d, Aug 2025). The vulnerability was fixed upstream by Taylor Otwell in July 2020. The target code uses CookieValuePrefix::create() with hash_hmac, preventing attackers from forging valid cookie prefixes even with an encryption oracle.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel 8.83.29 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The fix replacing predictable SHA1 cookie prefixes with HMAC-keyed prefixes was already present in the upstream Laravel 8.83.29 release when TuxCare onboarded it (commit 838fe2b62d, Aug 2025). The vulnerability was fixed upstream by Taylor Otwell in July 2020. The target code uses CookieValuePrefix::create() with hash_hmac, preventing attackers from forging valid cookie prefixes even with an encryption oracle." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 8.83.29-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.83.29 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched upstream in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Since version 8.83.29 > 8.40.0, the fix was already present in the upstream release that TuxCare onboarded. All four vulnerable entry points (limit/offset/skip/ta...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.83.29 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched upstream in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Since version 8.83.29 > 8.40.0, the fix was already present in the upstream release that TuxCare onboarded. All four vulnerable entry points (limit/offset/skip/ta..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:41:35.131174+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 8.83.29-p1+tuxcare of laravel/framework. The target Laravel 8.83.29 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involves unexpected query bindings when array values are passed to query builder methods expecting scalars. All affected methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) already use the flattenValue() helper method to extract scalar values from arrays, which provides the same protection as the upstream patches. This fix was already present in the upstream Laravel v8.83.29 release that TuxCare onboarded on 2025-08-25 via commit 838fe2b62d.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "The target Laravel 8.83.29 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involves unexpected query bindings when array values are passed to query builder methods expecting scalars. All affected methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) already use the flattenValue() helper method to extract scalar values from arrays, which provides the same protection as the upstream patches. This fix was already present in the upstream Laravel v8.83.29 release that TuxCare onboarded on 2025-08-25 via commit 838fe2b62d." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 11.51.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 11.51.0-p2+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel framework version 11.51.0-p4+tuxcare) is NOT AFFECTED by CVE-2017-14775. The vulnerability concerned Laravel versions before 5.5.10 where DatabaseUserProvider and EloquentUserProvider performed variable-time token comparison using database WHERE clauses, allowing timing attacks on remember_me tokens. The fix (constant-time comparison using hash_equals()) was intro...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target repository (Laravel framework version 11.51.0-p4+tuxcare) is NOT AFFECTED by CVE-2017-14775. The vulnerability concerned Laravel versions before 5.5.10 where DatabaseUserProvider and EloquentUserProvider performed variable-time token comparison using database WHERE clauses, allowing timing attacks on remember_me tokens. The fix (constant-time comparison using hash_equals()) was intro..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 11.51.0-p2+tuxcare of laravel/framework. The target Laravel Framework v11.51.0 is NOT affected by CVE-2018-15133. The vulnerability pattern (uncontrolled PHP deserialization of encrypted cookie values) is not present. The upstream Laravel v11.51.0 release includes the security fix (commit 240d904606 by Taylor Otwell) that disables PHP serialization during cookie encryption/decryption operations by default. The EncryptCookies middleware passes serialize=false to all encrypt/decrypt operations, preventing unserialize() from being called on attacker-controlled encrypted cookie data, thus blocking the RCE attack vector.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "The target Laravel Framework v11.51.0 is NOT affected by CVE-2018-15133. The vulnerability pattern (uncontrolled PHP deserialization of encrypted cookie values) is not present. The upstream Laravel v11.51.0 release includes the security fix (commit 240d904606 by Taylor Otwell) that disables PHP serialization during cookie encryption/decryption operations by default. The EncryptCookies middleware passes serialize=false to all encrypt/decrypt operations, preventing unserialize() from being called on attacker-controlled encrypted cookie data, thus blocking the RCE attack vector." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 11.51.0-p2+tuxcare of laravel/framework. Laravel 11.51.0 is not affected by CVE-2019-9081. While the PendingCommand class retains the dangerous __destruct pattern from the vulnerable 5.7.x versions, this class is strictly test-only (part of Illuminate\\Testing namespace, used exclusively in PHPUnit test contexts via InteractsWithConsole trait). Production code never instantiates PendingCommand objects. Although Laravel's session unserialize() calls lack allowed_classes restrictions, exploitation requires compromising session security (APP_KEY) to inject arbitrary serialized data\u2014a separate vulnerability. The attack chain from normal production entry points to arbitrary command execution via PendingCommand is broken by architectural constraints. No CVE-2019-9081 fixes found in git history, indicating upstream Laravel considers this non-exploitable in practice.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "Laravel 11.51.0 is not affected by CVE-2019-9081. While the PendingCommand class retains the dangerous __destruct pattern from the vulnerable 5.7.x versions, this class is strictly test-only (part of Illuminate\\Testing namespace, used exclusively in PHPUnit test contexts via InteractsWithConsole trait). Production code never instantiates PendingCommand objects. Although Laravel's session unserialize() calls lack allowed_classes restrictions, exploitation requires compromising session security (APP_KEY) to inject arbitrary serialized data\u2014a separate vulnerability. The attack chain from normal production entry points to arbitrary command execution via PendingCommand is broken by architectural constraints. No CVE-2019-9081 fixes found in git history, indicating upstream Laravel considers this non-exploitable in practice." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 11.51.0-p2+tuxcare of laravel/framework. CVE-2020-19316 is not present in Laravel Framework v11.51.0. The OS command injection vulnerability in the link() function was fixed by upstream Laravel in version 5.8.17 (commit 44c3feb604, May 2019) by adding escapeshellarg() to both $link and $target parameters. The target version 11.51.0, released in 2024, already includes this fix as part of the upstream release that TuxCare onboarded. Both Windows (mklink) and Unix (ln -s) code paths properly escape shell arguments, preventing command injection.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 is not present in Laravel Framework v11.51.0. The OS command injection vulnerability in the link() function was fixed by upstream Laravel in version 5.8.17 (commit 44c3feb604, May 2019) by adding escapeshellarg() to both $link and $target parameters. The target version 11.51.0, released in 2024, already includes this fix as part of the upstream release that TuxCare onboarded. Both Windows (mklink) and Unix (ln -s) code paths properly escape shell arguments, preventing command injection." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:41:57.354813+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 11.51.0-p2+tuxcare of laravel/framework. CVE-2020-24941: Laravel framework $guarded property bypass via JSON column notation. The target (laravel/framework v11.51.0-p4+tuxcare) is NOT AFFECTED. The vulnerability allowed mass-assignment protection bypass by using attribute names that don't correspond to actual database columns (e.g., `fake_column->nested`). The upstream fix (commit 897d107775, Aug 2020) added isGuardableColumn() validation to reject non-existent column names. This fix shipped in Laravel 6.18.35/7.24.0 and was already present in upstream v11.51.0 when TuxCare created the snapshot (commit c90d5ed195, May 2026). The target contains the complete defense: $guardableColumns property (line 33), isGuardableColumn() method (lines 215-234), and the guard check integration (line 206).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941: Laravel framework $guarded property bypass via JSON column notation. The target (laravel/framework v11.51.0-p4+tuxcare) is NOT AFFECTED. The vulnerability allowed mass-assignment protection bypass by using attribute names that don't correspond to actual database columns (e.g., `fake_column->nested`). The upstream fix (commit 897d107775, Aug 2020) added isGuardableColumn() validation to reject non-existent column names. This fix shipped in Laravel 6.18.35/7.24.0 and was already present in upstream v11.51.0 when TuxCare created the snapshot (commit c90d5ed195, May 2026). The target contains the complete defense: $guardableColumns property (line 33), isGuardableColumn() method (lines 215-234), and the guard check integration (line 206)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 11.51.0-p2+tuxcare of laravel/framework. Laravel 11.51.0 is not affected by CVE-2021-21263. The vulnerable query binding pattern is not present in the target. The upstream Laravel project fixed this vulnerability in versions 6.20.12, 7.30.3, and 8.22.1 (released January 2021). Version 11.51.0 (released years later) already contains comprehensive protections through the `flattenValue()` method and array-limiting logic, which provide equivalent (and stronger) protection than the original security patch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "Laravel 11.51.0 is not affected by CVE-2021-21263. The vulnerable query binding pattern is not present in the target. The upstream Laravel project fixed this vulnerability in versions 6.20.12, 7.30.3, and 8.22.1 (released January 2021). Version 11.51.0 (released years later) already contains comprehensive protections through the `flattenValue()` method and array-limiting logic, which provide equivalent (and stronger) protection than the original security patch." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 11.51.0-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework 11.51.0-p4+tuxcare is NOT affected by CVE-2021-43808. The vulnerability involved predictable parent placeholder hashes in Blade templates enabling XSS attacks by allowing attackers to guess placeholder tokens like ##parent-placeholder-## and inject malicious content. The fix (random salt-based hashing + runtime evaluation) was already present in upstream Laravel 11.51.0 ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel Framework 11.51.0-p4+tuxcare is NOT affected by CVE-2021-43808. The vulnerability involved predictable parent placeholder hashes in Blade templates enabling XSS attacks by allowing attackers to guess placeholder tokens like ##parent-placeholder-## and inject malicious content. The fix (random salt-based hashing + runtime evaluation) was already present in upstream Laravel 11.51.0 ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 11.51.0-p2+tuxcare of laravel/framework. The target Laravel framework v11.51.0 is NOT AFFECTED by CVE-2024-52301. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when PHP's register_argc_argv directive is enabled. The fix (checking runningInConsole() before trusting $_SERVER['argv']) was already present in the upstream Laravel v11.51.0 release (March 26, 2026), which was released after the security patches were created on November 12, 2024. The TuxCare repository onboarded this already-fixed version via snapshot commit c90d5ed195.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target Laravel framework v11.51.0 is NOT AFFECTED by CVE-2024-52301. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when PHP's register_argc_argv directive is enabled. The fix (checking runningInConsole() before trusting $_SERVER['argv']) was already present in the upstream Laravel v11.51.0 release (March 26, 2026), which was released after the security patches were created on November 12, 2024. The TuxCare repository onboarded this already-fixed version via snapshot commit c90d5ed195." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 11.51.0-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 11.51.0-p4+tuxcare is NOT AFFECTED by CVE-2025-27515. The vulnerability (wildcard validation bypass allowing user-crafted array keys to bypass validation rules) was fixed in the upstream Laravel v11.51.0 release before TuxCare onboarded this version. The fix is present in the target at src/Illuminate/Validation/Validator.php lines 875-921, where the validateUsingCustomRule me...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target Laravel 11.51.0-p4+tuxcare is NOT AFFECTED by CVE-2025-27515. The vulnerability (wildcard validation bypass allowing user-crafted array keys to bypass validation rules) was fixed in the upstream Laravel v11.51.0 release before TuxCare onboarded this version. The fix is present in the target at src/Illuminate/Validation/Validator.php lines 875-921, where the validateUsingCustomRule me..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:33:09.068963+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 11.51.0-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-102279. The vulnerability was introduced in Laravel 12.x with a redesigned exception renderer that explicitly set `allowHTML: true` in Tippy.js tooltip configuration. Laravel 11.x uses a different exception renderer architecture that never had this vulnerable pattern. While 11.x does display attacker-controlled data (request headers, route context) in...", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-102279. The vulnerability was introduced in Laravel 12.x with a redesigned exception renderer that explicitly set `allowHTML: true` in Tippy.js tooltip configuration. Laravel 11.x uses a different exception renderer architecture that never had this vulnerable pattern. While 11.x does display attacker-controlled data (request headers, route context) in..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 11.51.0-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-114508. The vulnerable JSON:API resource feature was introduced in Laravel 12.45.0 (December 2025) and does not exist in this version. The entire JsonApi component, including the vulnerable ResolvesJsonApiElements trait that allowed malicious include parameters to trigger destructive database operations like truncate(), is not present in v11.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-114508. The vulnerable JSON:API resource feature was introduced in Laravel 12.45.0 (December 2025) and does not exist in this version. The entire JsonApi component, including the vulnerable ResolvesJsonApiElements trait that allowed malicious include parameters to trigger destructive database operations like truncate(), is not present in v11.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T13:21:38.472678+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 11.51.0-p2+tuxcare of laravel/framework, and is fixed in 11.51.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 11.51.0-p2+tuxcare of laravel/framework, and is fixed in 11.51.0-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 11.51.0-p2+tuxcare of laravel/framework. Already fixed upstream before 11.51.0 (GHSA-4mg9-vhxq-vm7j patched in 6.20.26/7.30.5/8.40.0, upstream commit eaca1cb1cc #37164): Builder::offset()/limit() cast values to int and SqlServerGrammar casts limit/offset. Vendor fix present in laravel/framework v9.52.21+ and 11.51.0; no TuxCare patch needed. Ref PHPELSCVE-990.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "Already fixed upstream before 11.51.0 (GHSA-4mg9-vhxq-vm7j patched in 6.20.26/7.30.5/8.40.0, upstream commit eaca1cb1cc #37164): Builder::offset()/limit() cast values to int and SqlServerGrammar casts limit/offset. Vendor fix present in laravel/framework v9.52.21+ and 11.51.0; no TuxCare patch needed. Ref PHPELSCVE-990." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 11.51.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:02:32.915814+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 11.51.0-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v11.51.0 is NOT affected by GHSA-6jvx-8ch9-j2jr. The vulnerability concerned PHP object deserialization in cookies, which was fixed upstream in Laravel 5.6.30 (August 2018) by disabling serialization for all cookies. Version 11.51.0 (released ~2024) is much newer and inherited this fix from the upstream release. The vulnerable code pattern (cookies encrypted/decrypt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel framework v11.51.0 is NOT affected by GHSA-6jvx-8ch9-j2jr. The vulnerability concerned PHP object deserialization in cookies, which was fixed upstream in Laravel 5.6.30 (August 2018) by disabling serialization for all cookies. Version 11.51.0 (released ~2024) is much newer and inherited this fix from the upstream release. The vulnerable code pattern (cookies encrypted/decrypt..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 11.51.0-p2+tuxcare of laravel/framework. not_affected \u2014 The IV length validation fix for GHSA-7852-w36x-6mf6 is already present in Laravel 11.51.0. The vulnerability was fixed in upstream Laravel in March 2018 (commit 886d261df0 by Taylor Otwell). The fix validates that the base64-decoded IV length matches the expected cipher IV length before decryption, preventing silent failures that could lead to weak type comparison bypasses (false == ''). TuxCa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The IV length validation fix for GHSA-7852-w36x-6mf6 is already present in Laravel 11.51.0. The vulnerability was fixed in upstream Laravel in March 2018 (commit 886d261df0 by Taylor Otwell). The fix validates that the base64-decoded IV length matches the expected cipher IV length before decryption, preventing silent failures that could lead to weak type comparison bypasses (false == ''). TuxCa..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp is fixed in version 11.51.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:17:24.242406+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 11.51.0-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 11.51.0-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability pattern (unexpected query bindings from array parameters in scalar contexts) is not present because the fix was already included in the upstream Laravel v11.51.0 release. The target contains a `flattenValue()` method (line 4217) that flattens arrays to scalar values before binding, and all ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework 11.51.0-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability pattern (unexpected query bindings from array parameters in scalar contexts) is not present because the fix was already included in the upstream Laravel v11.51.0 release. The target contains a `flattenValue()` method (line 4217) that flattens arrays to scalar values before binding, and all ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:19:00.105438+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 11.51.0-p2+tuxcare of laravel/framework. The target Laravel framework v11.51.0 is NOT vulnerable to GHSA-qm5c-m76r-2hfr. The vulnerable code pattern (plain SHA1 hash for cookie prefixes) is absent. The upstream fix using HMAC-based cookie value prefixes was already present in Laravel 11.51.0 when TuxCare onboarded it. The fix replaces predictable sha1($cookieName.'v2') with hash_hmac('sha1', $cookieName.'v2', $key), preventing attackers from forging valid cookie prefixes even with encryption oracle access.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework v11.51.0 is NOT vulnerable to GHSA-qm5c-m76r-2hfr. The vulnerable code pattern (plain SHA1 hash for cookie prefixes) is absent. The upstream fix using HMAC-based cookie value prefixes was already present in Laravel 11.51.0 when TuxCare onboarded it. The fix replaces predictable sha1($cookieName.'v2') with hash_hmac('sha1', $cookieName.'v2', $key), preventing attackers from forging valid cookie prefixes even with encryption oracle access." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 11.51.0-p2+tuxcare of laravel/framework. not_affected \u2014 Target version 11.51.0 is NOT vulnerable to GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was fixed in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April 2021) by adding integer casting to limit and offset parameters. Laravel 11.51.0 (released 2024) inherits these fixes from the upstream codebase. Both critical files (SqlServerGrammar.php and Builder.php) conta...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Target version 11.51.0 is NOT vulnerable to GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was fixed in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April 2021) by adding integer casting to limit and offset parameters. Laravel 11.51.0 (released 2024) inherits these fixes from the upstream codebase. Both critical files (SqlServerGrammar.php and Builder.php) conta..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:42:04.797220+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 11.51.0-p2+tuxcare of laravel/framework. Laravel 11.51.0 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability (unexpected query bindings from array inputs) was fixed in upstream Laravel before the 11.51.0 release. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) now use the flattenValue() helper or array_slice() to limit bindings, preventing the vulnerability. The fix was already present when TuxCare took the v11.51.0 snapshot (commit c90d5ed195), requiring no separate backport to this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "Laravel 11.51.0 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability (unexpected query bindings from array inputs) was fixed in upstream Laravel before the 11.51.0 release. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) now use the flattenValue() helper or array_slice() to limit bindings, preventing the vulnerability. The fix was already present when TuxCare took the v11.51.0 snapshot (commit c90d5ed195), requiring no separate backport to this version." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-16T13:35:00.548500+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 8.83.29-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 does not affect this target. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.83.29, released years later, inherited this fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use PHP's hash_equals() for constant-time token comparison at line 77. The TuxCare onbo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 does not affect this target. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.83.29, released years later, inherited this fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use PHP's hash_equals() for constant-time token comparison at line 77. The TuxCare onbo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.83.29-p5+tuxcare of laravel/framework. CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29 via unserialize on untrusted X-XSRF-TOKEN values. The target (Laravel 8.83.29) ships with the upstream fix already present. The defense (static::$serialize = false; static::serialized() returning false) disables automatic unserialization after cookie/CSRF token decryption, preventing PHP object injection attacks. The fix was introduced by Taylor Otwell in upstream patches 240d9046 and c0eb9073 (Aug 2018) and is present in all Laravel 8.x releases. The vulnerable pattern (decrypt with unserialize enabled by default) does not exist in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29 via unserialize on untrusted X-XSRF-TOKEN values. The target (Laravel 8.83.29) ships with the upstream fix already present. The defense (static::$serialize = false; static::serialized() returning false) disables automatic unserialization after cookie/CSRF token decryption, preventing PHP object injection attacks. The fix was introduced by Taylor Otwell in upstream patches 240d9046 and c0eb9073 (Aug 2018) and is present in all Laravel 8.x releases. The vulnerable pattern (decrypt with unserialize enabled by default) does not exist in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.83.29-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.83.29-p5+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.83.29-p5+tuxcare of laravel/framework. Laravel Framework 8.83.29 is not affected by CVE-2020-19316. The OS command injection vulnerability in the Filesystem::link() function was fixed upstream in May 2019 (commit 44c3feb604) for Laravel 5.8.17. Version 8.83.29 was released much later and already included this fix when it was onboarded into the TuxCare repository. The current code at src/Illuminate/Filesystem/Filesystem.php:337 properly applies escapeshellarg() to both $link and $target parameters before passing them to the exec() function, preventing command injection.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "Laravel Framework 8.83.29 is not affected by CVE-2020-19316. The OS command injection vulnerability in the Filesystem::link() function was fixed upstream in May 2019 (commit 44c3feb604) for Laravel 5.8.17. Version 8.83.29 was released much later and already included this fix when it was onboarded into the TuxCare repository. The current code at src/Illuminate/Filesystem/Filesystem.php:337 properly applies escapeshellarg() to both $link and $target parameters before passing them to the exec() function, preventing command injection." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:41:26.189153+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.83.29-p5+tuxcare of laravel/framework. CVE-2020-24941 does not affect Laravel 8.83.29. The vulnerability (mass assignment bypass via non-column attribute keys) was fixed in Laravel 6.18.35 and 7.24.0 (August 2020). Laravel 8.x was released in September 2020, after the fix, so all 8.x versions including 8.83.29 shipped with the fix already present. The target repository's GuardsAttributes.php contains the complete fix: the isGuardableColumn() method validates attribute keys against actual database columns, and non-column keys are automatically treated as guarded (blocked). This fix came from upstream Laravel, not from a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 does not affect Laravel 8.83.29. The vulnerability (mass assignment bypass via non-column attribute keys) was fixed in Laravel 6.18.35 and 7.24.0 (August 2020). Laravel 8.x was released in September 2020, after the fix, so all 8.x versions including 8.83.29 shipped with the fix already present. The target repository's GuardsAttributes.php contains the complete fix: the isGuardableColumn() method validates attribute keys against actual database columns, and non-column keys are automatically treated as guarded (blocked). This fix came from upstream Laravel, not from a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 8.83.29-p5+tuxcare of laravel/framework. CVE-2021-21263 is not present in laravel/framework 8.83.29-p6+tuxcare. The vulnerability (query binding exploitation via unchecked array inputs) was fixed in upstream Laravel 8.22.1, and the target version 8.83.29 already contains the fix as shipped in the upstream release. The fix uses a flattenValue() helper method that limits array inputs to their first element, preventing unexpected query bindings in where(), whereBetween(), whereDate/Time/Day/Month/Year(), whereJsonLength(), and having() methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "CVE-2021-21263 is not present in laravel/framework 8.83.29-p6+tuxcare. The vulnerability (query binding exploitation via unchecked array inputs) was fixed in upstream Laravel 8.22.1, and the target version 8.83.29 already contains the fix as shipped in the upstream release. The fix uses a flattenValue() helper method that limits array inputs to their first element, preventing unexpected query bindings in where(), whereBetween(), whereDate/Time/Day/Month/Year(), whereJsonLength(), and having() methods." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 does not affect this target. The vulnerability (predictable parent placeholder hashes in Blade templates allowing XSS) was fixed by the upstream Laravel team before version 8.83.29 was released. The complete fix\u2014including random per-request salt generation, runtime placeholder creation, and cache invalidation\u2014is present in all three affected files. TuxCare onboarded an already-fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 does not affect this target. The vulnerability (predictable parent placeholder hashes in Blade templates allowing XSS) was fixed by the upstream Laravel team before version 8.83.29 was released. The complete fix\u2014including random per-request salt generation, runtime placeholder creation, and cache invalidation\u2014is present in all three affected files. TuxCare onboarded an already-fi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-16T13:35:00.548500+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 8.83.29-p5+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 8.83.29-p5+tuxcare of laravel/framework. CVE-2024-52301 is NOT present in Laravel 8.83.29-p6+tuxcare. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when register_argc_argv is enabled. The fix (checking runningInConsole() before using $_SERVER['argv']) was already present in the upstream code when TuxCare onboarded version 8.83.29 on Aug 25, 2025. The upstream fix was authored by Taylor Otwell and applied to all maintained Laravel branches in November 2024.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "CVE-2024-52301 is NOT present in Laravel 8.83.29-p6+tuxcare. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when register_argc_argv is enabled. The fix (checking runningInConsole() before using $_SERVER['argv']) was already present in the upstream code when TuxCare onboarded version 8.83.29 on Aug 25, 2025. The upstream fix was authored by Taylor Otwell and applied to all maintained Laravel branches in November 2024." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-16T13:35:00.548500+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.83.29-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-16T13:35:00.548500+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-102279. The vulnerability exists in the new exception renderer with Tippy.js tooltips (allowHTML: true) introduced in Laravel 12.x. The target version uses Whoops library's PrettyPageHandler for debug exception rendering instead, which does not have Tippy.js or any tooltip system that could be exploited via attacker-controlled HTML content.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-102279. The vulnerability exists in the new exception renderer with Tippy.js tooltips (allowHTML: true) introduced in Laravel 12.x. The target version uses Whoops library's PrettyPageHandler for debug exception rendering instead, which does not have Tippy.js or any tooltip system that could be exploited via attacker-controlled HTML content." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource relationship inclusion processing feature, which was introduced in Laravel 12.x (commit 2f30936319193371fc1ac338d171a5b92be9976de5). This feature is completely absent from Laravel 8.x. The vulnerable code path in ResolvesJsonApiElements.php does not exist in this version. The standard JsonResou...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource relationship inclusion processing feature, which was introduced in Laravel 12.x (commit 2f30936319193371fc1ac338d171a5b92be9976de5). This feature is completely absent from Laravel 8.x. The vulnerable code path in ResolvesJsonApiElements.php does not exist in this version. The standard JsonResou..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-28T12:27:44.661604+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.83.29-p5+tuxcare of laravel/framework, and is fixed in 8.83.29-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.83.29-p5+tuxcare of laravel/framework, and is fixed in 8.83.29-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-28T20:45:27.177095+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 The SQL injection vulnerability (GHSA-4mg9-vhxq-vm7j) affecting Laravel's SQL Server driver when user input is passed to limit/offset/skip/take functions is NOT present in this target. The vulnerability was fixed in upstream Laravel 8.40.0, and the target version 8.83.29 already contains the fix. Integer casting defenses are present in both Builder.php (lines 2140, 2167) and SqlServerGrammar.ph...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The SQL injection vulnerability (GHSA-4mg9-vhxq-vm7j) affecting Laravel's SQL Server driver when user input is passed to limit/offset/skip/take functions is NOT present in this target. The vulnerability was fixed in upstream Laravel 8.40.0, and the target version 8.83.29 already contains the fix. Integer casting defenses are present in both Builder.php (lines 2140, 2167) and SqlServerGrammar.ph..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-16T13:35:00.548500+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.83.29-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-28T20:58:09.118737+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The vulnerable pattern was fixed by upstream Laravel in version 5.6.30 (August 2018), and Laravel 8.83.29 (released September 2022) inherited this fix. The target uses `protected static $serialize = false` to disable PHP object serialization for all cookies, preventing CWE-502 deserialization attacks....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The vulnerable pattern was fixed by upstream Laravel in version 5.6.30 (August 2018), and Laravel 8.83.29 (released September 2022) inherited this fix. The target uses `protected static $serialize = false` to disable PHP object serialization for all cookies, preventing CWE-502 deserialization attacks...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 8.83.29-p6+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability pattern (missing IV length validation in Encrypter::validPayload) is not present in the target. The fix was already included in the upstream Laravel 8.83.29 release when TuxCare onboarded it in August 2025. The IV length validation check (strlen(base64_decode($payload['iv'], true)) === open...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework 8.83.29-p6+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability pattern (missing IV length validation in Encrypter::validPayload) is not present in the target. The fix was already included in the upstream Laravel 8.83.29 release when TuxCare onboarded it in August 2025. The IV length validation check (strlen(base64_decode($payload['iv'], true)) === open..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-16T13:35:00.548500+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerable component (LocalFilesystemAdapter with local filesystem signed URL serving) was introduced in Laravel 11.x/12.x and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerable component (LocalFilesystemAdapter with local filesystem signed URL serving) was introduced in Laravel 11.x/12.x and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-28T21:13:49.604159+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.83.29 is NOT AFFECTED by GHSA-jwvj-pwww-3mj5. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalars. The upstream Laravel 8.83.29 release (November 2024) already contains the complete fix via the flattenValue() method and array flattening+slicing logic applied to all vulnerable methods ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.83.29 is NOT AFFECTED by GHSA-jwvj-pwww-3mj5. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalars. The upstream Laravel 8.83.29 release (November 2024) already contains the complete fix via the flattenValue() method and array flattening+slicing logic applied to all vulnerable methods ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:15:18.533137+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.83.29-p5+tuxcare of laravel/framework. The target Laravel 8.83.29 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The fix replacing predictable SHA1 cookie prefixes with HMAC-keyed prefixes was already present in the upstream Laravel 8.83.29 release when TuxCare onboarded it (commit 838fe2b62d, Aug 2025). The vulnerability was fixed upstream by Taylor Otwell in July 2020. The target code uses CookieValuePrefix::create() with hash_hmac, preventing attackers from forging valid cookie prefixes even with an encryption oracle.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel 8.83.29 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The fix replacing predictable SHA1 cookie prefixes with HMAC-keyed prefixes was already present in the upstream Laravel 8.83.29 release when TuxCare onboarded it (commit 838fe2b62d, Aug 2025). The vulnerability was fixed upstream by Taylor Otwell in July 2020. The target code uses CookieValuePrefix::create() with hash_hmac, preventing attackers from forging valid cookie prefixes even with an encryption oracle." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 8.83.29-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.83.29 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched upstream in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Since version 8.83.29 > 8.40.0, the fix was already present in the upstream release that TuxCare onboarded. All four vulnerable entry points (limit/offset/skip/ta...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.83.29 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched upstream in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Since version 8.83.29 > 8.40.0, the fix was already present in the upstream release that TuxCare onboarded. All four vulnerable entry points (limit/offset/skip/ta..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:41:35.131174+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 8.83.29-p5+tuxcare of laravel/framework. The target Laravel 8.83.29 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involves unexpected query bindings when array values are passed to query builder methods expecting scalars. All affected methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) already use the flattenValue() helper method to extract scalar values from arrays, which provides the same protection as the upstream patches. This fix was already present in the upstream Laravel v8.83.29 release that TuxCare onboarded on 2025-08-25 via commit 838fe2b62d.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "The target Laravel 8.83.29 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involves unexpected query bindings when array values are passed to query builder methods expecting scalars. All affected methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) already use the flattenValue() helper method to extract scalar values from arrays, which provides the same protection as the upstream patches. This fix was already present in the upstream Laravel v8.83.29 release that TuxCare onboarded on 2025-08-25 via commit 838fe2b62d." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab...", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th...", "vulnerability": { "name": "CVE-2025-57811" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68454" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 is a false positive for verbb/feed-me 3.1.17-p3+tuxcare. false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron...", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n...", "vulnerability": { "name": "CVE-2026-29113" }, "impact_statement": "not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t...", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core...", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra...", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil...", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability.", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 is a false positive for verbb/feed-me 3.1.17-p3+tuxcare. false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase.", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do...", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.1.17-p3+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab...", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th...", "vulnerability": { "name": "CVE-2025-57811" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68454" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 is a false positive for verbb/feed-me 3.1.17-p4+tuxcare. false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron...", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n...", "vulnerability": { "name": "CVE-2026-29113" }, "impact_statement": "not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t...", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core...", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra...", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil...", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability.", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 is a false positive for verbb/feed-me 3.1.17-p4+tuxcare. false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase.", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do...", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.1.17-p4+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab...", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th...", "vulnerability": { "name": "CVE-2025-57811" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68454" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 is a false positive for verbb/feed-me 3.1.17-p5+tuxcare. false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron...", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n...", "vulnerability": { "name": "CVE-2026-29113" }, "impact_statement": "not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t...", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core...", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra...", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil...", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability.", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 is a false positive for verbb/feed-me 3.1.17-p5+tuxcare. false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase.", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do...", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.1.17-p5+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T13:21:32.363026+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 11.51.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 11.51.0-p4+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel framework version 11.51.0-p4+tuxcare) is NOT AFFECTED by CVE-2017-14775. The vulnerability concerned Laravel versions before 5.5.10 where DatabaseUserProvider and EloquentUserProvider performed variable-time token comparison using database WHERE clauses, allowing timing attacks on remember_me tokens. The fix (constant-time comparison using hash_equals()) was intro...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target repository (Laravel framework version 11.51.0-p4+tuxcare) is NOT AFFECTED by CVE-2017-14775. The vulnerability concerned Laravel versions before 5.5.10 where DatabaseUserProvider and EloquentUserProvider performed variable-time token comparison using database WHERE clauses, allowing timing attacks on remember_me tokens. The fix (constant-time comparison using hash_equals()) was intro..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 11.51.0-p4+tuxcare of laravel/framework. The target Laravel Framework v11.51.0 is NOT affected by CVE-2018-15133. The vulnerability pattern (uncontrolled PHP deserialization of encrypted cookie values) is not present. The upstream Laravel v11.51.0 release includes the security fix (commit 240d904606 by Taylor Otwell) that disables PHP serialization during cookie encryption/decryption operations by default. The EncryptCookies middleware passes serialize=false to all encrypt/decrypt operations, preventing unserialize() from being called on attacker-controlled encrypted cookie data, thus blocking the RCE attack vector.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "The target Laravel Framework v11.51.0 is NOT affected by CVE-2018-15133. The vulnerability pattern (uncontrolled PHP deserialization of encrypted cookie values) is not present. The upstream Laravel v11.51.0 release includes the security fix (commit 240d904606 by Taylor Otwell) that disables PHP serialization during cookie encryption/decryption operations by default. The EncryptCookies middleware passes serialize=false to all encrypt/decrypt operations, preventing unserialize() from being called on attacker-controlled encrypted cookie data, thus blocking the RCE attack vector." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 11.51.0-p4+tuxcare of laravel/framework. Laravel 11.51.0 is not affected by CVE-2019-9081. While the PendingCommand class retains the dangerous __destruct pattern from the vulnerable 5.7.x versions, this class is strictly test-only (part of Illuminate\\Testing namespace, used exclusively in PHPUnit test contexts via InteractsWithConsole trait). Production code never instantiates PendingCommand objects. Although Laravel's session unserialize() calls lack allowed_classes restrictions, exploitation requires compromising session security (APP_KEY) to inject arbitrary serialized data\u2014a separate vulnerability. The attack chain from normal production entry points to arbitrary command execution via PendingCommand is broken by architectural constraints. No CVE-2019-9081 fixes found in git history, indicating upstream Laravel considers this non-exploitable in practice.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "Laravel 11.51.0 is not affected by CVE-2019-9081. While the PendingCommand class retains the dangerous __destruct pattern from the vulnerable 5.7.x versions, this class is strictly test-only (part of Illuminate\\Testing namespace, used exclusively in PHPUnit test contexts via InteractsWithConsole trait). Production code never instantiates PendingCommand objects. Although Laravel's session unserialize() calls lack allowed_classes restrictions, exploitation requires compromising session security (APP_KEY) to inject arbitrary serialized data\u2014a separate vulnerability. The attack chain from normal production entry points to arbitrary command execution via PendingCommand is broken by architectural constraints. No CVE-2019-9081 fixes found in git history, indicating upstream Laravel considers this non-exploitable in practice." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 11.51.0-p4+tuxcare of laravel/framework. CVE-2020-19316 is not present in Laravel Framework v11.51.0. The OS command injection vulnerability in the link() function was fixed by upstream Laravel in version 5.8.17 (commit 44c3feb604, May 2019) by adding escapeshellarg() to both $link and $target parameters. The target version 11.51.0, released in 2024, already includes this fix as part of the upstream release that TuxCare onboarded. Both Windows (mklink) and Unix (ln -s) code paths properly escape shell arguments, preventing command injection.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 is not present in Laravel Framework v11.51.0. The OS command injection vulnerability in the link() function was fixed by upstream Laravel in version 5.8.17 (commit 44c3feb604, May 2019) by adding escapeshellarg() to both $link and $target parameters. The target version 11.51.0, released in 2024, already includes this fix as part of the upstream release that TuxCare onboarded. Both Windows (mklink) and Unix (ln -s) code paths properly escape shell arguments, preventing command injection." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:41:57.354813+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 11.51.0-p4+tuxcare of laravel/framework. CVE-2020-24941: Laravel framework $guarded property bypass via JSON column notation. The target (laravel/framework v11.51.0-p4+tuxcare) is NOT AFFECTED. The vulnerability allowed mass-assignment protection bypass by using attribute names that don't correspond to actual database columns (e.g., `fake_column->nested`). The upstream fix (commit 897d107775, Aug 2020) added isGuardableColumn() validation to reject non-existent column names. This fix shipped in Laravel 6.18.35/7.24.0 and was already present in upstream v11.51.0 when TuxCare created the snapshot (commit c90d5ed195, May 2026). The target contains the complete defense: $guardableColumns property (line 33), isGuardableColumn() method (lines 215-234), and the guard check integration (line 206).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941: Laravel framework $guarded property bypass via JSON column notation. The target (laravel/framework v11.51.0-p4+tuxcare) is NOT AFFECTED. The vulnerability allowed mass-assignment protection bypass by using attribute names that don't correspond to actual database columns (e.g., `fake_column->nested`). The upstream fix (commit 897d107775, Aug 2020) added isGuardableColumn() validation to reject non-existent column names. This fix shipped in Laravel 6.18.35/7.24.0 and was already present in upstream v11.51.0 when TuxCare created the snapshot (commit c90d5ed195, May 2026). The target contains the complete defense: $guardableColumns property (line 33), isGuardableColumn() method (lines 215-234), and the guard check integration (line 206)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 11.51.0-p4+tuxcare of laravel/framework. Laravel 11.51.0 is not affected by CVE-2021-21263. The vulnerable query binding pattern is not present in the target. The upstream Laravel project fixed this vulnerability in versions 6.20.12, 7.30.3, and 8.22.1 (released January 2021). Version 11.51.0 (released years later) already contains comprehensive protections through the `flattenValue()` method and array-limiting logic, which provide equivalent (and stronger) protection than the original security patch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "Laravel 11.51.0 is not affected by CVE-2021-21263. The vulnerable query binding pattern is not present in the target. The upstream Laravel project fixed this vulnerability in versions 6.20.12, 7.30.3, and 8.22.1 (released January 2021). Version 11.51.0 (released years later) already contains comprehensive protections through the `flattenValue()` method and array-limiting logic, which provide equivalent (and stronger) protection than the original security patch." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 11.51.0-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework 11.51.0-p4+tuxcare is NOT affected by CVE-2021-43808. The vulnerability involved predictable parent placeholder hashes in Blade templates enabling XSS attacks by allowing attackers to guess placeholder tokens like ##parent-placeholder-## and inject malicious content. The fix (random salt-based hashing + runtime evaluation) was already present in upstream Laravel 11.51.0 ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel Framework 11.51.0-p4+tuxcare is NOT affected by CVE-2021-43808. The vulnerability involved predictable parent placeholder hashes in Blade templates enabling XSS attacks by allowing attackers to guess placeholder tokens like ##parent-placeholder-## and inject malicious content. The fix (random salt-based hashing + runtime evaluation) was already present in upstream Laravel 11.51.0 ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 11.51.0-p4+tuxcare of laravel/framework. The target Laravel framework v11.51.0 is NOT AFFECTED by CVE-2024-52301. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when PHP's register_argc_argv directive is enabled. The fix (checking runningInConsole() before trusting $_SERVER['argv']) was already present in the upstream Laravel v11.51.0 release (March 26, 2026), which was released after the security patches were created on November 12, 2024. The TuxCare repository onboarded this already-fixed version via snapshot commit c90d5ed195.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target Laravel framework v11.51.0 is NOT AFFECTED by CVE-2024-52301. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when PHP's register_argc_argv directive is enabled. The fix (checking runningInConsole() before trusting $_SERVER['argv']) was already present in the upstream Laravel v11.51.0 release (March 26, 2026), which was released after the security patches were created on November 12, 2024. The TuxCare repository onboarded this already-fixed version via snapshot commit c90d5ed195." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 11.51.0-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 11.51.0-p4+tuxcare is NOT AFFECTED by CVE-2025-27515. The vulnerability (wildcard validation bypass allowing user-crafted array keys to bypass validation rules) was fixed in the upstream Laravel v11.51.0 release before TuxCare onboarded this version. The fix is present in the target at src/Illuminate/Validation/Validator.php lines 875-921, where the validateUsingCustomRule me...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target Laravel 11.51.0-p4+tuxcare is NOT AFFECTED by CVE-2025-27515. The vulnerability (wildcard validation bypass allowing user-crafted array keys to bypass validation rules) was fixed in the upstream Laravel v11.51.0 release before TuxCare onboarded this version. The fix is present in the target at src/Illuminate/Validation/Validator.php lines 875-921, where the validateUsingCustomRule me..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T13:21:32.363026+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 11.51.0-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-102279. The vulnerability was introduced in Laravel 12.x with a redesigned exception renderer that explicitly set `allowHTML: true` in Tippy.js tooltip configuration. Laravel 11.x uses a different exception renderer architecture that never had this vulnerable pattern. While 11.x does display attacker-controlled data (request headers, route context) in...", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-102279. The vulnerability was introduced in Laravel 12.x with a redesigned exception renderer that explicitly set `allowHTML: true` in Tippy.js tooltip configuration. Laravel 11.x uses a different exception renderer architecture that never had this vulnerable pattern. While 11.x does display attacker-controlled data (request headers, route context) in..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 11.51.0-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-114508. The vulnerable JSON:API resource feature was introduced in Laravel 12.45.0 (December 2025) and does not exist in this version. The entire JsonApi component, including the vulnerable ResolvesJsonApiElements trait that allowed malicious include parameters to trigger destructive database operations like truncate(), is not present in v11.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-114508. The vulnerable JSON:API resource feature was introduced in Laravel 12.45.0 (December 2025) and does not exist in this version. The entire JsonApi component, including the vulnerable ResolvesJsonApiElements trait that allowed malicious include parameters to trigger destructive database operations like truncate(), is not present in v11.x." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T13:21:38.472678+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 11.51.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 11.51.0-p4+tuxcare of laravel/framework. Already fixed upstream before 11.51.0 (GHSA-4mg9-vhxq-vm7j patched in 6.20.26/7.30.5/8.40.0, upstream commit eaca1cb1cc #37164): Builder::offset()/limit() cast values to int and SqlServerGrammar casts limit/offset. Vendor fix present in laravel/framework v9.52.21+ and 11.51.0; no TuxCare patch needed. Ref PHPELSCVE-990.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "Already fixed upstream before 11.51.0 (GHSA-4mg9-vhxq-vm7j patched in 6.20.26/7.30.5/8.40.0, upstream commit eaca1cb1cc #37164): Builder::offset()/limit() cast values to int and SqlServerGrammar casts limit/offset. Vendor fix present in laravel/framework v9.52.21+ and 11.51.0; no TuxCare patch needed. Ref PHPELSCVE-990." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T13:21:32.363026+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 11.51.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:02:32.915814+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 11.51.0-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v11.51.0 is NOT affected by GHSA-6jvx-8ch9-j2jr. The vulnerability concerned PHP object deserialization in cookies, which was fixed upstream in Laravel 5.6.30 (August 2018) by disabling serialization for all cookies. Version 11.51.0 (released ~2024) is much newer and inherited this fix from the upstream release. The vulnerable code pattern (cookies encrypted/decrypt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel framework v11.51.0 is NOT affected by GHSA-6jvx-8ch9-j2jr. The vulnerability concerned PHP object deserialization in cookies, which was fixed upstream in Laravel 5.6.30 (August 2018) by disabling serialization for all cookies. Version 11.51.0 (released ~2024) is much newer and inherited this fix from the upstream release. The vulnerable code pattern (cookies encrypted/decrypt..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 11.51.0-p4+tuxcare of laravel/framework. not_affected \u2014 The IV length validation fix for GHSA-7852-w36x-6mf6 is already present in Laravel 11.51.0. The vulnerability was fixed in upstream Laravel in March 2018 (commit 886d261df0 by Taylor Otwell). The fix validates that the base64-decoded IV length matches the expected cipher IV length before decryption, preventing silent failures that could lead to weak type comparison bypasses (false == ''). TuxCa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The IV length validation fix for GHSA-7852-w36x-6mf6 is already present in Laravel 11.51.0. The vulnerability was fixed in upstream Laravel in March 2018 (commit 886d261df0 by Taylor Otwell). The fix validates that the base64-decoded IV length matches the expected cipher IV length before decryption, preventing silent failures that could lead to weak type comparison bypasses (false == ''). TuxCa..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T13:21:32.363026+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp is fixed in version 11.51.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:17:24.242406+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 11.51.0-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 11.51.0-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability pattern (unexpected query bindings from array parameters in scalar contexts) is not present because the fix was already included in the upstream Laravel v11.51.0 release. The target contains a `flattenValue()` method (line 4217) that flattens arrays to scalar values before binding, and all ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework 11.51.0-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability pattern (unexpected query bindings from array parameters in scalar contexts) is not present because the fix was already included in the upstream Laravel v11.51.0 release. The target contains a `flattenValue()` method (line 4217) that flattens arrays to scalar values before binding, and all ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:19:00.105438+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 11.51.0-p4+tuxcare of laravel/framework. The target Laravel framework v11.51.0 is NOT vulnerable to GHSA-qm5c-m76r-2hfr. The vulnerable code pattern (plain SHA1 hash for cookie prefixes) is absent. The upstream fix using HMAC-based cookie value prefixes was already present in Laravel 11.51.0 when TuxCare onboarded it. The fix replaces predictable sha1($cookieName.'v2') with hash_hmac('sha1', $cookieName.'v2', $key), preventing attackers from forging valid cookie prefixes even with encryption oracle access.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework v11.51.0 is NOT vulnerable to GHSA-qm5c-m76r-2hfr. The vulnerable code pattern (plain SHA1 hash for cookie prefixes) is absent. The upstream fix using HMAC-based cookie value prefixes was already present in Laravel 11.51.0 when TuxCare onboarded it. The fix replaces predictable sha1($cookieName.'v2') with hash_hmac('sha1', $cookieName.'v2', $key), preventing attackers from forging valid cookie prefixes even with encryption oracle access." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 11.51.0-p4+tuxcare of laravel/framework. not_affected \u2014 Target version 11.51.0 is NOT vulnerable to GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was fixed in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April 2021) by adding integer casting to limit and offset parameters. Laravel 11.51.0 (released 2024) inherits these fixes from the upstream codebase. Both critical files (SqlServerGrammar.php and Builder.php) conta...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Target version 11.51.0 is NOT vulnerable to GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was fixed in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April 2021) by adding integer casting to limit and offset parameters. Laravel 11.51.0 (released 2024) inherits these fixes from the upstream codebase. Both critical files (SqlServerGrammar.php and Builder.php) conta..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:42:04.797220+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 11.51.0-p4+tuxcare of laravel/framework. Laravel 11.51.0 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability (unexpected query bindings from array inputs) was fixed in upstream Laravel before the 11.51.0 release. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) now use the flattenValue() helper or array_slice() to limit bindings, preventing the vulnerability. The fix was already present when TuxCare took the v11.51.0 snapshot (commit c90d5ed195), requiring no separate backport to this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "Laravel 11.51.0 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability (unexpected query bindings from array inputs) was fixed in upstream Laravel before the 11.51.0 release. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) now use the flattenValue() helper or array_slice() to limit bindings, preventing the vulnerability. The fix was already present when TuxCare took the v11.51.0 snapshot (commit c90d5ed195), requiring no separate backport to this version." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 8.83.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.83.29-p3+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 does not affect this target. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.83.29, released years later, inherited this fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use PHP's hash_equals() for constant-time token comparison at line 77. The TuxCare onbo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 does not affect this target. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.83.29, released years later, inherited this fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use PHP's hash_equals() for constant-time token comparison at line 77. The TuxCare onbo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.83.29-p3+tuxcare of laravel/framework. CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29 via unserialize on untrusted X-XSRF-TOKEN values. The target (Laravel 8.83.29) ships with the upstream fix already present. The defense (static::$serialize = false; static::serialized() returning false) disables automatic unserialization after cookie/CSRF token decryption, preventing PHP object injection attacks. The fix was introduced by Taylor Otwell in upstream patches 240d9046 and c0eb9073 (Aug 2018) and is present in all Laravel 8.x releases. The vulnerable pattern (decrypt with unserialize enabled by default) does not exist in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29 via unserialize on untrusted X-XSRF-TOKEN values. The target (Laravel 8.83.29) ships with the upstream fix already present. The defense (static::$serialize = false; static::serialized() returning false) disables automatic unserialization after cookie/CSRF token decryption, preventing PHP object injection attacks. The fix was introduced by Taylor Otwell in upstream patches 240d9046 and c0eb9073 (Aug 2018) and is present in all Laravel 8.x releases. The vulnerable pattern (decrypt with unserialize enabled by default) does not exist in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.83.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.83.29-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.83.29-p3+tuxcare of laravel/framework. Laravel Framework 8.83.29 is not affected by CVE-2020-19316. The OS command injection vulnerability in the Filesystem::link() function was fixed upstream in May 2019 (commit 44c3feb604) for Laravel 5.8.17. Version 8.83.29 was released much later and already included this fix when it was onboarded into the TuxCare repository. The current code at src/Illuminate/Filesystem/Filesystem.php:337 properly applies escapeshellarg() to both $link and $target parameters before passing them to the exec() function, preventing command injection.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "Laravel Framework 8.83.29 is not affected by CVE-2020-19316. The OS command injection vulnerability in the Filesystem::link() function was fixed upstream in May 2019 (commit 44c3feb604) for Laravel 5.8.17. Version 8.83.29 was released much later and already included this fix when it was onboarded into the TuxCare repository. The current code at src/Illuminate/Filesystem/Filesystem.php:337 properly applies escapeshellarg() to both $link and $target parameters before passing them to the exec() function, preventing command injection." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:41:26.189153+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.83.29-p3+tuxcare of laravel/framework. CVE-2020-24941 does not affect Laravel 8.83.29. The vulnerability (mass assignment bypass via non-column attribute keys) was fixed in Laravel 6.18.35 and 7.24.0 (August 2020). Laravel 8.x was released in September 2020, after the fix, so all 8.x versions including 8.83.29 shipped with the fix already present. The target repository's GuardsAttributes.php contains the complete fix: the isGuardableColumn() method validates attribute keys against actual database columns, and non-column keys are automatically treated as guarded (blocked). This fix came from upstream Laravel, not from a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 does not affect Laravel 8.83.29. The vulnerability (mass assignment bypass via non-column attribute keys) was fixed in Laravel 6.18.35 and 7.24.0 (August 2020). Laravel 8.x was released in September 2020, after the fix, so all 8.x versions including 8.83.29 shipped with the fix already present. The target repository's GuardsAttributes.php contains the complete fix: the isGuardableColumn() method validates attribute keys against actual database columns, and non-column keys are automatically treated as guarded (blocked). This fix came from upstream Laravel, not from a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 8.83.29-p3+tuxcare of laravel/framework. CVE-2021-21263 is not present in laravel/framework 8.83.29-p6+tuxcare. The vulnerability (query binding exploitation via unchecked array inputs) was fixed in upstream Laravel 8.22.1, and the target version 8.83.29 already contains the fix as shipped in the upstream release. The fix uses a flattenValue() helper method that limits array inputs to their first element, preventing unexpected query bindings in where(), whereBetween(), whereDate/Time/Day/Month/Year(), whereJsonLength(), and having() methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "CVE-2021-21263 is not present in laravel/framework 8.83.29-p6+tuxcare. The vulnerability (query binding exploitation via unchecked array inputs) was fixed in upstream Laravel 8.22.1, and the target version 8.83.29 already contains the fix as shipped in the upstream release. The fix uses a flattenValue() helper method that limits array inputs to their first element, preventing unexpected query bindings in where(), whereBetween(), whereDate/Time/Day/Month/Year(), whereJsonLength(), and having() methods." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 8.83.29-p3+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 does not affect this target. The vulnerability (predictable parent placeholder hashes in Blade templates allowing XSS) was fixed by the upstream Laravel team before version 8.83.29 was released. The complete fix\u2014including random per-request salt generation, runtime placeholder creation, and cache invalidation\u2014is present in all three affected files. TuxCare onboarded an already-fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 does not affect this target. The vulnerability (predictable parent placeholder hashes in Blade templates allowing XSS) was fixed by the upstream Laravel team before version 8.83.29 was released. The complete fix\u2014including random per-request salt generation, runtime placeholder creation, and cache invalidation\u2014is present in all three affected files. TuxCare onboarded an already-fi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 8.83.29-p3+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 8.83.29-p3+tuxcare of laravel/framework. CVE-2024-52301 is NOT present in Laravel 8.83.29-p6+tuxcare. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when register_argc_argv is enabled. The fix (checking runningInConsole() before using $_SERVER['argv']) was already present in the upstream code when TuxCare onboarded version 8.83.29 on Aug 25, 2025. The upstream fix was authored by Taylor Otwell and applied to all maintained Laravel branches in November 2024.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "CVE-2024-52301 is NOT present in Laravel 8.83.29-p6+tuxcare. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when register_argc_argv is enabled. The fix (checking runningInConsole() before using $_SERVER['argv']) was already present in the upstream code when TuxCare onboarded version 8.83.29 on Aug 25, 2025. The upstream fix was authored by Taylor Otwell and applied to all maintained Laravel branches in November 2024." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.83.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-09-29T20:27:02.675922+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.83.29-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-102279. The vulnerability exists in the new exception renderer with Tippy.js tooltips (allowHTML: true) introduced in Laravel 12.x. The target version uses Whoops library's PrettyPageHandler for debug exception rendering instead, which does not have Tippy.js or any tooltip system that could be exploited via attacker-controlled HTML content.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-102279. The vulnerability exists in the new exception renderer with Tippy.js tooltips (allowHTML: true) introduced in Laravel 12.x. The target version uses Whoops library's PrettyPageHandler for debug exception rendering instead, which does not have Tippy.js or any tooltip system that could be exploited via attacker-controlled HTML content." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.83.29-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource relationship inclusion processing feature, which was introduced in Laravel 12.x (commit 2f30936319193371fc1ac338d171a5b92be9976de5). This feature is completely absent from Laravel 8.x. The vulnerable code path in ResolvesJsonApiElements.php does not exist in this version. The standard JsonResou...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource relationship inclusion processing feature, which was introduced in Laravel 12.x (commit 2f30936319193371fc1ac338d171a5b92be9976de5). This feature is completely absent from Laravel 8.x. The vulnerable code path in ResolvesJsonApiElements.php does not exist in this version. The standard JsonResou..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T12:27:44.661604+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.83.29-p3+tuxcare of laravel/framework, and is fixed in 8.83.29-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.83.29-p3+tuxcare of laravel/framework, and is fixed in 8.83.29-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:45:27.177095+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 8.83.29-p3+tuxcare of laravel/framework. not_affected \u2014 The SQL injection vulnerability (GHSA-4mg9-vhxq-vm7j) affecting Laravel's SQL Server driver when user input is passed to limit/offset/skip/take functions is NOT present in this target. The vulnerability was fixed in upstream Laravel 8.40.0, and the target version 8.83.29 already contains the fix. Integer casting defenses are present in both Builder.php (lines 2140, 2167) and SqlServerGrammar.ph...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The SQL injection vulnerability (GHSA-4mg9-vhxq-vm7j) affecting Laravel's SQL Server driver when user input is passed to limit/offset/skip/take functions is NOT present in this target. The vulnerability was fixed in upstream Laravel 8.40.0, and the target version 8.83.29 already contains the fix. Integer casting defenses are present in both Builder.php (lines 2140, 2167) and SqlServerGrammar.ph..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.83.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:58:09.118737+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.83.29-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The vulnerable pattern was fixed by upstream Laravel in version 5.6.30 (August 2018), and Laravel 8.83.29 (released September 2022) inherited this fix. The target uses `protected static $serialize = false` to disable PHP object serialization for all cookies, preventing CWE-502 deserialization attacks....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The vulnerable pattern was fixed by upstream Laravel in version 5.6.30 (August 2018), and Laravel 8.83.29 (released September 2022) inherited this fix. The target uses `protected static $serialize = false` to disable PHP object serialization for all cookies, preventing CWE-502 deserialization attacks...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.83.29-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 8.83.29-p6+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability pattern (missing IV length validation in Encrypter::validPayload) is not present in the target. The fix was already included in the upstream Laravel 8.83.29 release when TuxCare onboarded it in August 2025. The IV length validation check (strlen(base64_decode($payload['iv'], true)) === open...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework 8.83.29-p6+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability pattern (missing IV length validation in Encrypter::validPayload) is not present in the target. The fix was already included in the upstream Laravel 8.83.29 release when TuxCare onboarded it in August 2025. The IV length validation check (strlen(base64_decode($payload['iv'], true)) === open..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.83.29-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerable component (LocalFilesystemAdapter with local filesystem signed URL serving) was introduced in Laravel 11.x/12.x and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerable component (LocalFilesystemAdapter with local filesystem signed URL serving) was introduced in Laravel 11.x/12.x and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:13:49.604159+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 8.83.29-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.83.29 is NOT AFFECTED by GHSA-jwvj-pwww-3mj5. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalars. The upstream Laravel 8.83.29 release (November 2024) already contains the complete fix via the flattenValue() method and array flattening+slicing logic applied to all vulnerable methods ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.83.29 is NOT AFFECTED by GHSA-jwvj-pwww-3mj5. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalars. The upstream Laravel 8.83.29 release (November 2024) already contains the complete fix via the flattenValue() method and array flattening+slicing logic applied to all vulnerable methods ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:15:18.533137+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.83.29-p3+tuxcare of laravel/framework. The target Laravel 8.83.29 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The fix replacing predictable SHA1 cookie prefixes with HMAC-keyed prefixes was already present in the upstream Laravel 8.83.29 release when TuxCare onboarded it (commit 838fe2b62d, Aug 2025). The vulnerability was fixed upstream by Taylor Otwell in July 2020. The target code uses CookieValuePrefix::create() with hash_hmac, preventing attackers from forging valid cookie prefixes even with an encryption oracle.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel 8.83.29 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The fix replacing predictable SHA1 cookie prefixes with HMAC-keyed prefixes was already present in the upstream Laravel 8.83.29 release when TuxCare onboarded it (commit 838fe2b62d, Aug 2025). The vulnerability was fixed upstream by Taylor Otwell in July 2020. The target code uses CookieValuePrefix::create() with hash_hmac, preventing attackers from forging valid cookie prefixes even with an encryption oracle." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 8.83.29-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.83.29 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched upstream in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Since version 8.83.29 > 8.40.0, the fix was already present in the upstream release that TuxCare onboarded. All four vulnerable entry points (limit/offset/skip/ta...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.83.29 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched upstream in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Since version 8.83.29 > 8.40.0, the fix was already present in the upstream release that TuxCare onboarded. All four vulnerable entry points (limit/offset/skip/ta..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:41:35.131174+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 8.83.29-p3+tuxcare of laravel/framework. The target Laravel 8.83.29 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involves unexpected query bindings when array values are passed to query builder methods expecting scalars. All affected methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) already use the flattenValue() helper method to extract scalar values from arrays, which provides the same protection as the upstream patches. This fix was already present in the upstream Laravel v8.83.29 release that TuxCare onboarded on 2025-08-25 via commit 838fe2b62d.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "The target Laravel 8.83.29 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involves unexpected query bindings when array values are passed to query builder methods expecting scalars. All affected methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) already use the flattenValue() helper method to extract scalar values from arrays, which provides the same protection as the upstream patches. This fix was already present in the upstream Laravel v8.83.29 release that TuxCare onboarded on 2025-08-25 via commit 838fe2b62d." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab...", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2025-57811 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th...", "vulnerability": { "name": "CVE-2025-57811" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2025-68454 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68454" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-25494 is a false positive for verbb/feed-me 3.1.17-p9+tuxcare. false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron...", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-29113 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n...", "vulnerability": { "name": "CVE-2026-29113" }, "impact_statement": "not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t...", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core...", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra...", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil...", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability.", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-33161 is a false positive for verbb/feed-me 3.1.17-p9+tuxcare. false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase.", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do...", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p9+tuxcare" } } ], "timestamp": "2026-10-16T13:34:00.299914+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.1.17-p9+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 8.83.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.83.29-p2+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 does not affect this target. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.83.29, released years later, inherited this fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use PHP's hash_equals() for constant-time token comparison at line 77. The TuxCare onbo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 does not affect this target. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.83.29, released years later, inherited this fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use PHP's hash_equals() for constant-time token comparison at line 77. The TuxCare onbo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.83.29-p2+tuxcare of laravel/framework. CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29 via unserialize on untrusted X-XSRF-TOKEN values. The target (Laravel 8.83.29) ships with the upstream fix already present. The defense (static::$serialize = false; static::serialized() returning false) disables automatic unserialization after cookie/CSRF token decryption, preventing PHP object injection attacks. The fix was introduced by Taylor Otwell in upstream patches 240d9046 and c0eb9073 (Aug 2018) and is present in all Laravel 8.x releases. The vulnerable pattern (decrypt with unserialize enabled by default) does not exist in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29 via unserialize on untrusted X-XSRF-TOKEN values. The target (Laravel 8.83.29) ships with the upstream fix already present. The defense (static::$serialize = false; static::serialized() returning false) disables automatic unserialization after cookie/CSRF token decryption, preventing PHP object injection attacks. The fix was introduced by Taylor Otwell in upstream patches 240d9046 and c0eb9073 (Aug 2018) and is present in all Laravel 8.x releases. The vulnerable pattern (decrypt with unserialize enabled by default) does not exist in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.83.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.83.29-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.83.29-p2+tuxcare of laravel/framework. Laravel Framework 8.83.29 is not affected by CVE-2020-19316. The OS command injection vulnerability in the Filesystem::link() function was fixed upstream in May 2019 (commit 44c3feb604) for Laravel 5.8.17. Version 8.83.29 was released much later and already included this fix when it was onboarded into the TuxCare repository. The current code at src/Illuminate/Filesystem/Filesystem.php:337 properly applies escapeshellarg() to both $link and $target parameters before passing them to the exec() function, preventing command injection.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "Laravel Framework 8.83.29 is not affected by CVE-2020-19316. The OS command injection vulnerability in the Filesystem::link() function was fixed upstream in May 2019 (commit 44c3feb604) for Laravel 5.8.17. Version 8.83.29 was released much later and already included this fix when it was onboarded into the TuxCare repository. The current code at src/Illuminate/Filesystem/Filesystem.php:337 properly applies escapeshellarg() to both $link and $target parameters before passing them to the exec() function, preventing command injection." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:41:26.189153+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.83.29-p2+tuxcare of laravel/framework. CVE-2020-24941 does not affect Laravel 8.83.29. The vulnerability (mass assignment bypass via non-column attribute keys) was fixed in Laravel 6.18.35 and 7.24.0 (August 2020). Laravel 8.x was released in September 2020, after the fix, so all 8.x versions including 8.83.29 shipped with the fix already present. The target repository's GuardsAttributes.php contains the complete fix: the isGuardableColumn() method validates attribute keys against actual database columns, and non-column keys are automatically treated as guarded (blocked). This fix came from upstream Laravel, not from a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 does not affect Laravel 8.83.29. The vulnerability (mass assignment bypass via non-column attribute keys) was fixed in Laravel 6.18.35 and 7.24.0 (August 2020). Laravel 8.x was released in September 2020, after the fix, so all 8.x versions including 8.83.29 shipped with the fix already present. The target repository's GuardsAttributes.php contains the complete fix: the isGuardableColumn() method validates attribute keys against actual database columns, and non-column keys are automatically treated as guarded (blocked). This fix came from upstream Laravel, not from a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 8.83.29-p2+tuxcare of laravel/framework. CVE-2021-21263 is not present in laravel/framework 8.83.29-p6+tuxcare. The vulnerability (query binding exploitation via unchecked array inputs) was fixed in upstream Laravel 8.22.1, and the target version 8.83.29 already contains the fix as shipped in the upstream release. The fix uses a flattenValue() helper method that limits array inputs to their first element, preventing unexpected query bindings in where(), whereBetween(), whereDate/Time/Day/Month/Year(), whereJsonLength(), and having() methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "CVE-2021-21263 is not present in laravel/framework 8.83.29-p6+tuxcare. The vulnerability (query binding exploitation via unchecked array inputs) was fixed in upstream Laravel 8.22.1, and the target version 8.83.29 already contains the fix as shipped in the upstream release. The fix uses a flattenValue() helper method that limits array inputs to their first element, preventing unexpected query bindings in where(), whereBetween(), whereDate/Time/Day/Month/Year(), whereJsonLength(), and having() methods." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 8.83.29-p2+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 does not affect this target. The vulnerability (predictable parent placeholder hashes in Blade templates allowing XSS) was fixed by the upstream Laravel team before version 8.83.29 was released. The complete fix\u2014including random per-request salt generation, runtime placeholder creation, and cache invalidation\u2014is present in all three affected files. TuxCare onboarded an already-fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 does not affect this target. The vulnerability (predictable parent placeholder hashes in Blade templates allowing XSS) was fixed by the upstream Laravel team before version 8.83.29 was released. The complete fix\u2014including random per-request salt generation, runtime placeholder creation, and cache invalidation\u2014is present in all three affected files. TuxCare onboarded an already-fi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 8.83.29-p2+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 8.83.29-p2+tuxcare of laravel/framework. CVE-2024-52301 is NOT present in Laravel 8.83.29-p6+tuxcare. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when register_argc_argv is enabled. The fix (checking runningInConsole() before using $_SERVER['argv']) was already present in the upstream code when TuxCare onboarded version 8.83.29 on Aug 25, 2025. The upstream fix was authored by Taylor Otwell and applied to all maintained Laravel branches in November 2024.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "CVE-2024-52301 is NOT present in Laravel 8.83.29-p6+tuxcare. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when register_argc_argv is enabled. The fix (checking runningInConsole() before using $_SERVER['argv']) was already present in the upstream code when TuxCare onboarded version 8.83.29 on Aug 25, 2025. The upstream fix was authored by Taylor Otwell and applied to all maintained Laravel branches in November 2024." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.83.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:27:02.675922+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.83.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-102279. The vulnerability exists in the new exception renderer with Tippy.js tooltips (allowHTML: true) introduced in Laravel 12.x. The target version uses Whoops library's PrettyPageHandler for debug exception rendering instead, which does not have Tippy.js or any tooltip system that could be exploited via attacker-controlled HTML content.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-102279. The vulnerability exists in the new exception renderer with Tippy.js tooltips (allowHTML: true) introduced in Laravel 12.x. The target version uses Whoops library's PrettyPageHandler for debug exception rendering instead, which does not have Tippy.js or any tooltip system that could be exploited via attacker-controlled HTML content." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.83.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource relationship inclusion processing feature, which was introduced in Laravel 12.x (commit 2f30936319193371fc1ac338d171a5b92be9976de5). This feature is completely absent from Laravel 8.x. The vulnerable code path in ResolvesJsonApiElements.php does not exist in this version. The standard JsonResou...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource relationship inclusion processing feature, which was introduced in Laravel 12.x (commit 2f30936319193371fc1ac338d171a5b92be9976de5). This feature is completely absent from Laravel 8.x. The vulnerable code path in ResolvesJsonApiElements.php does not exist in this version. The standard JsonResou..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T12:27:44.661604+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.83.29-p2+tuxcare of laravel/framework, and is fixed in 8.83.29-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.83.29-p2+tuxcare of laravel/framework, and is fixed in 8.83.29-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:45:27.177095+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 8.83.29-p2+tuxcare of laravel/framework. not_affected \u2014 The SQL injection vulnerability (GHSA-4mg9-vhxq-vm7j) affecting Laravel's SQL Server driver when user input is passed to limit/offset/skip/take functions is NOT present in this target. The vulnerability was fixed in upstream Laravel 8.40.0, and the target version 8.83.29 already contains the fix. Integer casting defenses are present in both Builder.php (lines 2140, 2167) and SqlServerGrammar.ph...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The SQL injection vulnerability (GHSA-4mg9-vhxq-vm7j) affecting Laravel's SQL Server driver when user input is passed to limit/offset/skip/take functions is NOT present in this target. The vulnerability was fixed in upstream Laravel 8.40.0, and the target version 8.83.29 already contains the fix. Integer casting defenses are present in both Builder.php (lines 2140, 2167) and SqlServerGrammar.ph..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.83.29-p2+tuxcare of laravel/framework, and is fixed in 8.83.29-p3+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.83.29-p2+tuxcare of laravel/framework, and is fixed in 8.83.29-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:58:09.118737+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.83.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The vulnerable pattern was fixed by upstream Laravel in version 5.6.30 (August 2018), and Laravel 8.83.29 (released September 2022) inherited this fix. The target uses `protected static $serialize = false` to disable PHP object serialization for all cookies, preventing CWE-502 deserialization attacks....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The vulnerable pattern was fixed by upstream Laravel in version 5.6.30 (August 2018), and Laravel 8.83.29 (released September 2022) inherited this fix. The target uses `protected static $serialize = false` to disable PHP object serialization for all cookies, preventing CWE-502 deserialization attacks...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.83.29-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 8.83.29-p6+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability pattern (missing IV length validation in Encrypter::validPayload) is not present in the target. The fix was already included in the upstream Laravel 8.83.29 release when TuxCare onboarded it in August 2025. The IV length validation check (strlen(base64_decode($payload['iv'], true)) === open...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework 8.83.29-p6+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability pattern (missing IV length validation in Encrypter::validPayload) is not present in the target. The fix was already included in the upstream Laravel 8.83.29 release when TuxCare onboarded it in August 2025. The IV length validation check (strlen(base64_decode($payload['iv'], true)) === open..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.83.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerable component (LocalFilesystemAdapter with local filesystem signed URL serving) was introduced in Laravel 11.x/12.x and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerable component (LocalFilesystemAdapter with local filesystem signed URL serving) was introduced in Laravel 11.x/12.x and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:13:49.604159+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 8.83.29-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.83.29 is NOT AFFECTED by GHSA-jwvj-pwww-3mj5. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalars. The upstream Laravel 8.83.29 release (November 2024) already contains the complete fix via the flattenValue() method and array flattening+slicing logic applied to all vulnerable methods ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.83.29 is NOT AFFECTED by GHSA-jwvj-pwww-3mj5. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalars. The upstream Laravel 8.83.29 release (November 2024) already contains the complete fix via the flattenValue() method and array flattening+slicing logic applied to all vulnerable methods ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:15:18.533137+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.83.29-p2+tuxcare of laravel/framework. The target Laravel 8.83.29 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The fix replacing predictable SHA1 cookie prefixes with HMAC-keyed prefixes was already present in the upstream Laravel 8.83.29 release when TuxCare onboarded it (commit 838fe2b62d, Aug 2025). The vulnerability was fixed upstream by Taylor Otwell in July 2020. The target code uses CookieValuePrefix::create() with hash_hmac, preventing attackers from forging valid cookie prefixes even with an encryption oracle.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel 8.83.29 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The fix replacing predictable SHA1 cookie prefixes with HMAC-keyed prefixes was already present in the upstream Laravel 8.83.29 release when TuxCare onboarded it (commit 838fe2b62d, Aug 2025). The vulnerability was fixed upstream by Taylor Otwell in July 2020. The target code uses CookieValuePrefix::create() with hash_hmac, preventing attackers from forging valid cookie prefixes even with an encryption oracle." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 8.83.29-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.83.29 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched upstream in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Since version 8.83.29 > 8.40.0, the fix was already present in the upstream release that TuxCare onboarded. All four vulnerable entry points (limit/offset/skip/ta...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.83.29 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched upstream in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Since version 8.83.29 > 8.40.0, the fix was already present in the upstream release that TuxCare onboarded. All four vulnerable entry points (limit/offset/skip/ta..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:41:35.131174+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 8.83.29-p2+tuxcare of laravel/framework. The target Laravel 8.83.29 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involves unexpected query bindings when array values are passed to query builder methods expecting scalars. All affected methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) already use the flattenValue() helper method to extract scalar values from arrays, which provides the same protection as the upstream patches. This fix was already present in the upstream Laravel v8.83.29 release that TuxCare onboarded on 2025-08-25 via commit 838fe2b62d.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "The target Laravel 8.83.29 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involves unexpected query bindings when array values are passed to query builder methods expecting scalars. All affected methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) already use the flattenValue() helper method to extract scalar values from arrays, which provides the same protection as the upstream patches. This fix was already present in the upstream Laravel v8.83.29 release that TuxCare onboarded on 2025-08-25 via commit 838fe2b62d." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T12:27:37.729976+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 8.83.29-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 does not affect this target. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.83.29, released years later, inherited this fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use PHP's hash_equals() for constant-time token comparison at line 77. The TuxCare onbo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 does not affect this target. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.83.29, released years later, inherited this fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use PHP's hash_equals() for constant-time token comparison at line 77. The TuxCare onbo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.83.29-p6+tuxcare of laravel/framework. CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29 via unserialize on untrusted X-XSRF-TOKEN values. The target (Laravel 8.83.29) ships with the upstream fix already present. The defense (static::$serialize = false; static::serialized() returning false) disables automatic unserialization after cookie/CSRF token decryption, preventing PHP object injection attacks. The fix was introduced by Taylor Otwell in upstream patches 240d9046 and c0eb9073 (Aug 2018) and is present in all Laravel 8.x releases. The vulnerable pattern (decrypt with unserialize enabled by default) does not exist in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29 via unserialize on untrusted X-XSRF-TOKEN values. The target (Laravel 8.83.29) ships with the upstream fix already present. The defense (static::$serialize = false; static::serialized() returning false) disables automatic unserialization after cookie/CSRF token decryption, preventing PHP object injection attacks. The fix was introduced by Taylor Otwell in upstream patches 240d9046 and c0eb9073 (Aug 2018) and is present in all Laravel 8.x releases. The vulnerable pattern (decrypt with unserialize enabled by default) does not exist in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.83.29-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.83.29-p6+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.83.29-p6+tuxcare of laravel/framework. Laravel Framework 8.83.29 is not affected by CVE-2020-19316. The OS command injection vulnerability in the Filesystem::link() function was fixed upstream in May 2019 (commit 44c3feb604) for Laravel 5.8.17. Version 8.83.29 was released much later and already included this fix when it was onboarded into the TuxCare repository. The current code at src/Illuminate/Filesystem/Filesystem.php:337 properly applies escapeshellarg() to both $link and $target parameters before passing them to the exec() function, preventing command injection.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "Laravel Framework 8.83.29 is not affected by CVE-2020-19316. The OS command injection vulnerability in the Filesystem::link() function was fixed upstream in May 2019 (commit 44c3feb604) for Laravel 5.8.17. Version 8.83.29 was released much later and already included this fix when it was onboarded into the TuxCare repository. The current code at src/Illuminate/Filesystem/Filesystem.php:337 properly applies escapeshellarg() to both $link and $target parameters before passing them to the exec() function, preventing command injection." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:41:26.189153+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.83.29-p6+tuxcare of laravel/framework. CVE-2020-24941 does not affect Laravel 8.83.29. The vulnerability (mass assignment bypass via non-column attribute keys) was fixed in Laravel 6.18.35 and 7.24.0 (August 2020). Laravel 8.x was released in September 2020, after the fix, so all 8.x versions including 8.83.29 shipped with the fix already present. The target repository's GuardsAttributes.php contains the complete fix: the isGuardableColumn() method validates attribute keys against actual database columns, and non-column keys are automatically treated as guarded (blocked). This fix came from upstream Laravel, not from a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 does not affect Laravel 8.83.29. The vulnerability (mass assignment bypass via non-column attribute keys) was fixed in Laravel 6.18.35 and 7.24.0 (August 2020). Laravel 8.x was released in September 2020, after the fix, so all 8.x versions including 8.83.29 shipped with the fix already present. The target repository's GuardsAttributes.php contains the complete fix: the isGuardableColumn() method validates attribute keys against actual database columns, and non-column keys are automatically treated as guarded (blocked). This fix came from upstream Laravel, not from a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 8.83.29-p6+tuxcare of laravel/framework. CVE-2021-21263 is not present in laravel/framework 8.83.29-p6+tuxcare. The vulnerability (query binding exploitation via unchecked array inputs) was fixed in upstream Laravel 8.22.1, and the target version 8.83.29 already contains the fix as shipped in the upstream release. The fix uses a flattenValue() helper method that limits array inputs to their first element, preventing unexpected query bindings in where(), whereBetween(), whereDate/Time/Day/Month/Year(), whereJsonLength(), and having() methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "CVE-2021-21263 is not present in laravel/framework 8.83.29-p6+tuxcare. The vulnerability (query binding exploitation via unchecked array inputs) was fixed in upstream Laravel 8.22.1, and the target version 8.83.29 already contains the fix as shipped in the upstream release. The fix uses a flattenValue() helper method that limits array inputs to their first element, preventing unexpected query bindings in where(), whereBetween(), whereDate/Time/Day/Month/Year(), whereJsonLength(), and having() methods." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 does not affect this target. The vulnerability (predictable parent placeholder hashes in Blade templates allowing XSS) was fixed by the upstream Laravel team before version 8.83.29 was released. The complete fix\u2014including random per-request salt generation, runtime placeholder creation, and cache invalidation\u2014is present in all three affected files. TuxCare onboarded an already-fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 does not affect this target. The vulnerability (predictable parent placeholder hashes in Blade templates allowing XSS) was fixed by the upstream Laravel team before version 8.83.29 was released. The complete fix\u2014including random per-request salt generation, runtime placeholder creation, and cache invalidation\u2014is present in all three affected files. TuxCare onboarded an already-fi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T12:27:37.729976+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 8.83.29-p6+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 8.83.29-p6+tuxcare of laravel/framework. CVE-2024-52301 is NOT present in Laravel 8.83.29-p6+tuxcare. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when register_argc_argv is enabled. The fix (checking runningInConsole() before using $_SERVER['argv']) was already present in the upstream code when TuxCare onboarded version 8.83.29 on Aug 25, 2025. The upstream fix was authored by Taylor Otwell and applied to all maintained Laravel branches in November 2024.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "CVE-2024-52301 is NOT present in Laravel 8.83.29-p6+tuxcare. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when register_argc_argv is enabled. The fix (checking runningInConsole() before using $_SERVER['argv']) was already present in the upstream code when TuxCare onboarded version 8.83.29 on Aug 25, 2025. The upstream fix was authored by Taylor Otwell and applied to all maintained Laravel branches in November 2024." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T12:27:37.729976+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.83.29-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T12:27:37.729976+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-102279. The vulnerability exists in the new exception renderer with Tippy.js tooltips (allowHTML: true) introduced in Laravel 12.x. The target version uses Whoops library's PrettyPageHandler for debug exception rendering instead, which does not have Tippy.js or any tooltip system that could be exploited via attacker-controlled HTML content.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-102279. The vulnerability exists in the new exception renderer with Tippy.js tooltips (allowHTML: true) introduced in Laravel 12.x. The target version uses Whoops library's PrettyPageHandler for debug exception rendering instead, which does not have Tippy.js or any tooltip system that could be exploited via attacker-controlled HTML content." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource relationship inclusion processing feature, which was introduced in Laravel 12.x (commit 2f30936319193371fc1ac338d171a5b92be9976de5). This feature is completely absent from Laravel 8.x. The vulnerable code path in ResolvesJsonApiElements.php does not exist in this version. The standard JsonResou...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource relationship inclusion processing feature, which was introduced in Laravel 12.x (commit 2f30936319193371fc1ac338d171a5b92be9976de5). This feature is completely absent from Laravel 8.x. The vulnerable code path in ResolvesJsonApiElements.php does not exist in this version. The standard JsonResou..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T12:27:44.661604+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 8.83.29-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T20:45:27.177095+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 The SQL injection vulnerability (GHSA-4mg9-vhxq-vm7j) affecting Laravel's SQL Server driver when user input is passed to limit/offset/skip/take functions is NOT present in this target. The vulnerability was fixed in upstream Laravel 8.40.0, and the target version 8.83.29 already contains the fix. Integer casting defenses are present in both Builder.php (lines 2140, 2167) and SqlServerGrammar.ph...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The SQL injection vulnerability (GHSA-4mg9-vhxq-vm7j) affecting Laravel's SQL Server driver when user input is passed to limit/offset/skip/take functions is NOT present in this target. The vulnerability was fixed in upstream Laravel 8.40.0, and the target version 8.83.29 already contains the fix. Integer casting defenses are present in both Builder.php (lines 2140, 2167) and SqlServerGrammar.ph..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T12:27:37.729976+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.83.29-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T20:58:09.118737+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The vulnerable pattern was fixed by upstream Laravel in version 5.6.30 (August 2018), and Laravel 8.83.29 (released September 2022) inherited this fix. The target uses `protected static $serialize = false` to disable PHP object serialization for all cookies, preventing CWE-502 deserialization attacks....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The vulnerable pattern was fixed by upstream Laravel in version 5.6.30 (August 2018), and Laravel 8.83.29 (released September 2022) inherited this fix. The target uses `protected static $serialize = false` to disable PHP object serialization for all cookies, preventing CWE-502 deserialization attacks...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 8.83.29-p6+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability pattern (missing IV length validation in Encrypter::validPayload) is not present in the target. The fix was already included in the upstream Laravel 8.83.29 release when TuxCare onboarded it in August 2025. The IV length validation check (strlen(base64_decode($payload['iv'], true)) === open...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework 8.83.29-p6+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability pattern (missing IV length validation in Encrypter::validPayload) is not present in the target. The fix was already included in the upstream Laravel 8.83.29 release when TuxCare onboarded it in August 2025. The IV length validation check (strlen(base64_decode($payload['iv'], true)) === open..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T12:27:37.729976+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerable component (LocalFilesystemAdapter with local filesystem signed URL serving) was introduced in Laravel 11.x/12.x and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerable component (LocalFilesystemAdapter with local filesystem signed URL serving) was introduced in Laravel 11.x/12.x and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T21:13:49.604159+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.83.29 is NOT AFFECTED by GHSA-jwvj-pwww-3mj5. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalars. The upstream Laravel 8.83.29 release (November 2024) already contains the complete fix via the flattenValue() method and array flattening+slicing logic applied to all vulnerable methods ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.83.29 is NOT AFFECTED by GHSA-jwvj-pwww-3mj5. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalars. The upstream Laravel 8.83.29 release (November 2024) already contains the complete fix via the flattenValue() method and array flattening+slicing logic applied to all vulnerable methods ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:15:18.533137+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.83.29-p6+tuxcare of laravel/framework. The target Laravel 8.83.29 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The fix replacing predictable SHA1 cookie prefixes with HMAC-keyed prefixes was already present in the upstream Laravel 8.83.29 release when TuxCare onboarded it (commit 838fe2b62d, Aug 2025). The vulnerability was fixed upstream by Taylor Otwell in July 2020. The target code uses CookieValuePrefix::create() with hash_hmac, preventing attackers from forging valid cookie prefixes even with an encryption oracle.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel 8.83.29 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The fix replacing predictable SHA1 cookie prefixes with HMAC-keyed prefixes was already present in the upstream Laravel 8.83.29 release when TuxCare onboarded it (commit 838fe2b62d, Aug 2025). The vulnerability was fixed upstream by Taylor Otwell in July 2020. The target code uses CookieValuePrefix::create() with hash_hmac, preventing attackers from forging valid cookie prefixes even with an encryption oracle." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.83.29 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched upstream in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Since version 8.83.29 > 8.40.0, the fix was already present in the upstream release that TuxCare onboarded. All four vulnerable entry points (limit/offset/skip/ta...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.83.29 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched upstream in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Since version 8.83.29 > 8.40.0, the fix was already present in the upstream release that TuxCare onboarded. All four vulnerable entry points (limit/offset/skip/ta..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:41:35.131174+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 8.83.29-p6+tuxcare of laravel/framework. The target Laravel 8.83.29 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involves unexpected query bindings when array values are passed to query builder methods expecting scalars. All affected methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) already use the flattenValue() helper method to extract scalar values from arrays, which provides the same protection as the upstream patches. This fix was already present in the upstream Laravel v8.83.29 release that TuxCare onboarded on 2025-08-25 via commit 838fe2b62d.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "The target Laravel 8.83.29 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involves unexpected query bindings when array values are passed to query builder methods expecting scalars. All affected methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) already use the flattenValue() helper method to extract scalar values from arrays, which provides the same protection as the upstream patches. This fix was already present in the upstream Laravel v8.83.29 release that TuxCare onboarded on 2025-08-25 via commit 838fe2b62d." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 11.51.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 11.51.0-p1+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel framework version 11.51.0-p4+tuxcare) is NOT AFFECTED by CVE-2017-14775. The vulnerability concerned Laravel versions before 5.5.10 where DatabaseUserProvider and EloquentUserProvider performed variable-time token comparison using database WHERE clauses, allowing timing attacks on remember_me tokens. The fix (constant-time comparison using hash_equals()) was intro...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target repository (Laravel framework version 11.51.0-p4+tuxcare) is NOT AFFECTED by CVE-2017-14775. The vulnerability concerned Laravel versions before 5.5.10 where DatabaseUserProvider and EloquentUserProvider performed variable-time token comparison using database WHERE clauses, allowing timing attacks on remember_me tokens. The fix (constant-time comparison using hash_equals()) was intro..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 11.51.0-p1+tuxcare of laravel/framework. The target Laravel Framework v11.51.0 is NOT affected by CVE-2018-15133. The vulnerability pattern (uncontrolled PHP deserialization of encrypted cookie values) is not present. The upstream Laravel v11.51.0 release includes the security fix (commit 240d904606 by Taylor Otwell) that disables PHP serialization during cookie encryption/decryption operations by default. The EncryptCookies middleware passes serialize=false to all encrypt/decrypt operations, preventing unserialize() from being called on attacker-controlled encrypted cookie data, thus blocking the RCE attack vector.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "The target Laravel Framework v11.51.0 is NOT affected by CVE-2018-15133. The vulnerability pattern (uncontrolled PHP deserialization of encrypted cookie values) is not present. The upstream Laravel v11.51.0 release includes the security fix (commit 240d904606 by Taylor Otwell) that disables PHP serialization during cookie encryption/decryption operations by default. The EncryptCookies middleware passes serialize=false to all encrypt/decrypt operations, preventing unserialize() from being called on attacker-controlled encrypted cookie data, thus blocking the RCE attack vector." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 11.51.0-p1+tuxcare of laravel/framework. Laravel 11.51.0 is not affected by CVE-2019-9081. While the PendingCommand class retains the dangerous __destruct pattern from the vulnerable 5.7.x versions, this class is strictly test-only (part of Illuminate\\Testing namespace, used exclusively in PHPUnit test contexts via InteractsWithConsole trait). Production code never instantiates PendingCommand objects. Although Laravel's session unserialize() calls lack allowed_classes restrictions, exploitation requires compromising session security (APP_KEY) to inject arbitrary serialized data\u2014a separate vulnerability. The attack chain from normal production entry points to arbitrary command execution via PendingCommand is broken by architectural constraints. No CVE-2019-9081 fixes found in git history, indicating upstream Laravel considers this non-exploitable in practice.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "Laravel 11.51.0 is not affected by CVE-2019-9081. While the PendingCommand class retains the dangerous __destruct pattern from the vulnerable 5.7.x versions, this class is strictly test-only (part of Illuminate\\Testing namespace, used exclusively in PHPUnit test contexts via InteractsWithConsole trait). Production code never instantiates PendingCommand objects. Although Laravel's session unserialize() calls lack allowed_classes restrictions, exploitation requires compromising session security (APP_KEY) to inject arbitrary serialized data\u2014a separate vulnerability. The attack chain from normal production entry points to arbitrary command execution via PendingCommand is broken by architectural constraints. No CVE-2019-9081 fixes found in git history, indicating upstream Laravel considers this non-exploitable in practice." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 11.51.0-p1+tuxcare of laravel/framework. CVE-2020-19316 is not present in Laravel Framework v11.51.0. The OS command injection vulnerability in the link() function was fixed by upstream Laravel in version 5.8.17 (commit 44c3feb604, May 2019) by adding escapeshellarg() to both $link and $target parameters. The target version 11.51.0, released in 2024, already includes this fix as part of the upstream release that TuxCare onboarded. Both Windows (mklink) and Unix (ln -s) code paths properly escape shell arguments, preventing command injection.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 is not present in Laravel Framework v11.51.0. The OS command injection vulnerability in the link() function was fixed by upstream Laravel in version 5.8.17 (commit 44c3feb604, May 2019) by adding escapeshellarg() to both $link and $target parameters. The target version 11.51.0, released in 2024, already includes this fix as part of the upstream release that TuxCare onboarded. Both Windows (mklink) and Unix (ln -s) code paths properly escape shell arguments, preventing command injection." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:41:57.354813+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 11.51.0-p1+tuxcare of laravel/framework. CVE-2020-24941: Laravel framework $guarded property bypass via JSON column notation. The target (laravel/framework v11.51.0-p4+tuxcare) is NOT AFFECTED. The vulnerability allowed mass-assignment protection bypass by using attribute names that don't correspond to actual database columns (e.g., `fake_column->nested`). The upstream fix (commit 897d107775, Aug 2020) added isGuardableColumn() validation to reject non-existent column names. This fix shipped in Laravel 6.18.35/7.24.0 and was already present in upstream v11.51.0 when TuxCare created the snapshot (commit c90d5ed195, May 2026). The target contains the complete defense: $guardableColumns property (line 33), isGuardableColumn() method (lines 215-234), and the guard check integration (line 206).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941: Laravel framework $guarded property bypass via JSON column notation. The target (laravel/framework v11.51.0-p4+tuxcare) is NOT AFFECTED. The vulnerability allowed mass-assignment protection bypass by using attribute names that don't correspond to actual database columns (e.g., `fake_column->nested`). The upstream fix (commit 897d107775, Aug 2020) added isGuardableColumn() validation to reject non-existent column names. This fix shipped in Laravel 6.18.35/7.24.0 and was already present in upstream v11.51.0 when TuxCare created the snapshot (commit c90d5ed195, May 2026). The target contains the complete defense: $guardableColumns property (line 33), isGuardableColumn() method (lines 215-234), and the guard check integration (line 206)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 11.51.0-p1+tuxcare of laravel/framework. Laravel 11.51.0 is not affected by CVE-2021-21263. The vulnerable query binding pattern is not present in the target. The upstream Laravel project fixed this vulnerability in versions 6.20.12, 7.30.3, and 8.22.1 (released January 2021). Version 11.51.0 (released years later) already contains comprehensive protections through the `flattenValue()` method and array-limiting logic, which provide equivalent (and stronger) protection than the original security patch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "Laravel 11.51.0 is not affected by CVE-2021-21263. The vulnerable query binding pattern is not present in the target. The upstream Laravel project fixed this vulnerability in versions 6.20.12, 7.30.3, and 8.22.1 (released January 2021). Version 11.51.0 (released years later) already contains comprehensive protections through the `flattenValue()` method and array-limiting logic, which provide equivalent (and stronger) protection than the original security patch." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 11.51.0-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework 11.51.0-p4+tuxcare is NOT affected by CVE-2021-43808. The vulnerability involved predictable parent placeholder hashes in Blade templates enabling XSS attacks by allowing attackers to guess placeholder tokens like ##parent-placeholder-## and inject malicious content. The fix (random salt-based hashing + runtime evaluation) was already present in upstream Laravel 11.51.0 ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel Framework 11.51.0-p4+tuxcare is NOT affected by CVE-2021-43808. The vulnerability involved predictable parent placeholder hashes in Blade templates enabling XSS attacks by allowing attackers to guess placeholder tokens like ##parent-placeholder-## and inject malicious content. The fix (random salt-based hashing + runtime evaluation) was already present in upstream Laravel 11.51.0 ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 11.51.0-p1+tuxcare of laravel/framework. The target Laravel framework v11.51.0 is NOT AFFECTED by CVE-2024-52301. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when PHP's register_argc_argv directive is enabled. The fix (checking runningInConsole() before trusting $_SERVER['argv']) was already present in the upstream Laravel v11.51.0 release (March 26, 2026), which was released after the security patches were created on November 12, 2024. The TuxCare repository onboarded this already-fixed version via snapshot commit c90d5ed195.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target Laravel framework v11.51.0 is NOT AFFECTED by CVE-2024-52301. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when PHP's register_argc_argv directive is enabled. The fix (checking runningInConsole() before trusting $_SERVER['argv']) was already present in the upstream Laravel v11.51.0 release (March 26, 2026), which was released after the security patches were created on November 12, 2024. The TuxCare repository onboarded this already-fixed version via snapshot commit c90d5ed195." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 11.51.0-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 11.51.0-p4+tuxcare is NOT AFFECTED by CVE-2025-27515. The vulnerability (wildcard validation bypass allowing user-crafted array keys to bypass validation rules) was fixed in the upstream Laravel v11.51.0 release before TuxCare onboarded this version. The fix is present in the target at src/Illuminate/Validation/Validator.php lines 875-921, where the validateUsingCustomRule me...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target Laravel 11.51.0-p4+tuxcare is NOT AFFECTED by CVE-2025-27515. The vulnerability (wildcard validation bypass allowing user-crafted array keys to bypass validation rules) was fixed in the upstream Laravel v11.51.0 release before TuxCare onboarded this version. The fix is present in the target at src/Illuminate/Validation/Validator.php lines 875-921, where the validateUsingCustomRule me..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:33:09.068963+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 11.51.0-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-102279. The vulnerability was introduced in Laravel 12.x with a redesigned exception renderer that explicitly set `allowHTML: true` in Tippy.js tooltip configuration. Laravel 11.x uses a different exception renderer architecture that never had this vulnerable pattern. While 11.x does display attacker-controlled data (request headers, route context) in...", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-102279. The vulnerability was introduced in Laravel 12.x with a redesigned exception renderer that explicitly set `allowHTML: true` in Tippy.js tooltip configuration. Laravel 11.x uses a different exception renderer architecture that never had this vulnerable pattern. While 11.x does display attacker-controlled data (request headers, route context) in..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 11.51.0-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-114508. The vulnerable JSON:API resource feature was introduced in Laravel 12.45.0 (December 2025) and does not exist in this version. The entire JsonApi component, including the vulnerable ResolvesJsonApiElements trait that allowed malicious include parameters to trigger destructive database operations like truncate(), is not present in v11.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-114508. The vulnerable JSON:API resource feature was introduced in Laravel 12.45.0 (December 2025) and does not exist in this version. The entire JsonApi component, including the vulnerable ResolvesJsonApiElements trait that allowed malicious include parameters to trigger destructive database operations like truncate(), is not present in v11.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T13:21:38.472678+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 11.51.0-p1+tuxcare of laravel/framework, and is fixed in 11.51.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 11.51.0-p1+tuxcare of laravel/framework, and is fixed in 11.51.0-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 11.51.0-p1+tuxcare of laravel/framework. Already fixed upstream before 11.51.0 (GHSA-4mg9-vhxq-vm7j patched in 6.20.26/7.30.5/8.40.0, upstream commit eaca1cb1cc #37164): Builder::offset()/limit() cast values to int and SqlServerGrammar casts limit/offset. Vendor fix present in laravel/framework v9.52.21+ and 11.51.0; no TuxCare patch needed. Ref PHPELSCVE-990.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "Already fixed upstream before 11.51.0 (GHSA-4mg9-vhxq-vm7j patched in 6.20.26/7.30.5/8.40.0, upstream commit eaca1cb1cc #37164): Builder::offset()/limit() cast values to int and SqlServerGrammar casts limit/offset. Vendor fix present in laravel/framework v9.52.21+ and 11.51.0; no TuxCare patch needed. Ref PHPELSCVE-990." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 11.51.0-p1+tuxcare of laravel/framework, and is fixed in 11.51.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 11.51.0-p1+tuxcare of laravel/framework, and is fixed in 11.51.0-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:02:32.915814+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 11.51.0-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v11.51.0 is NOT affected by GHSA-6jvx-8ch9-j2jr. The vulnerability concerned PHP object deserialization in cookies, which was fixed upstream in Laravel 5.6.30 (August 2018) by disabling serialization for all cookies. Version 11.51.0 (released ~2024) is much newer and inherited this fix from the upstream release. The vulnerable code pattern (cookies encrypted/decrypt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel framework v11.51.0 is NOT affected by GHSA-6jvx-8ch9-j2jr. The vulnerability concerned PHP object deserialization in cookies, which was fixed upstream in Laravel 5.6.30 (August 2018) by disabling serialization for all cookies. Version 11.51.0 (released ~2024) is much newer and inherited this fix from the upstream release. The vulnerable code pattern (cookies encrypted/decrypt..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 11.51.0-p1+tuxcare of laravel/framework. not_affected \u2014 The IV length validation fix for GHSA-7852-w36x-6mf6 is already present in Laravel 11.51.0. The vulnerability was fixed in upstream Laravel in March 2018 (commit 886d261df0 by Taylor Otwell). The fix validates that the base64-decoded IV length matches the expected cipher IV length before decryption, preventing silent failures that could lead to weak type comparison bypasses (false == ''). TuxCa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The IV length validation fix for GHSA-7852-w36x-6mf6 is already present in Laravel 11.51.0. The vulnerability was fixed in upstream Laravel in March 2018 (commit 886d261df0 by Taylor Otwell). The fix validates that the base64-decoded IV length matches the expected cipher IV length before decryption, preventing silent failures that could lead to weak type comparison bypasses (false == ''). TuxCa..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp affects version 11.51.0-p1+tuxcare of laravel/framework, and is fixed in 11.51.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "action_statement": "Vulnerability GHSA-crmm-hgp2-wgrp affects version 11.51.0-p1+tuxcare of laravel/framework, and is fixed in 11.51.0-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:17:24.242406+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 11.51.0-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 11.51.0-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability pattern (unexpected query bindings from array parameters in scalar contexts) is not present because the fix was already included in the upstream Laravel v11.51.0 release. The target contains a `flattenValue()` method (line 4217) that flattens arrays to scalar values before binding, and all ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework 11.51.0-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability pattern (unexpected query bindings from array parameters in scalar contexts) is not present because the fix was already included in the upstream Laravel v11.51.0 release. The target contains a `flattenValue()` method (line 4217) that flattens arrays to scalar values before binding, and all ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:19:00.105438+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 11.51.0-p1+tuxcare of laravel/framework. The target Laravel framework v11.51.0 is NOT vulnerable to GHSA-qm5c-m76r-2hfr. The vulnerable code pattern (plain SHA1 hash for cookie prefixes) is absent. The upstream fix using HMAC-based cookie value prefixes was already present in Laravel 11.51.0 when TuxCare onboarded it. The fix replaces predictable sha1($cookieName.'v2') with hash_hmac('sha1', $cookieName.'v2', $key), preventing attackers from forging valid cookie prefixes even with encryption oracle access.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework v11.51.0 is NOT vulnerable to GHSA-qm5c-m76r-2hfr. The vulnerable code pattern (plain SHA1 hash for cookie prefixes) is absent. The upstream fix using HMAC-based cookie value prefixes was already present in Laravel 11.51.0 when TuxCare onboarded it. The fix replaces predictable sha1($cookieName.'v2') with hash_hmac('sha1', $cookieName.'v2', $key), preventing attackers from forging valid cookie prefixes even with encryption oracle access." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 11.51.0-p1+tuxcare of laravel/framework. not_affected \u2014 Target version 11.51.0 is NOT vulnerable to GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was fixed in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April 2021) by adding integer casting to limit and offset parameters. Laravel 11.51.0 (released 2024) inherits these fixes from the upstream codebase. Both critical files (SqlServerGrammar.php and Builder.php) conta...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Target version 11.51.0 is NOT vulnerable to GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was fixed in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April 2021) by adding integer casting to limit and offset parameters. Laravel 11.51.0 (released 2024) inherits these fixes from the upstream codebase. Both critical files (SqlServerGrammar.php and Builder.php) conta..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:42:04.797220+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 11.51.0-p1+tuxcare of laravel/framework. Laravel 11.51.0 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability (unexpected query bindings from array inputs) was fixed in upstream Laravel before the 11.51.0 release. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) now use the flattenValue() helper or array_slice() to limit bindings, preventing the vulnerability. The fix was already present when TuxCare took the v11.51.0 snapshot (commit c90d5ed195), requiring no separate backport to this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "Laravel 11.51.0 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability (unexpected query bindings from array inputs) was fixed in upstream Laravel before the 11.51.0 release. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) now use the flattenValue() helper or array_slice() to limit bindings, preventing the vulnerability. The fix was already present when TuxCare took the v11.51.0 snapshot (commit c90d5ed195), requiring no separate backport to this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "CVE-2023-33195 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "CVE-2023-33196 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "CVE-2023-33197 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "CVE-2023-41892 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "CVE-2024-41800 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "CVE-2025-23209 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab...", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "not_affected \u2014 CVE-2025-46731 affects Craft CMS core versions 4.x (prior to 4.14.13) and 5.x (prior to 5.6.16). The target repository is the Feed Me plugin (verbb/feed-me) version 3.1.17, which depends on Craft CMS 3.x. The CVE does not mention Craft CMS 3.x as affected. While the plugin does use Twig template rendering via Craft CMS's renderObjectTemplate API with administrator-controlled input, the vulnerab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th...", "vulnerability": { "name": "CVE-2025-57811" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-57811. While the plugin does pass user-controlled feed data to Craft's renderObjectTemplate() method when parseTwig is enabled, the vulnerability only exists in Craft CMS versions 4.x and 5.x. Feed Me v3.1.17 is constrained to run exclusively on Craft CMS 3.x (per composer.json requirement: 'craftcms/cms': '^3.1.0'), which is not affected by th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2025-68436. This vulnerability affects Craft CMS core versions 4.x and 5.x user profile photo functionality, while Feed Me is a plugin for Craft CMS 3.x that does not implement user profile photo management features. Feed Me only provides admin-only bulk import functionality for user data from feeds, which is architecturally different from the indiv..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68454" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2025-68454. The vulnerability targets Craft CMS core features (Settings text fields and System Messages utility) that do not exist in the Feed Me plugin codebase. Feed Me's Twig processing serves a different purpose (processing external feed data) and does not expose the vulnerable attack vector described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "not_affected \u2014 CVE-2025-68455 affects Craft CMS core's Behavior attachment functionality in versions 4.x and 5.x. The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that handles feed imports. Exhaustive analysis confirms the plugin does not implement, use, or interact with Craft's Behavior system. The vulnerability pattern (malicious Behavior attachment leading to RCE) does not apply b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "CVE-2026-25491 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 CVE-2026-25493 targets the saveAsset GraphQL mutation in Craft CMS core versions 4.x and 5.x. This repository is verbb/feed-me v3.1.17, a plugin for Craft CMS 3.x that does not implement or use the vulnerable GraphQL mutation. The specific vulnerable component does not exist in this project." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 is a false positive for verbb/feed-me 3.1.17-p2+tuxcare. false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron...", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "false_positive \u2014 CVE-2026-25494 concerns Craft CMS core (craftcms/cms versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.22), specifically the saveAsset GraphQL mutation. This repository is verbb/feed-me version 3.1.17-p1+tuxcare, a plugin FOR Craft CMS, not Craft CMS itself. The affected component (saveAsset GraphQL mutation with IP validation) does not exist in this plugin's codebase. This is a wron..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17, a Craft CMS plugin) is not affected by CVE-2026-25495. The vulnerability exists in Craft CMS core's element-indexes/get-elements endpoint which processes criteria[orderBy] parameters. This endpoint does not exist in the plugin. While the plugin contains a getFeeds($orderBy) method with a similar unsanitized pattern, it is never exposed to user input..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 Feed Me plugin is not affected by CVE-2026-25496. The vulnerability concerns Craft CMS core's Number field type settings rendering (Prefix/Suffix with |md|raw filter), but Feed Me is a data import plugin that does not implement field settings UI, field rendering, or handle Number field Prefix/Suffix configuration. Feed Me only maps imported data values to existing Craft fields and never process..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "not_affected \u2014 The feed-me plugin v3.1.17 is not affected by CVE-2026-25498. The vulnerability exists in Craft CMS core (v4.0.0-RC1+ and v5.0.0-RC1+) in the assembleLayoutFromPost() function which does not exist in this plugin. While feed-me uses similar object creation functions (ComponentHelper::createComponent), these are only called with hardcoded class names from internal registries, never with user-cont..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Feed Me plugin v3.1.17 is not affected by CVE-2026-27126. The vulnerability exists in Craft CMS core's editableTable.twig component (versions 4.5.0+ and 5.0.0+), which Feed Me does not use, implement, or interact with. Feed Me is a data import plugin that operates at a different architectural layer than the vulnerable admin UI rendering component." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin for importing content from feeds. The CVE-2026-27128 vulnerability exists in Craft CMS core's token validation service (specifically the getTokenRoute() method's TOCTOU race condition). After exhaustive analysis, the plugin's codebase does not implement, use, or interact with Craft CMS's token validation service or impersonatio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n...", "vulnerability": { "name": "CVE-2026-29113" }, "impact_statement": "not_affected \u2014 Feed Me plugin (verbb/feed-me v3.1.17) is not affected by CVE-2026-29113. The vulnerability exists in Craft CMS core's preview token endpoint (/actions/preview/create-token), which is part of the craftcms/cms package. This plugin does not implement, interact with, or depend on the vulnerable preview token creation functionality. The plugin's codebase focuses on feed import operations and does n..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t...", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 CVE-2026-31857 targets Craft CMS core's BaseElementSelectConditionRule class in versions 4.x and 5.x. The target repository is verbb/feed-me plugin v3.1.17, which depends on Craft CMS 3.1.5. The vulnerable conditions system and BaseElementSelectConditionRule class were introduced in Craft CMS 4.0 and do not exist in version 3.x. The plugin does not implement or use condition rules. Therefore, t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core...", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in Craft CMS core's ElementSearchController::actionSearch() endpoint. The target repository (verbb/feed-me v3.1.17) is a Craft CMS plugin, not Craft CMS core itself. The vulnerable endpoint and controller classes (ElementSearchController, ElementIndexesController) do not exist in this plugin's codebase. The vulnerability resides in the core..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The CVE-2026-32262 vulnerability exists in Craft CMS core's AssetsController->replaceFile() method. This repository is verbb/feed-me version 3.1.17, a Craft CMS plugin, not the CMS core itself. The plugin does not implement the vulnerable endpoint or replicate the vulnerable pattern. While the plugin processes filenames from feeds, all filenames are sanitized via AssetsHelper::prepareAssetName(..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "CVE-2026-32263 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra...", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me v3.1.17, a plugin for Craft CMS. CVE-2026-32264 describes a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController, which are core Craft CMS controllers in the craftcms/cms package (versions 4.x and 5.x). This plugin does not contain these controllers, does not implement behavior injection patterns, and its dependency constra..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "not_affected \u2014 CVE-2026-32267 concerns Craft CMS core's UsersController->actionImpersonateWithToken privilege escalation vulnerability. The target repository is verbb/feed-me version 3.1.17, a Craft CMS plugin (not the CMS core itself). The plugin provides feed import functionality and does not contain the affected component (UsersController), does not implement any user impersonation functionality, and does ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "CVE-2026-33051 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil...", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "not_affected \u2014 CVE-2026-33157 affects Craft CMS core (versions 5.6.0 to 5.9.13), specifically ElementIndexesController::actionFilterHud() and FieldLayout::createFromConfig(). The target repository is verbb/feed-me 3.1.17, a Craft CMS plugin that requires craftcms/cms ^3.1.0. The plugin does not contain, invoke, or interact with the vulnerable Craft CMS core components. Type A1 analysis confirms the vulnerabil..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability.", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me plugin v3.1.17) is not affected by CVE-2026-33158. The vulnerability exists in Craft CMS core's assets/edit-image endpoint, which is not implemented by this plugin. The plugin's asset functionality is limited to importing assets from feeds and does not include any asset viewing or editing endpoints that could exhibit the authorization bypass vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 Target repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS core. CVE-2026-33159 concerns Craft CMS's Config Sync feature authentication bypass. This plugin does not implement, extend, or interact with Config Sync functionality." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me (version 3.1.17), a Craft CMS plugin for importing content from feeds. CVE-2026-33160 concerns a vulnerability in Craft CMS core's assets/generate-transform endpoint. This plugin does not implement, extend, or interact with asset transformation functionality. The vulnerable code path exists only in Craft CMS core, not in this plugin repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 is a false positive for verbb/feed-me 3.1.17-p2+tuxcare. false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase.", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "false_positive \u2014 CVE-2026-33161 is a false positive for this repository. The vulnerability concerns Craft CMS core's assets/image-editor endpoint, but this repository is verbb/feed-me (a Craft CMS plugin), not Craft CMS itself. The vulnerable code does not exist in this codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do...", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 The target repository (verbb/feed-me v3.1.17) is a plugin for Craft CMS that provides feed import functionality. The vulnerability CVE-2026-33162 affects the core Craft CMS product (craftcms/cms v5.3.0-5.9.13), specifically the /actions/entries/move-to-section endpoint in the EntriesController. This plugin does not implement, vendor, or bundle this vulnerable component. The plugin's own code do..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details.", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 in craftcms/cms 3.9.15 is not affected. Refer to craftcms/cms 3.9.15 for details." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare", "identifiers": { "purl": "pkg:composer/verbb/feed-me@3.1.17-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.1.17-p2+tuxcare of verbb/feed-me. not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target repository is verbb/feed-me version 3.1.17, a plugin for Craft CMS, not Craft CMS core itself. CVE-2026-41130 affects the resource-js endpoint in Craft CMS core versions 4.x through 4.17.8 and 5.x through 5.9.14. This plugin targets Craft CMS 3.x (^3.1.0) and does not implement the vulnerable resource-js endpoint or any similar functionality that proxies JavaScript resources based on..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-13T11:48:00.136646+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 11.51.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 11.51.0-p3+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel framework version 11.51.0-p4+tuxcare) is NOT AFFECTED by CVE-2017-14775. The vulnerability concerned Laravel versions before 5.5.10 where DatabaseUserProvider and EloquentUserProvider performed variable-time token comparison using database WHERE clauses, allowing timing attacks on remember_me tokens. The fix (constant-time comparison using hash_equals()) was intro...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target repository (Laravel framework version 11.51.0-p4+tuxcare) is NOT AFFECTED by CVE-2017-14775. The vulnerability concerned Laravel versions before 5.5.10 where DatabaseUserProvider and EloquentUserProvider performed variable-time token comparison using database WHERE clauses, allowing timing attacks on remember_me tokens. The fix (constant-time comparison using hash_equals()) was intro..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 11.51.0-p3+tuxcare of laravel/framework. The target Laravel Framework v11.51.0 is NOT affected by CVE-2018-15133. The vulnerability pattern (uncontrolled PHP deserialization of encrypted cookie values) is not present. The upstream Laravel v11.51.0 release includes the security fix (commit 240d904606 by Taylor Otwell) that disables PHP serialization during cookie encryption/decryption operations by default. The EncryptCookies middleware passes serialize=false to all encrypt/decrypt operations, preventing unserialize() from being called on attacker-controlled encrypted cookie data, thus blocking the RCE attack vector.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "The target Laravel Framework v11.51.0 is NOT affected by CVE-2018-15133. The vulnerability pattern (uncontrolled PHP deserialization of encrypted cookie values) is not present. The upstream Laravel v11.51.0 release includes the security fix (commit 240d904606 by Taylor Otwell) that disables PHP serialization during cookie encryption/decryption operations by default. The EncryptCookies middleware passes serialize=false to all encrypt/decrypt operations, preventing unserialize() from being called on attacker-controlled encrypted cookie data, thus blocking the RCE attack vector." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 11.51.0-p3+tuxcare of laravel/framework. Laravel 11.51.0 is not affected by CVE-2019-9081. While the PendingCommand class retains the dangerous __destruct pattern from the vulnerable 5.7.x versions, this class is strictly test-only (part of Illuminate\\Testing namespace, used exclusively in PHPUnit test contexts via InteractsWithConsole trait). Production code never instantiates PendingCommand objects. Although Laravel's session unserialize() calls lack allowed_classes restrictions, exploitation requires compromising session security (APP_KEY) to inject arbitrary serialized data\u2014a separate vulnerability. The attack chain from normal production entry points to arbitrary command execution via PendingCommand is broken by architectural constraints. No CVE-2019-9081 fixes found in git history, indicating upstream Laravel considers this non-exploitable in practice.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "Laravel 11.51.0 is not affected by CVE-2019-9081. While the PendingCommand class retains the dangerous __destruct pattern from the vulnerable 5.7.x versions, this class is strictly test-only (part of Illuminate\\Testing namespace, used exclusively in PHPUnit test contexts via InteractsWithConsole trait). Production code never instantiates PendingCommand objects. Although Laravel's session unserialize() calls lack allowed_classes restrictions, exploitation requires compromising session security (APP_KEY) to inject arbitrary serialized data\u2014a separate vulnerability. The attack chain from normal production entry points to arbitrary command execution via PendingCommand is broken by architectural constraints. No CVE-2019-9081 fixes found in git history, indicating upstream Laravel considers this non-exploitable in practice." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 11.51.0-p3+tuxcare of laravel/framework. CVE-2020-19316 is not present in Laravel Framework v11.51.0. The OS command injection vulnerability in the link() function was fixed by upstream Laravel in version 5.8.17 (commit 44c3feb604, May 2019) by adding escapeshellarg() to both $link and $target parameters. The target version 11.51.0, released in 2024, already includes this fix as part of the upstream release that TuxCare onboarded. Both Windows (mklink) and Unix (ln -s) code paths properly escape shell arguments, preventing command injection.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 is not present in Laravel Framework v11.51.0. The OS command injection vulnerability in the link() function was fixed by upstream Laravel in version 5.8.17 (commit 44c3feb604, May 2019) by adding escapeshellarg() to both $link and $target parameters. The target version 11.51.0, released in 2024, already includes this fix as part of the upstream release that TuxCare onboarded. Both Windows (mklink) and Unix (ln -s) code paths properly escape shell arguments, preventing command injection." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:41:57.354813+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 11.51.0-p3+tuxcare of laravel/framework. CVE-2020-24941: Laravel framework $guarded property bypass via JSON column notation. The target (laravel/framework v11.51.0-p4+tuxcare) is NOT AFFECTED. The vulnerability allowed mass-assignment protection bypass by using attribute names that don't correspond to actual database columns (e.g., `fake_column->nested`). The upstream fix (commit 897d107775, Aug 2020) added isGuardableColumn() validation to reject non-existent column names. This fix shipped in Laravel 6.18.35/7.24.0 and was already present in upstream v11.51.0 when TuxCare created the snapshot (commit c90d5ed195, May 2026). The target contains the complete defense: $guardableColumns property (line 33), isGuardableColumn() method (lines 215-234), and the guard check integration (line 206).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941: Laravel framework $guarded property bypass via JSON column notation. The target (laravel/framework v11.51.0-p4+tuxcare) is NOT AFFECTED. The vulnerability allowed mass-assignment protection bypass by using attribute names that don't correspond to actual database columns (e.g., `fake_column->nested`). The upstream fix (commit 897d107775, Aug 2020) added isGuardableColumn() validation to reject non-existent column names. This fix shipped in Laravel 6.18.35/7.24.0 and was already present in upstream v11.51.0 when TuxCare created the snapshot (commit c90d5ed195, May 2026). The target contains the complete defense: $guardableColumns property (line 33), isGuardableColumn() method (lines 215-234), and the guard check integration (line 206)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 11.51.0-p3+tuxcare of laravel/framework. Laravel 11.51.0 is not affected by CVE-2021-21263. The vulnerable query binding pattern is not present in the target. The upstream Laravel project fixed this vulnerability in versions 6.20.12, 7.30.3, and 8.22.1 (released January 2021). Version 11.51.0 (released years later) already contains comprehensive protections through the `flattenValue()` method and array-limiting logic, which provide equivalent (and stronger) protection than the original security patch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "Laravel 11.51.0 is not affected by CVE-2021-21263. The vulnerable query binding pattern is not present in the target. The upstream Laravel project fixed this vulnerability in versions 6.20.12, 7.30.3, and 8.22.1 (released January 2021). Version 11.51.0 (released years later) already contains comprehensive protections through the `flattenValue()` method and array-limiting logic, which provide equivalent (and stronger) protection than the original security patch." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 11.51.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework 11.51.0-p4+tuxcare is NOT affected by CVE-2021-43808. The vulnerability involved predictable parent placeholder hashes in Blade templates enabling XSS attacks by allowing attackers to guess placeholder tokens like ##parent-placeholder-## and inject malicious content. The fix (random salt-based hashing + runtime evaluation) was already present in upstream Laravel 11.51.0 ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel Framework 11.51.0-p4+tuxcare is NOT affected by CVE-2021-43808. The vulnerability involved predictable parent placeholder hashes in Blade templates enabling XSS attacks by allowing attackers to guess placeholder tokens like ##parent-placeholder-## and inject malicious content. The fix (random salt-based hashing + runtime evaluation) was already present in upstream Laravel 11.51.0 ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 11.51.0-p3+tuxcare of laravel/framework. The target Laravel framework v11.51.0 is NOT AFFECTED by CVE-2024-52301. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when PHP's register_argc_argv directive is enabled. The fix (checking runningInConsole() before trusting $_SERVER['argv']) was already present in the upstream Laravel v11.51.0 release (March 26, 2026), which was released after the security patches were created on November 12, 2024. The TuxCare repository onboarded this already-fixed version via snapshot commit c90d5ed195.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target Laravel framework v11.51.0 is NOT AFFECTED by CVE-2024-52301. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when PHP's register_argc_argv directive is enabled. The fix (checking runningInConsole() before trusting $_SERVER['argv']) was already present in the upstream Laravel v11.51.0 release (March 26, 2026), which was released after the security patches were created on November 12, 2024. The TuxCare repository onboarded this already-fixed version via snapshot commit c90d5ed195." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 11.51.0-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 11.51.0-p4+tuxcare is NOT AFFECTED by CVE-2025-27515. The vulnerability (wildcard validation bypass allowing user-crafted array keys to bypass validation rules) was fixed in the upstream Laravel v11.51.0 release before TuxCare onboarded this version. The fix is present in the target at src/Illuminate/Validation/Validator.php lines 875-921, where the validateUsingCustomRule me...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target Laravel 11.51.0-p4+tuxcare is NOT AFFECTED by CVE-2025-27515. The vulnerability (wildcard validation bypass allowing user-crafted array keys to bypass validation rules) was fixed in the upstream Laravel v11.51.0 release before TuxCare onboarded this version. The fix is present in the target at src/Illuminate/Validation/Validator.php lines 875-921, where the validateUsingCustomRule me..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-13T11:48:00.136646+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 11.51.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-102279. The vulnerability was introduced in Laravel 12.x with a redesigned exception renderer that explicitly set `allowHTML: true` in Tippy.js tooltip configuration. Laravel 11.x uses a different exception renderer architecture that never had this vulnerable pattern. While 11.x does display attacker-controlled data (request headers, route context) in...", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-102279. The vulnerability was introduced in Laravel 12.x with a redesigned exception renderer that explicitly set `allowHTML: true` in Tippy.js tooltip configuration. Laravel 11.x uses a different exception renderer architecture that never had this vulnerable pattern. While 11.x does display attacker-controlled data (request headers, route context) in..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 11.51.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-114508. The vulnerable JSON:API resource feature was introduced in Laravel 12.45.0 (December 2025) and does not exist in this version. The entire JsonApi component, including the vulnerable ResolvesJsonApiElements trait that allowed malicious include parameters to trigger destructive database operations like truncate(), is not present in v11.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 11.51.0 is not affected by CVE-2026-114508. The vulnerable JSON:API resource feature was introduced in Laravel 12.45.0 (December 2025) and does not exist in this version. The entire JsonApi component, including the vulnerable ResolvesJsonApiElements trait that allowed malicious include parameters to trigger destructive database operations like truncate(), is not present in v11.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:21:38.472678+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 11.51.0-p3+tuxcare of laravel/framework, and is fixed in 11.51.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 11.51.0-p3+tuxcare of laravel/framework, and is fixed in 11.51.0-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 11.51.0-p3+tuxcare of laravel/framework. Already fixed upstream before 11.51.0 (GHSA-4mg9-vhxq-vm7j patched in 6.20.26/7.30.5/8.40.0, upstream commit eaca1cb1cc #37164): Builder::offset()/limit() cast values to int and SqlServerGrammar casts limit/offset. Vendor fix present in laravel/framework v9.52.21+ and 11.51.0; no TuxCare patch needed. Ref PHPELSCVE-990.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "Already fixed upstream before 11.51.0 (GHSA-4mg9-vhxq-vm7j patched in 6.20.26/7.30.5/8.40.0, upstream commit eaca1cb1cc #37164): Builder::offset()/limit() cast values to int and SqlServerGrammar casts limit/offset. Vendor fix present in laravel/framework v9.52.21+ and 11.51.0; no TuxCare patch needed. Ref PHPELSCVE-990." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-13T11:48:00.136646+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 11.51.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:02:32.915814+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 11.51.0-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v11.51.0 is NOT affected by GHSA-6jvx-8ch9-j2jr. The vulnerability concerned PHP object deserialization in cookies, which was fixed upstream in Laravel 5.6.30 (August 2018) by disabling serialization for all cookies. Version 11.51.0 (released ~2024) is much newer and inherited this fix from the upstream release. The vulnerable code pattern (cookies encrypted/decrypt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel framework v11.51.0 is NOT affected by GHSA-6jvx-8ch9-j2jr. The vulnerability concerned PHP object deserialization in cookies, which was fixed upstream in Laravel 5.6.30 (August 2018) by disabling serialization for all cookies. Version 11.51.0 (released ~2024) is much newer and inherited this fix from the upstream release. The vulnerable code pattern (cookies encrypted/decrypt..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 11.51.0-p3+tuxcare of laravel/framework. not_affected \u2014 The IV length validation fix for GHSA-7852-w36x-6mf6 is already present in Laravel 11.51.0. The vulnerability was fixed in upstream Laravel in March 2018 (commit 886d261df0 by Taylor Otwell). The fix validates that the base64-decoded IV length matches the expected cipher IV length before decryption, preventing silent failures that could lead to weak type comparison bypasses (false == ''). TuxCa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The IV length validation fix for GHSA-7852-w36x-6mf6 is already present in Laravel 11.51.0. The vulnerability was fixed in upstream Laravel in March 2018 (commit 886d261df0 by Taylor Otwell). The fix validates that the base64-decoded IV length matches the expected cipher IV length before decryption, preventing silent failures that could lead to weak type comparison bypasses (false == ''). TuxCa..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-13T11:48:00.136646+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp is fixed in version 11.51.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:17:24.242406+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 11.51.0-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 11.51.0-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability pattern (unexpected query bindings from array parameters in scalar contexts) is not present because the fix was already included in the upstream Laravel v11.51.0 release. The target contains a `flattenValue()` method (line 4217) that flattens arrays to scalar values before binding, and all ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework 11.51.0-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability pattern (unexpected query bindings from array parameters in scalar contexts) is not present because the fix was already included in the upstream Laravel v11.51.0 release. The target contains a `flattenValue()` method (line 4217) that flattens arrays to scalar values before binding, and all ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:19:00.105438+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 11.51.0-p3+tuxcare of laravel/framework. The target Laravel framework v11.51.0 is NOT vulnerable to GHSA-qm5c-m76r-2hfr. The vulnerable code pattern (plain SHA1 hash for cookie prefixes) is absent. The upstream fix using HMAC-based cookie value prefixes was already present in Laravel 11.51.0 when TuxCare onboarded it. The fix replaces predictable sha1($cookieName.'v2') with hash_hmac('sha1', $cookieName.'v2', $key), preventing attackers from forging valid cookie prefixes even with encryption oracle access.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework v11.51.0 is NOT vulnerable to GHSA-qm5c-m76r-2hfr. The vulnerable code pattern (plain SHA1 hash for cookie prefixes) is absent. The upstream fix using HMAC-based cookie value prefixes was already present in Laravel 11.51.0 when TuxCare onboarded it. The fix replaces predictable sha1($cookieName.'v2') with hash_hmac('sha1', $cookieName.'v2', $key), preventing attackers from forging valid cookie prefixes even with encryption oracle access." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 11.51.0-p3+tuxcare of laravel/framework. not_affected \u2014 Target version 11.51.0 is NOT vulnerable to GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was fixed in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April 2021) by adding integer casting to limit and offset parameters. Laravel 11.51.0 (released 2024) inherits these fixes from the upstream codebase. Both critical files (SqlServerGrammar.php and Builder.php) conta...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Target version 11.51.0 is NOT vulnerable to GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was fixed in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April 2021) by adding integer casting to limit and offset parameters. Laravel 11.51.0 (released 2024) inherits these fixes from the upstream codebase. Both critical files (SqlServerGrammar.php and Builder.php) conta..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.51.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:42:04.797220+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 11.51.0-p3+tuxcare of laravel/framework. Laravel 11.51.0 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability (unexpected query bindings from array inputs) was fixed in upstream Laravel before the 11.51.0 release. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) now use the flattenValue() helper or array_slice() to limit bindings, preventing the vulnerability. The fix was already present when TuxCare took the v11.51.0 snapshot (commit c90d5ed195), requiring no separate backport to this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "Laravel 11.51.0 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability (unexpected query bindings from array inputs) was fixed in upstream Laravel before the 11.51.0 release. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) now use the flattenValue() helper or array_slice() to limit bindings, preventing the vulnerability. The fix was already present when TuxCare took the v11.51.0 snapshot (commit c90d5ed195), requiring no separate backport to this version." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:05:02.010251+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 8.83.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.83.29-p4+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 does not affect this target. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.83.29, released years later, inherited this fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use PHP's hash_equals() for constant-time token comparison at line 77. The TuxCare onbo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 does not affect this target. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.83.29, released years later, inherited this fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use PHP's hash_equals() for constant-time token comparison at line 77. The TuxCare onbo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.83.29-p4+tuxcare of laravel/framework. CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29 via unserialize on untrusted X-XSRF-TOKEN values. The target (Laravel 8.83.29) ships with the upstream fix already present. The defense (static::$serialize = false; static::serialized() returning false) disables automatic unserialization after cookie/CSRF token decryption, preventing PHP object injection attacks. The fix was introduced by Taylor Otwell in upstream patches 240d9046 and c0eb9073 (Aug 2018) and is present in all Laravel 8.x releases. The vulnerable pattern (decrypt with unserialize enabled by default) does not exist in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29 via unserialize on untrusted X-XSRF-TOKEN values. The target (Laravel 8.83.29) ships with the upstream fix already present. The defense (static::$serialize = false; static::serialized() returning false) disables automatic unserialization after cookie/CSRF token decryption, preventing PHP object injection attacks. The fix was introduced by Taylor Otwell in upstream patches 240d9046 and c0eb9073 (Aug 2018) and is present in all Laravel 8.x releases. The vulnerable pattern (decrypt with unserialize enabled by default) does not exist in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.83.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.83.29-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.83.29-p4+tuxcare of laravel/framework. Laravel Framework 8.83.29 is not affected by CVE-2020-19316. The OS command injection vulnerability in the Filesystem::link() function was fixed upstream in May 2019 (commit 44c3feb604) for Laravel 5.8.17. Version 8.83.29 was released much later and already included this fix when it was onboarded into the TuxCare repository. The current code at src/Illuminate/Filesystem/Filesystem.php:337 properly applies escapeshellarg() to both $link and $target parameters before passing them to the exec() function, preventing command injection.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "Laravel Framework 8.83.29 is not affected by CVE-2020-19316. The OS command injection vulnerability in the Filesystem::link() function was fixed upstream in May 2019 (commit 44c3feb604) for Laravel 5.8.17. Version 8.83.29 was released much later and already included this fix when it was onboarded into the TuxCare repository. The current code at src/Illuminate/Filesystem/Filesystem.php:337 properly applies escapeshellarg() to both $link and $target parameters before passing them to the exec() function, preventing command injection." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:41:26.189153+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.83.29-p4+tuxcare of laravel/framework. CVE-2020-24941 does not affect Laravel 8.83.29. The vulnerability (mass assignment bypass via non-column attribute keys) was fixed in Laravel 6.18.35 and 7.24.0 (August 2020). Laravel 8.x was released in September 2020, after the fix, so all 8.x versions including 8.83.29 shipped with the fix already present. The target repository's GuardsAttributes.php contains the complete fix: the isGuardableColumn() method validates attribute keys against actual database columns, and non-column keys are automatically treated as guarded (blocked). This fix came from upstream Laravel, not from a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 does not affect Laravel 8.83.29. The vulnerability (mass assignment bypass via non-column attribute keys) was fixed in Laravel 6.18.35 and 7.24.0 (August 2020). Laravel 8.x was released in September 2020, after the fix, so all 8.x versions including 8.83.29 shipped with the fix already present. The target repository's GuardsAttributes.php contains the complete fix: the isGuardableColumn() method validates attribute keys against actual database columns, and non-column keys are automatically treated as guarded (blocked). This fix came from upstream Laravel, not from a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 8.83.29-p4+tuxcare of laravel/framework. CVE-2021-21263 is not present in laravel/framework 8.83.29-p6+tuxcare. The vulnerability (query binding exploitation via unchecked array inputs) was fixed in upstream Laravel 8.22.1, and the target version 8.83.29 already contains the fix as shipped in the upstream release. The fix uses a flattenValue() helper method that limits array inputs to their first element, preventing unexpected query bindings in where(), whereBetween(), whereDate/Time/Day/Month/Year(), whereJsonLength(), and having() methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "CVE-2021-21263 is not present in laravel/framework 8.83.29-p6+tuxcare. The vulnerability (query binding exploitation via unchecked array inputs) was fixed in upstream Laravel 8.22.1, and the target version 8.83.29 already contains the fix as shipped in the upstream release. The fix uses a flattenValue() helper method that limits array inputs to their first element, preventing unexpected query bindings in where(), whereBetween(), whereDate/Time/Day/Month/Year(), whereJsonLength(), and having() methods." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 8.83.29-p4+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 does not affect this target. The vulnerability (predictable parent placeholder hashes in Blade templates allowing XSS) was fixed by the upstream Laravel team before version 8.83.29 was released. The complete fix\u2014including random per-request salt generation, runtime placeholder creation, and cache invalidation\u2014is present in all three affected files. TuxCare onboarded an already-fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 does not affect this target. The vulnerability (predictable parent placeholder hashes in Blade templates allowing XSS) was fixed by the upstream Laravel team before version 8.83.29 was released. The complete fix\u2014including random per-request salt generation, runtime placeholder creation, and cache invalidation\u2014is present in all three affected files. TuxCare onboarded an already-fi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:05:02.010251+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 8.83.29-p4+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 8.83.29-p4+tuxcare of laravel/framework. CVE-2024-52301 is NOT present in Laravel 8.83.29-p6+tuxcare. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when register_argc_argv is enabled. The fix (checking runningInConsole() before using $_SERVER['argv']) was already present in the upstream code when TuxCare onboarded version 8.83.29 on Aug 25, 2025. The upstream fix was authored by Taylor Otwell and applied to all maintained Laravel branches in November 2024.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "CVE-2024-52301 is NOT present in Laravel 8.83.29-p6+tuxcare. The vulnerability allowed attackers to manipulate the application environment via crafted query strings when register_argc_argv is enabled. The fix (checking runningInConsole() before using $_SERVER['argv']) was already present in the upstream code when TuxCare onboarded version 8.83.29 on Aug 25, 2025. The upstream fix was authored by Taylor Otwell and applied to all maintained Laravel branches in November 2024." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:05:02.010251+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.83.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:05:02.010251+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.83.29-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-102279. The vulnerability exists in the new exception renderer with Tippy.js tooltips (allowHTML: true) introduced in Laravel 12.x. The target version uses Whoops library's PrettyPageHandler for debug exception rendering instead, which does not have Tippy.js or any tooltip system that could be exploited via attacker-controlled HTML content.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-102279. The vulnerability exists in the new exception renderer with Tippy.js tooltips (allowHTML: true) introduced in Laravel 12.x. The target version uses Whoops library's PrettyPageHandler for debug exception rendering instead, which does not have Tippy.js or any tooltip system that could be exploited via attacker-controlled HTML content." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.83.29-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource relationship inclusion processing feature, which was introduced in Laravel 12.x (commit 2f30936319193371fc1ac338d171a5b92be9976de5). This feature is completely absent from Laravel 8.x. The vulnerable code path in ResolvesJsonApiElements.php does not exist in this version. The standard JsonResou...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource relationship inclusion processing feature, which was introduced in Laravel 12.x (commit 2f30936319193371fc1ac338d171a5b92be9976de5). This feature is completely absent from Laravel 8.x. The vulnerable code path in ResolvesJsonApiElements.php does not exist in this version. The standard JsonResou..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T12:27:44.661604+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.83.29-p4+tuxcare of laravel/framework, and is fixed in 8.83.29-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.83.29-p4+tuxcare of laravel/framework, and is fixed in 8.83.29-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:45:27.177095+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 8.83.29-p4+tuxcare of laravel/framework. not_affected \u2014 The SQL injection vulnerability (GHSA-4mg9-vhxq-vm7j) affecting Laravel's SQL Server driver when user input is passed to limit/offset/skip/take functions is NOT present in this target. The vulnerability was fixed in upstream Laravel 8.40.0, and the target version 8.83.29 already contains the fix. Integer casting defenses are present in both Builder.php (lines 2140, 2167) and SqlServerGrammar.ph...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The SQL injection vulnerability (GHSA-4mg9-vhxq-vm7j) affecting Laravel's SQL Server driver when user input is passed to limit/offset/skip/take functions is NOT present in this target. The vulnerability was fixed in upstream Laravel 8.40.0, and the target version 8.83.29 already contains the fix. Integer casting defenses are present in both Builder.php (lines 2140, 2167) and SqlServerGrammar.ph..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:05:02.010251+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.83.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:58:09.118737+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.83.29-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The vulnerable pattern was fixed by upstream Laravel in version 5.6.30 (August 2018), and Laravel 8.83.29 (released September 2022) inherited this fix. The target uses `protected static $serialize = false` to disable PHP object serialization for all cookies, preventing CWE-502 deserialization attacks....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The vulnerable pattern was fixed by upstream Laravel in version 5.6.30 (August 2018), and Laravel 8.83.29 (released September 2022) inherited this fix. The target uses `protected static $serialize = false` to disable PHP object serialization for all cookies, preventing CWE-502 deserialization attacks...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.83.29-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 8.83.29-p6+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability pattern (missing IV length validation in Encrypter::validPayload) is not present in the target. The fix was already included in the upstream Laravel 8.83.29 release when TuxCare onboarded it in August 2025. The IV length validation check (strlen(base64_decode($payload['iv'], true)) === open...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework 8.83.29-p6+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability pattern (missing IV length validation in Encrypter::validPayload) is not present in the target. The fix was already included in the upstream Laravel 8.83.29 release when TuxCare onboarded it in August 2025. The IV length validation check (strlen(base64_decode($payload['iv'], true)) === open..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:05:02.010251+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.83.29-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerable component (LocalFilesystemAdapter with local filesystem signed URL serving) was introduced in Laravel 11.x/12.x and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerable component (LocalFilesystemAdapter with local filesystem signed URL serving) was introduced in Laravel 11.x/12.x and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:13:49.604159+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 8.83.29-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.83.29 is NOT AFFECTED by GHSA-jwvj-pwww-3mj5. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalars. The upstream Laravel 8.83.29 release (November 2024) already contains the complete fix via the flattenValue() method and array flattening+slicing logic applied to all vulnerable methods ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.83.29 is NOT AFFECTED by GHSA-jwvj-pwww-3mj5. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalars. The upstream Laravel 8.83.29 release (November 2024) already contains the complete fix via the flattenValue() method and array flattening+slicing logic applied to all vulnerable methods ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:15:18.533137+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.83.29-p4+tuxcare of laravel/framework. The target Laravel 8.83.29 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The fix replacing predictable SHA1 cookie prefixes with HMAC-keyed prefixes was already present in the upstream Laravel 8.83.29 release when TuxCare onboarded it (commit 838fe2b62d, Aug 2025). The vulnerability was fixed upstream by Taylor Otwell in July 2020. The target code uses CookieValuePrefix::create() with hash_hmac, preventing attackers from forging valid cookie prefixes even with an encryption oracle.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel 8.83.29 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The fix replacing predictable SHA1 cookie prefixes with HMAC-keyed prefixes was already present in the upstream Laravel 8.83.29 release when TuxCare onboarded it (commit 838fe2b62d, Aug 2025). The vulnerability was fixed upstream by Taylor Otwell in July 2020. The target code uses CookieValuePrefix::create() with hash_hmac, preventing attackers from forging valid cookie prefixes even with an encryption oracle." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 8.83.29-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.83.29 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched upstream in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Since version 8.83.29 > 8.40.0, the fix was already present in the upstream release that TuxCare onboarded. All four vulnerable entry points (limit/offset/skip/ta...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.83.29 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched upstream in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Since version 8.83.29 > 8.40.0, the fix was already present in the upstream release that TuxCare onboarded. All four vulnerable entry points (limit/offset/skip/ta..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.83.29-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:41:35.131174+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 8.83.29-p4+tuxcare of laravel/framework. The target Laravel 8.83.29 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involves unexpected query bindings when array values are passed to query builder methods expecting scalars. All affected methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) already use the flattenValue() helper method to extract scalar values from arrays, which provides the same protection as the upstream patches. This fix was already present in the upstream Laravel v8.83.29 release that TuxCare onboarded on 2025-08-25 via commit 838fe2b62d.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "The target Laravel 8.83.29 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involves unexpected query bindings when array values are passed to query builder methods expecting scalars. All affected methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) already use the flattenValue() helper method to extract scalar values from arrays, which provides the same protection as the upstream patches. This fix was already present in the upstream Laravel v8.83.29 release that TuxCare onboarded on 2025-08-25 via commit 838fe2b62d." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2025-46734 does not affect version 2.8.2-p2+tuxcare of league/commonmark. not_affected \u2014 Target version 2.8.2-p4+tuxcare is not affected by CVE-2025-46734. The XSS vulnerability in the Attributes extension was fixed by upstream maintainer Colin O'Dell in commit 43207253 (May 5, 2025), which was included in upstream release 2.7.0. When TuxCare onboarded version 2.8.2 via snapshot commit 9e8d7678 (May 13, 2026), the fix was already present. All three mitigation measures from the CVE ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46734" }, "impact_statement": "not_affected \u2014 Target version 2.8.2-p4+tuxcare is not affected by CVE-2025-46734. The XSS vulnerability in the Attributes extension was fixed by upstream maintainer Colin O'Dell in commit 43207253 (May 5, 2025), which was included in upstream release 2.7.0. When TuxCare onboarded version 2.8.2 via snapshot commit 9e8d7678 (May 13, 2026), the fix was already present. All three mitigation measures from the CVE ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2026-30838 does not affect version 2.8.2-p2+tuxcare of league/commonmark. not_affected \u2014 The target (league/commonmark version 2.8.2) is not affected by CVE-2026-30838. The vulnerability involves a DisallowedRawHtml extension regex bypass allowing XSS via whitespace (newline/tab) between HTML tag names and closing `>`. The vulnerable pattern `[ \\/>]` (matches only space) was fixed upstream in version 2.8.1 by changing to `[\\s\\/>]` (matches all whitespace). The TuxCare snapshot impo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-30838" }, "impact_statement": "not_affected \u2014 The target (league/commonmark version 2.8.2) is not affected by CVE-2026-30838. The vulnerability involves a DisallowedRawHtml extension regex bypass allowing XSS via whitespace (newline/tab) between HTML tag names and closing `>`. The vulnerable pattern `[ \\/>]` (matches only space) was fixed upstream in version 2.8.1 by changing to `[\\s\\/>]` (matches all whitespace). The TuxCare snapshot impo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 2.8.2-p2+tuxcare of league/commonmark. not_affected \u2014 CVE-2026-33347 describes a regex-based allowlist bypass in DomainFilteringAdapter where domains like `youtube.com.evil` could match allowlist entry `youtube.com`, enabling SSRF and XSS attacks. The target (version 2.8.2, SHA 48469075) contains the fixed implementation that uses `parse_url()` for explicit hostname extraction and proper boundary checking via `\\str_ends_with($host, '.' . $domain)`...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "not_affected \u2014 CVE-2026-33347 describes a regex-based allowlist bypass in DomainFilteringAdapter where domains like `youtube.com.evil` could match allowlist entry `youtube.com`, enabling SSRF and XSS attacks. The target (version 2.8.2, SHA 48469075) contains the fixed implementation that uses `parse_url()` for explicit hostname extraction and proper boundary checking via `\\str_ends_with($host, '.' . $domain)`..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71478 is fixed in version 2.8.2-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71478" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71488 is fixed in version 2.8.2-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71488" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 2.8.2-p2+tuxcare of league/commonmark, and is fixed in 2.8.2-p4+tuxcare.", "vulnerability": { "name": "GHSA-3q6v-r5mr-hxv8" }, "action_statement": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 2.8.2-p2+tuxcare of league/commonmark, and is fixed in 2.8.2-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8rr7-cvq3-gmfh affects version 2.8.2-p2+tuxcare of league/commonmark, and is fixed in 2.8.2-p3+tuxcare.", "vulnerability": { "name": "GHSA-8rr7-cvq3-gmfh" }, "action_statement": "Vulnerability GHSA-8rr7-cvq3-gmfh affects version 2.8.2-p2+tuxcare of league/commonmark, and is fixed in 2.8.2-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 2.8.2-p2+tuxcare of league/commonmark, and is fixed in 2.8.2-p4+tuxcare.", "vulnerability": { "name": "GHSA-97jj-33gv-5xf9" }, "action_statement": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 2.8.2-p2+tuxcare of league/commonmark, and is fixed in 2.8.2-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:18:21.473206+00:00", "status_notes": "Vulnerability GHSA-c2pc-g5qf-rfrf does not affect version 2.8.2-p2+tuxcare of league/commonmark. Target version 2.8.2 is NOT vulnerable to GHSA-c2pc-g5qf-rfrf. The advisory states the vulnerability was patched in version 2.6.0, and the target is 2.8.2 > 2.6.0. All required algorithmic defenses against polynomial time complexity are present in the upstream 2.8.2 release that TuxCare onboarded: delimiter stack size limits, openersBottom cache optimization for O(n\u00b2) prevention, memory-limited reference maps, and optimized multibyte handling. The comprehensive pathological test suite covering all referenced CVEs is also present. No TuxCare backport for this GHSA exists; the fixes came with the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c2pc-g5qf-rfrf" }, "impact_statement": "Target version 2.8.2 is NOT vulnerable to GHSA-c2pc-g5qf-rfrf. The advisory states the vulnerability was patched in version 2.6.0, and the target is 2.8.2 > 2.6.0. All required algorithmic defenses against polynomial time complexity are present in the upstream 2.8.2 release that TuxCare onboarded: delimiter stack size limits, openersBottom cache optimization for O(n\u00b2) prevention, memory-limited reference maps, and optimized multibyte handling. The comprehensive pathological test suite covering all referenced CVEs is also present. No TuxCare backport for this GHSA exists; the fixes came with the upstream release." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 2.8.2-p2+tuxcare of league/commonmark, and is fixed in 2.8.2-p3+tuxcare.", "vulnerability": { "name": "GHSA-f8fg-pg57-v4j8" }, "action_statement": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 2.8.2-p2+tuxcare of league/commonmark, and is fixed in 2.8.2-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g2gp-3wwq-f4ph is fixed in version 2.8.2-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-g2gp-3wwq-f4ph" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-j8pm-gj4c-rq4x affects version 2.8.2-p2+tuxcare of league/commonmark, and is fixed in 2.8.2-p3+tuxcare.", "vulnerability": { "name": "GHSA-j8pm-gj4c-rq4x" }, "action_statement": "Vulnerability GHSA-j8pm-gj4c-rq4x affects version 2.8.2-p2+tuxcare of league/commonmark, and is fixed in 2.8.2-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jfm3-95jq-q3rf is fixed in version 2.8.2-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jfm3-95jq-q3rf" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jjv6-8j6v-6j52 affects version 2.8.2-p2+tuxcare of league/commonmark, and is fixed in 2.8.2-p3+tuxcare.", "vulnerability": { "name": "GHSA-jjv6-8j6v-6j52" }, "action_statement": "Vulnerability GHSA-jjv6-8j6v-6j52 affects version 2.8.2-p2+tuxcare of league/commonmark, and is fixed in 2.8.2-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mh25-x5hq-wrqp is fixed in version 2.8.2-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mh25-x5hq-wrqp" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mj63-m3rc-8ppr is fixed in version 2.8.2-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mj63-m3rc-8ppr" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.9.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.9.1-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2022-24775 does not affect version 1.9.1-p2+tuxcare of guzzlehttp/psr7. The target repository at version 1.9.1-p2+tuxcare is NOT affected by CVE-2022-24775. The vulnerability pattern (missing validation of carriage return/newline characters in HTTP headers) is not present because the fix was already included in the upstream 1.9.1 release that TuxCare onboarded. The assertValue() method in src/MessageTrait.php (lines 277-295) validates header values using regex /^[\\x20\\x09\\x21-\\x7E\\x80-\\xFF]*$/D which properly rejects control characters including \\r (0x0D) and \\n (0x0A), preventing HTTP header injection attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-24775" }, "impact_statement": "The target repository at version 1.9.1-p2+tuxcare is NOT affected by CVE-2022-24775. The vulnerability pattern (missing validation of carriage return/newline characters in HTTP headers) is not present because the fix was already included in the upstream 1.9.1 release that TuxCare onboarded. The assertValue() method in src/MessageTrait.php (lines 277-295) validates header values using regex /^[\\x20\\x09\\x21-\\x7E\\x80-\\xFF]*$/D which properly rejects control characters including \\r (0x0D) and \\n (0x0A), preventing HTTP header injection attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.9.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.9.1-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:40:33.053070+00:00", "status_notes": "Vulnerability CVE-2023-29197 does not affect version 1.9.1-p2+tuxcare of guzzlehttp/psr7. not_affected \u2014 The target repository (guzzlehttp/psr7 version 1.9.1-p2+tuxcare) is not affected by CVE-2023-29197. The vulnerability involves improper header validation allowing newline injection in HTTP header names and values. The fix (adding PCRE /D modifier to regex patterns to prevent $ from matching before trailing newlines) was included in upstream release 1.9.1 (April 17, 2023) by Graham Campbell and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-29197" }, "impact_statement": "not_affected \u2014 The target repository (guzzlehttp/psr7 version 1.9.1-p2+tuxcare) is not affected by CVE-2023-29197. The vulnerability involves improper header validation allowing newline injection in HTTP header names and values. The fix (adding PCRE /D modifier to regex patterns to prevent $ from matching before trailing newlines) was included in upstream release 1.9.1 (April 17, 2023) by Graham Campbell and ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.9.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.9.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48998 is fixed in version 1.9.1-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-48998" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.9.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.9.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49214 is fixed in version 1.9.1-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-49214" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.9.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.9.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55766 is fixed in version 1.9.1-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-55766" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.9.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.9.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59882 is fixed in version 1.9.1-p2+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-59882" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-29T05:10:28.546830+00:00", "status_notes": "Vulnerability CVE-2022-25270 does not affect version 9.5.11-p7+tuxcare of drupal/core. not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25270" }, "impact_statement": "not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-11-03T10:12:46.442569+00:00", "status_notes": "Vulnerability CVE-2022-25271 does not affect version 9.5.11-p7+tuxcare of drupal/core. CVE-2022-25271 is NOT present in the target. The vulnerable pattern (allowing user input to overwrite 'value' type form elements) was fixed in upstream Drupal releases SA-CORE-2022-003 (Feb 2022) and SA-CORE-2022-008 (Apr 2022). Drupal 9.5.11 (released Sept 2023) shipped with the comprehensive fix that excludes both 'item' and 'value' type elements from being processed as user input. The target repository's snapshot commit imported this already-fixed upstream version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25271" }, "impact_statement": "CVE-2022-25271 is NOT present in the target. The vulnerable pattern (allowing user input to overwrite 'value' type form elements) was fixed in upstream Drupal releases SA-CORE-2022-003 (Feb 2022) and SA-CORE-2022-008 (Apr 2022). Drupal 9.5.11 (released Sept 2023) shipped with the comprehensive fix that excludes both 'item' and 'value' type elements from being processed as user input. The target repository's snapshot commit imported this already-fixed upstream version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25273 does not affect version 9.5.11-p7+tuxcare of drupal/core. CVE-2022-25273 is not present in Drupal 9.5.11-p7+tuxcare. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-008 (April 2022), and the fix was already included in the Drupal 9.5.11 release (September 2023) that TuxCare later imported. The target code contains the patched version that excludes both 'item' and 'value' type form elements from input processing, preventing attackers from overwriting display-only form element values.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25273" }, "impact_statement": "CVE-2022-25273 is not present in Drupal 9.5.11-p7+tuxcare. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-008 (April 2022), and the fix was already included in the Drupal 9.5.11 release (September 2023) that TuxCare later imported. The target code contains the patched version that excludes both 'item' and 'value' type form elements from input processing, preventing attackers from overwriting display-only form element values." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25275 does not affect version 9.5.11-p7+tuxcare of drupal/core. The target repository (Drupal 9.5.11) is not affected by CVE-2022-25275. The SA-CORE-2022-012 security fix was already present in the upstream Drupal 9.5.11 release when TuxCare created the initial snapshot (commit 8233a54800). All three components of the fix are present: (1) ImageStyleDownloadController.php uses `$is_public` logic with `file_additional_public_schemes` support instead of hardcoded `$scheme == 'private'` check; (2) PublicStream.php has the `getLocalPath()` override that prevents accessing private files via public scheme; (3) system.module implements `system_file_download()` hook for additional public schemes. No TuxCare backport was required for version 9.5.11 (backport e12f4968b6 exists only for 8.9.20). The vulnerable pattern is not present in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25275" }, "impact_statement": "The target repository (Drupal 9.5.11) is not affected by CVE-2022-25275. The SA-CORE-2022-012 security fix was already present in the upstream Drupal 9.5.11 release when TuxCare created the initial snapshot (commit 8233a54800). All three components of the fix are present: (1) ImageStyleDownloadController.php uses `$is_public` logic with `file_additional_public_schemes` support instead of hardcoded `$scheme == 'private'` check; (2) PublicStream.php has the `getLocalPath()` override that prevents accessing private files via public scheme; (3) system.module implements `system_file_download()` hook for additional public schemes. No TuxCare backport was required for version 9.5.11 (backport e12f4968b6 exists only for 8.9.20). The vulnerable pattern is not present in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-29T01:55:18.385525+00:00", "status_notes": "Vulnerability CVE-2022-25276 does not affect version 9.5.11-p7+tuxcare of drupal/core. not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25276" }, "impact_statement": "not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25277 does not affect version 9.5.11-p7+tuxcare of drupal/core. The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25277. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-014 on July 20, 2022, and the fix was already present in the upstream Drupal 9.5.11 release (September 19, 2023) that TuxCare imported via snapshot commit 8233a54800. Both required defenses are present: (1) 'htaccess' added to INSECURE_EXTENSIONS array, and (2) special handling for dot-files that are also insecure extensions (e.g., .htaccess) to prevent bypass when administrators configure htaccess as an allowed extension.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25277" }, "impact_statement": "The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25277. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-014 on July 20, 2022, and the fix was already present in the upstream Drupal 9.5.11 release (September 19, 2023) that TuxCare imported via snapshot commit 8233a54800. Both required defenses are present: (1) 'htaccess' added to INSECURE_EXTENSIONS array, and (2) special handling for dot-files that are also insecure extensions (e.g., .htaccess) to prevent bypass when administrators configure htaccess as an allowed extension." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2022-25278 does not affect version 9.5.11-p7+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25278" }, "impact_statement": "not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2023-5256 does not affect version 9.5.11-p7+tuxcare of drupal/core. The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2023-5256. The vulnerability fix (SA-CORE-2023-006) was already included in the upstream Drupal 9.5.11 release that TuxCare onboarded. The fix prevents sensitive error backtraces from being cached and exposed to unauthorized users by adding two protections: (1) setting cache max-age to 0 when verbose error reporting is enabled, and (2) requiring both 'access site reports' permission AND ERROR_REPORTING_DISPLAY_VERBOSE setting to show backtraces, instead of only checking the permission.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-5256" }, "impact_statement": "The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2023-5256. The vulnerability fix (SA-CORE-2023-006) was already included in the upstream Drupal 9.5.11 release that TuxCare onboarded. The fix prevents sensitive error backtraces from being cached and exposed to unauthorized users by adding two protections: (1) setting cache max-age to 0 when verbose error reporting is enabled, and (2) requiring both 'access site reports' permission AND ERROR_REPORTING_DISPLAY_VERBOSE setting to show backtraces, instead of only checking the permission." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2024-45440 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-45440" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2025-13081 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13081" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2025-13082 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2025-13083 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13083" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2026-108097 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-108097" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2026-108515 does not affect version 9.5.11-p7+tuxcare of drupal/core. not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-108515" }, "impact_statement": "not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability GHSA-6CCV-8FGF-CJPW is fixed in version 9.5.11-p7+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6CCV-8FGF-CJPW" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p7+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p7+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw does not affect version 9.5.11-p7+tuxcare of drupal/core. already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" }, "impact_statement": "already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2025-46734 does not affect version 2.7.1-p1+tuxcare of league/commonmark. not_affected \u2014 CVE-2025-46734 describes an XSS vulnerability in league/commonmark versions 1.5.0 through 2.6.x where the Attributes extension allows injection of malicious JavaScript via event handler attributes like `onerror`. Version 2.7.0 introduced three defenses: (1) blocking attributes starting with `on`, (2) enforcing an attribute allowlist, and (3) making href/src respect `allow_unsafe_links` configur...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46734" }, "impact_statement": "not_affected \u2014 CVE-2025-46734 describes an XSS vulnerability in league/commonmark versions 1.5.0 through 2.6.x where the Attributes extension allows injection of malicious JavaScript via event handler attributes like `onerror`. Version 2.7.0 introduced three defenses: (1) blocking attributes starting with `on`, (2) enforcing an attribute allowlist, and (3) making href/src respect `allow_unsafe_links` configur..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-30838 is fixed in version 2.7.1-p1+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-30838" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 is fixed in version 2.7.1-p1+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-33347" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71478 affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-71478" }, "action_statement": "Vulnerability CVE-2026-71478 affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71488 affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-71488" }, "action_statement": "Vulnerability CVE-2026-71488 affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p4+tuxcare.", "vulnerability": { "name": "GHSA-3q6v-r5mr-hxv8" }, "action_statement": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8rr7-cvq3-gmfh affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare.", "vulnerability": { "name": "GHSA-8rr7-cvq3-gmfh" }, "action_statement": "Vulnerability GHSA-8rr7-cvq3-gmfh affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p4+tuxcare.", "vulnerability": { "name": "GHSA-97jj-33gv-5xf9" }, "action_statement": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:18:21.473206+00:00", "status_notes": "Vulnerability GHSA-c2pc-g5qf-rfrf does not affect version 2.7.1-p1+tuxcare of league/commonmark. Target version 2.7.1 is not affected by GHSA-c2pc-g5qf-rfrf. This CVE was fixed in version 2.6.0 (released 2024-12-07), and the target version 2.7.1 (released 2025-07-20) already includes all the upstream security defenses. The polynomial time complexity vulnerabilities are not present because the necessary rate-limiting mechanisms (max_delimiters_per_line, table/max_autocompleted_cells, URL subdomain limits, reference link expansion limits, and optimized bracket parsing) are all active in the shipped code. These fixes came with the upstream 2.7.1 release that TuxCare onboarded, not from TuxCare backports.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c2pc-g5qf-rfrf" }, "impact_statement": "Target version 2.7.1 is not affected by GHSA-c2pc-g5qf-rfrf. This CVE was fixed in version 2.6.0 (released 2024-12-07), and the target version 2.7.1 (released 2025-07-20) already includes all the upstream security defenses. The polynomial time complexity vulnerabilities are not present because the necessary rate-limiting mechanisms (max_delimiters_per_line, table/max_autocompleted_cells, URL subdomain limits, reference link expansion limits, and optimized bracket parsing) are all active in the shipped code. These fixes came with the upstream 2.7.1 release that TuxCare onboarded, not from TuxCare backports." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare.", "vulnerability": { "name": "GHSA-f8fg-pg57-v4j8" }, "action_statement": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g2gp-3wwq-f4ph affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p2+tuxcare.", "vulnerability": { "name": "GHSA-g2gp-3wwq-f4ph" }, "action_statement": "Vulnerability GHSA-g2gp-3wwq-f4ph affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-j8pm-gj4c-rq4x affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare.", "vulnerability": { "name": "GHSA-j8pm-gj4c-rq4x" }, "action_statement": "Vulnerability GHSA-j8pm-gj4c-rq4x affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jfm3-95jq-q3rf affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p2+tuxcare.", "vulnerability": { "name": "GHSA-jfm3-95jq-q3rf" }, "action_statement": "Vulnerability GHSA-jfm3-95jq-q3rf affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jjv6-8j6v-6j52 affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare.", "vulnerability": { "name": "GHSA-jjv6-8j6v-6j52" }, "action_statement": "Vulnerability GHSA-jjv6-8j6v-6j52 affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mh25-x5hq-wrqp affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p2+tuxcare.", "vulnerability": { "name": "GHSA-mh25-x5hq-wrqp" }, "action_statement": "Vulnerability GHSA-mh25-x5hq-wrqp affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mj63-m3rc-8ppr affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p2+tuxcare.", "vulnerability": { "name": "GHSA-mj63-m3rc-8ppr" }, "action_statement": "Vulnerability GHSA-mj63-m3rc-8ppr affects version 2.7.1-p1+tuxcare of league/commonmark, and is fixed in 2.7.1-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-10-29T05:10:28.546830+00:00", "status_notes": "Vulnerability CVE-2022-25270 does not affect version 9.5.11-p3+tuxcare of drupal/core. not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25270" }, "impact_statement": "not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-11-03T10:12:46.442569+00:00", "status_notes": "Vulnerability CVE-2022-25271 does not affect version 9.5.11-p3+tuxcare of drupal/core. CVE-2022-25271 is NOT present in the target. The vulnerable pattern (allowing user input to overwrite 'value' type form elements) was fixed in upstream Drupal releases SA-CORE-2022-003 (Feb 2022) and SA-CORE-2022-008 (Apr 2022). Drupal 9.5.11 (released Sept 2023) shipped with the comprehensive fix that excludes both 'item' and 'value' type elements from being processed as user input. The target repository's snapshot commit imported this already-fixed upstream version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25271" }, "impact_statement": "CVE-2022-25271 is NOT present in the target. The vulnerable pattern (allowing user input to overwrite 'value' type form elements) was fixed in upstream Drupal releases SA-CORE-2022-003 (Feb 2022) and SA-CORE-2022-008 (Apr 2022). Drupal 9.5.11 (released Sept 2023) shipped with the comprehensive fix that excludes both 'item' and 'value' type elements from being processed as user input. The target repository's snapshot commit imported this already-fixed upstream version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25273 does not affect version 9.5.11-p3+tuxcare of drupal/core. CVE-2022-25273 is not present in Drupal 9.5.11-p7+tuxcare. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-008 (April 2022), and the fix was already included in the Drupal 9.5.11 release (September 2023) that TuxCare later imported. The target code contains the patched version that excludes both 'item' and 'value' type form elements from input processing, preventing attackers from overwriting display-only form element values.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25273" }, "impact_statement": "CVE-2022-25273 is not present in Drupal 9.5.11-p7+tuxcare. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-008 (April 2022), and the fix was already included in the Drupal 9.5.11 release (September 2023) that TuxCare later imported. The target code contains the patched version that excludes both 'item' and 'value' type form elements from input processing, preventing attackers from overwriting display-only form element values." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25275 does not affect version 9.5.11-p3+tuxcare of drupal/core. The target repository (Drupal 9.5.11) is not affected by CVE-2022-25275. The SA-CORE-2022-012 security fix was already present in the upstream Drupal 9.5.11 release when TuxCare created the initial snapshot (commit 8233a54800). All three components of the fix are present: (1) ImageStyleDownloadController.php uses `$is_public` logic with `file_additional_public_schemes` support instead of hardcoded `$scheme == 'private'` check; (2) PublicStream.php has the `getLocalPath()` override that prevents accessing private files via public scheme; (3) system.module implements `system_file_download()` hook for additional public schemes. No TuxCare backport was required for version 9.5.11 (backport e12f4968b6 exists only for 8.9.20). The vulnerable pattern is not present in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25275" }, "impact_statement": "The target repository (Drupal 9.5.11) is not affected by CVE-2022-25275. The SA-CORE-2022-012 security fix was already present in the upstream Drupal 9.5.11 release when TuxCare created the initial snapshot (commit 8233a54800). All three components of the fix are present: (1) ImageStyleDownloadController.php uses `$is_public` logic with `file_additional_public_schemes` support instead of hardcoded `$scheme == 'private'` check; (2) PublicStream.php has the `getLocalPath()` override that prevents accessing private files via public scheme; (3) system.module implements `system_file_download()` hook for additional public schemes. No TuxCare backport was required for version 9.5.11 (backport e12f4968b6 exists only for 8.9.20). The vulnerable pattern is not present in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-10-29T01:55:18.385525+00:00", "status_notes": "Vulnerability CVE-2022-25276 does not affect version 9.5.11-p3+tuxcare of drupal/core. not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25276" }, "impact_statement": "not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25277 does not affect version 9.5.11-p3+tuxcare of drupal/core. The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25277. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-014 on July 20, 2022, and the fix was already present in the upstream Drupal 9.5.11 release (September 19, 2023) that TuxCare imported via snapshot commit 8233a54800. Both required defenses are present: (1) 'htaccess' added to INSECURE_EXTENSIONS array, and (2) special handling for dot-files that are also insecure extensions (e.g., .htaccess) to prevent bypass when administrators configure htaccess as an allowed extension.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25277" }, "impact_statement": "The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25277. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-014 on July 20, 2022, and the fix was already present in the upstream Drupal 9.5.11 release (September 19, 2023) that TuxCare imported via snapshot commit 8233a54800. Both required defenses are present: (1) 'htaccess' added to INSECURE_EXTENSIONS array, and (2) special handling for dot-files that are also insecure extensions (e.g., .htaccess) to prevent bypass when administrators configure htaccess as an allowed extension." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2022-25278 does not affect version 9.5.11-p3+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25278" }, "impact_statement": "not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2023-5256 does not affect version 9.5.11-p3+tuxcare of drupal/core. The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2023-5256. The vulnerability fix (SA-CORE-2023-006) was already included in the upstream Drupal 9.5.11 release that TuxCare onboarded. The fix prevents sensitive error backtraces from being cached and exposed to unauthorized users by adding two protections: (1) setting cache max-age to 0 when verbose error reporting is enabled, and (2) requiring both 'access site reports' permission AND ERROR_REPORTING_DISPLAY_VERBOSE setting to show backtraces, instead of only checking the permission.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-5256" }, "impact_statement": "The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2023-5256. The vulnerability fix (SA-CORE-2023-006) was already included in the upstream Drupal 9.5.11 release that TuxCare onboarded. The fix prevents sensitive error backtraces from being cached and exposed to unauthorized users by adding two protections: (1) setting cache max-age to 0 when verbose error reporting is enabled, and (2) requiring both 'access site reports' permission AND ERROR_REPORTING_DISPLAY_VERBOSE setting to show backtraces, instead of only checking the permission." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45440 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-45440" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13080 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p4+tuxcare.", "vulnerability": { "name": "CVE-2025-13080" }, "action_statement": "Vulnerability CVE-2025-13080 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13081 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13081" }, "action_statement": "Vulnerability CVE-2025-13081 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13082 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13082" }, "action_statement": "Vulnerability CVE-2025-13082 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13083 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13083" }, "action_statement": "Vulnerability CVE-2025-13083 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2026-108097 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-108097" }, "action_statement": "Vulnerability CVE-2026-108097 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-10-16T16:27:00.115201+00:00", "status_notes": "Vulnerability CVE-2026-108515 does not affect version 9.5.11-p3+tuxcare of drupal/core. not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-108515" }, "impact_statement": "not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6366 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-6366" }, "action_statement": "Vulnerability CVE-2026-6366 affects version 9.5.11-p3+tuxcare of drupal/core, and is fixed in 9.5.11-p4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6CCV-8FGF-CJPW is fixed in version 9.5.11-p3+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6CCV-8FGF-CJPW" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p3+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw does not affect version 9.5.11-p3+tuxcare of drupal/core. already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" }, "impact_statement": "already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:18:21.473206+00:00", "status_notes": "Vulnerability CVE-2022-29248 does not affect version 7.10.0-p2+tuxcare of guzzlehttp/guzzle. CVE-2022-29248 (cross-domain cookie leakage) is NOT present in the target. The vulnerability was fixed in upstream Guzzle 7.4.3 (May 2022), and the target is at version 7.10.0 (Aug 2025), which already includes the fix. The domain validation check is present in CookieJar.php:261-263 and the improved matchesDomain method in SetCookie.php:478-486. This is an upstream fix that was already part of the 7.10.0 release when TuxCare onboarded it via snapshot commit 3cfa8e02.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-29248" }, "impact_statement": "CVE-2022-29248 (cross-domain cookie leakage) is NOT present in the target. The vulnerability was fixed in upstream Guzzle 7.4.3 (May 2022), and the target is at version 7.10.0 (Aug 2025), which already includes the fix. The domain validation check is present in CookieJar.php:261-263 and the improved matchesDomain method in SetCookie.php:478-486. This is an upstream fix that was already part of the 7.10.0 release when TuxCare onboarded it via snapshot commit 3cfa8e02." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:18:21.473206+00:00", "status_notes": "Vulnerability CVE-2022-31042 does not affect version 7.10.0-p2+tuxcare of guzzlehttp/guzzle. CVE-2022-31042 is NOT present in guzzlehttp/guzzle 7.10.0. The vulnerability (failure to strip manually-added Cookie headers on cross-origin redirects and HTTPS-to-HTTP downgrades) was fixed in upstream Guzzle 7.4.4. The target version 7.10.0 includes this fix using Psr7\\UriComparator::isCrossOrigin() which provides equivalent protection by stripping both Authorization and Cookie headers when redirecting cross-origin (different host, scheme, or port). The fix came from the upstream 7.10.0 release, not from a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31042" }, "impact_statement": "CVE-2022-31042 is NOT present in guzzlehttp/guzzle 7.10.0. The vulnerability (failure to strip manually-added Cookie headers on cross-origin redirects and HTTPS-to-HTTP downgrades) was fixed in upstream Guzzle 7.4.4. The target version 7.10.0 includes this fix using Psr7\\UriComparator::isCrossOrigin() which provides equivalent protection by stripping both Authorization and Cookie headers when redirecting cross-origin (different host, scheme, or port). The fix came from the upstream 7.10.0 release, not from a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:18:21.473206+00:00", "status_notes": "Vulnerability CVE-2022-31043 does not affect version 7.10.0-p2+tuxcare of guzzlehttp/guzzle. CVE-2022-31043 describes a vulnerability where Authorization headers are not stripped on HTTPS\u2192HTTP redirect downgrades. The target version 7.10.0-p3+tuxcare is not affected because the upstream 7.10.0 release already contains a fix that strips sensitive headers on cross-origin redirects, including scheme changes. The target uses Psr7\\UriComparator::isCrossOrigin() which provides protection equivalent to (and actually more conservative than) the original CVE fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31043" }, "impact_statement": "CVE-2022-31043 describes a vulnerability where Authorization headers are not stripped on HTTPS\u2192HTTP redirect downgrades. The target version 7.10.0-p3+tuxcare is not affected because the upstream 7.10.0 release already contains a fix that strips sensitive headers on cross-origin redirects, including scheme changes. The target uses Psr7\\UriComparator::isCrossOrigin() which provides protection equivalent to (and actually more conservative than) the original CVE fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2022-31090 does not affect version 7.10.0-p2+tuxcare of guzzlehttp/guzzle. Target at 7.10.0-p3+tuxcare is NOT AFFECTED by CVE-2022-31090. The vulnerability required only host-based validation when removing curl authentication options on cross-origin redirects, allowing credential leakage when port or scheme changed. The fix (upstream commit 1dd98b05, Guzzle 7.4.5, June 2022) replaced host-only checking with comprehensive origin validation via Psr7\\UriComparator::isCrossOrigin() that validates host, port, AND scheme. Upstream Guzzle 7.10.0 already contained this fix (7.10.0 > 7.4.5). TuxCare onboarded the fixed upstream 7.10.0, so the vulnerable pattern (host-only checking) is not present in the target. The fix was authored by Graham Campbell (upstream maintainer) and shipped in the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31090" }, "impact_statement": "Target at 7.10.0-p3+tuxcare is NOT AFFECTED by CVE-2022-31090. The vulnerability required only host-based validation when removing curl authentication options on cross-origin redirects, allowing credential leakage when port or scheme changed. The fix (upstream commit 1dd98b05, Guzzle 7.4.5, June 2022) replaced host-only checking with comprehensive origin validation via Psr7\\UriComparator::isCrossOrigin() that validates host, port, AND scheme. Upstream Guzzle 7.10.0 already contained this fix (7.10.0 > 7.4.5). TuxCare onboarded the fixed upstream 7.10.0, so the vulnerable pattern (host-only checking) is not present in the target. The fix was authored by Graham Campbell (upstream maintainer) and shipped in the upstream release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:18:21.473206+00:00", "status_notes": "Vulnerability CVE-2022-31091 does not affect version 7.10.0-p2+tuxcare of guzzlehttp/guzzle. CVE-2022-31091 concerns sensitive header leakage (Authorization, Cookie) when following HTTP redirects to different ports. The vulnerability existed in Guzzle versions prior to 6.5.8 and 7.4.5, where the shouldStripSensitiveHeaders() method only checked for host changes or scheme downgrades, missing port changes. The target repository (guzzlehttp/guzzle version 7.10.0-p3+tuxcare) is NOT AFFECTED because the fix was already present in the upstream Guzzle 7.10.0 release that TuxCare onboarded. The vulnerable code pattern (shouldStripSensitiveHeaders checking only host/scheme) is absent; the fixed code uses Psr7\\UriComparator::isCrossOrigin() which properly treats port changes as cross-origin. The fix was authored by Graham Campbell in upstream Guzzle 7.4.5 (June 2022) and shipped in all subsequent releases including 7.10.0.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31091" }, "impact_statement": "CVE-2022-31091 concerns sensitive header leakage (Authorization, Cookie) when following HTTP redirects to different ports. The vulnerability existed in Guzzle versions prior to 6.5.8 and 7.4.5, where the shouldStripSensitiveHeaders() method only checked for host changes or scheme downgrades, missing port changes. The target repository (guzzlehttp/guzzle version 7.10.0-p3+tuxcare) is NOT AFFECTED because the fix was already present in the upstream Guzzle 7.10.0 release that TuxCare onboarded. The vulnerable code pattern (shouldStripSensitiveHeaders checking only host/scheme) is absent; the fixed code uses Psr7\\UriComparator::isCrossOrigin() which properly treats port changes as cross-origin. The fix was authored by Graham Campbell in upstream Guzzle 7.4.5 (June 2022) and shipped in all subsequent releases including 7.10.0." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55568 is fixed in version 7.10.0-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55568" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55767 is fixed in version 7.10.0-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55767" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59883 is fixed in version 7.10.0-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-59883" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67339 is fixed in version 7.10.0-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67339" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67353 is fixed in version 7.10.0-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67353" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67354 is fixed in version 7.10.0-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67354" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67355 is fixed in version 7.10.0-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67355" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69245 affects version 7.10.0-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-69245" }, "action_statement": "Vulnerability CVE-2026-69245 affects version 7.10.0-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69246 affects version 7.10.0-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-69246" }, "action_statement": "Vulnerability CVE-2026-69246 affects version 7.10.0-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 7.10.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 7.10.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w is fixed in version 7.10.0-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 is fixed in version 7.10.0-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 is fixed in version 7.10.0-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 7.10.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 7.10.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 is fixed in version 7.10.0-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2025-46734 does not affect version 2.7.1-p4+tuxcare of league/commonmark. not_affected \u2014 CVE-2025-46734 describes an XSS vulnerability in league/commonmark versions 1.5.0 through 2.6.x where the Attributes extension allows injection of malicious JavaScript via event handler attributes like `onerror`. Version 2.7.0 introduced three defenses: (1) blocking attributes starting with `on`, (2) enforcing an attribute allowlist, and (3) making href/src respect `allow_unsafe_links` configur...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46734" }, "impact_statement": "not_affected \u2014 CVE-2025-46734 describes an XSS vulnerability in league/commonmark versions 1.5.0 through 2.6.x where the Attributes extension allows injection of malicious JavaScript via event handler attributes like `onerror`. Version 2.7.0 introduced three defenses: (1) blocking attributes starting with `on`, (2) enforcing an attribute allowlist, and (3) making href/src respect `allow_unsafe_links` configur..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability CVE-2026-30838 is fixed in version 2.7.1-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-30838" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability CVE-2026-33347 is fixed in version 2.7.1-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-33347" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability CVE-2026-71478 is fixed in version 2.7.1-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71478" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability CVE-2026-71488 is fixed in version 2.7.1-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71488" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-3q6v-r5mr-hxv8 is fixed in version 2.7.1-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-3q6v-r5mr-hxv8" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-8rr7-cvq3-gmfh is fixed in version 2.7.1-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-8rr7-cvq3-gmfh" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-97jj-33gv-5xf9 is fixed in version 2.7.1-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-97jj-33gv-5xf9" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-11-03T10:18:21.473206+00:00", "status_notes": "Vulnerability GHSA-c2pc-g5qf-rfrf does not affect version 2.7.1-p4+tuxcare of league/commonmark. Target version 2.7.1 is not affected by GHSA-c2pc-g5qf-rfrf. This CVE was fixed in version 2.6.0 (released 2024-12-07), and the target version 2.7.1 (released 2025-07-20) already includes all the upstream security defenses. The polynomial time complexity vulnerabilities are not present because the necessary rate-limiting mechanisms (max_delimiters_per_line, table/max_autocompleted_cells, URL subdomain limits, reference link expansion limits, and optimized bracket parsing) are all active in the shipped code. These fixes came with the upstream 2.7.1 release that TuxCare onboarded, not from TuxCare backports.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c2pc-g5qf-rfrf" }, "impact_statement": "Target version 2.7.1 is not affected by GHSA-c2pc-g5qf-rfrf. This CVE was fixed in version 2.6.0 (released 2024-12-07), and the target version 2.7.1 (released 2025-07-20) already includes all the upstream security defenses. The polynomial time complexity vulnerabilities are not present because the necessary rate-limiting mechanisms (max_delimiters_per_line, table/max_autocompleted_cells, URL subdomain limits, reference link expansion limits, and optimized bracket parsing) are all active in the shipped code. These fixes came with the upstream 2.7.1 release that TuxCare onboarded, not from TuxCare backports." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-f8fg-pg57-v4j8 is fixed in version 2.7.1-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-f8fg-pg57-v4j8" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-g2gp-3wwq-f4ph is fixed in version 2.7.1-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-g2gp-3wwq-f4ph" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-j8pm-gj4c-rq4x is fixed in version 2.7.1-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-j8pm-gj4c-rq4x" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-jfm3-95jq-q3rf is fixed in version 2.7.1-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jfm3-95jq-q3rf" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-jjv6-8j6v-6j52 is fixed in version 2.7.1-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jjv6-8j6v-6j52" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-mh25-x5hq-wrqp is fixed in version 2.7.1-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mh25-x5hq-wrqp" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-mj63-m3rc-8ppr is fixed in version 2.7.1-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mj63-m3rc-8ppr" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:18:21.473206+00:00", "status_notes": "Vulnerability CVE-2022-29248 does not affect version 7.10.0-p1+tuxcare of guzzlehttp/guzzle. CVE-2022-29248 (cross-domain cookie leakage) is NOT present in the target. The vulnerability was fixed in upstream Guzzle 7.4.3 (May 2022), and the target is at version 7.10.0 (Aug 2025), which already includes the fix. The domain validation check is present in CookieJar.php:261-263 and the improved matchesDomain method in SetCookie.php:478-486. This is an upstream fix that was already part of the 7.10.0 release when TuxCare onboarded it via snapshot commit 3cfa8e02.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-29248" }, "impact_statement": "CVE-2022-29248 (cross-domain cookie leakage) is NOT present in the target. The vulnerability was fixed in upstream Guzzle 7.4.3 (May 2022), and the target is at version 7.10.0 (Aug 2025), which already includes the fix. The domain validation check is present in CookieJar.php:261-263 and the improved matchesDomain method in SetCookie.php:478-486. This is an upstream fix that was already part of the 7.10.0 release when TuxCare onboarded it via snapshot commit 3cfa8e02." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:18:21.473206+00:00", "status_notes": "Vulnerability CVE-2022-31042 does not affect version 7.10.0-p1+tuxcare of guzzlehttp/guzzle. CVE-2022-31042 is NOT present in guzzlehttp/guzzle 7.10.0. The vulnerability (failure to strip manually-added Cookie headers on cross-origin redirects and HTTPS-to-HTTP downgrades) was fixed in upstream Guzzle 7.4.4. The target version 7.10.0 includes this fix using Psr7\\UriComparator::isCrossOrigin() which provides equivalent protection by stripping both Authorization and Cookie headers when redirecting cross-origin (different host, scheme, or port). The fix came from the upstream 7.10.0 release, not from a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31042" }, "impact_statement": "CVE-2022-31042 is NOT present in guzzlehttp/guzzle 7.10.0. The vulnerability (failure to strip manually-added Cookie headers on cross-origin redirects and HTTPS-to-HTTP downgrades) was fixed in upstream Guzzle 7.4.4. The target version 7.10.0 includes this fix using Psr7\\UriComparator::isCrossOrigin() which provides equivalent protection by stripping both Authorization and Cookie headers when redirecting cross-origin (different host, scheme, or port). The fix came from the upstream 7.10.0 release, not from a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:18:21.473206+00:00", "status_notes": "Vulnerability CVE-2022-31043 does not affect version 7.10.0-p1+tuxcare of guzzlehttp/guzzle. CVE-2022-31043 describes a vulnerability where Authorization headers are not stripped on HTTPS\u2192HTTP redirect downgrades. The target version 7.10.0-p3+tuxcare is not affected because the upstream 7.10.0 release already contains a fix that strips sensitive headers on cross-origin redirects, including scheme changes. The target uses Psr7\\UriComparator::isCrossOrigin() which provides protection equivalent to (and actually more conservative than) the original CVE fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31043" }, "impact_statement": "CVE-2022-31043 describes a vulnerability where Authorization headers are not stripped on HTTPS\u2192HTTP redirect downgrades. The target version 7.10.0-p3+tuxcare is not affected because the upstream 7.10.0 release already contains a fix that strips sensitive headers on cross-origin redirects, including scheme changes. The target uses Psr7\\UriComparator::isCrossOrigin() which provides protection equivalent to (and actually more conservative than) the original CVE fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2022-31090 does not affect version 7.10.0-p1+tuxcare of guzzlehttp/guzzle. Target at 7.10.0-p3+tuxcare is NOT AFFECTED by CVE-2022-31090. The vulnerability required only host-based validation when removing curl authentication options on cross-origin redirects, allowing credential leakage when port or scheme changed. The fix (upstream commit 1dd98b05, Guzzle 7.4.5, June 2022) replaced host-only checking with comprehensive origin validation via Psr7\\UriComparator::isCrossOrigin() that validates host, port, AND scheme. Upstream Guzzle 7.10.0 already contained this fix (7.10.0 > 7.4.5). TuxCare onboarded the fixed upstream 7.10.0, so the vulnerable pattern (host-only checking) is not present in the target. The fix was authored by Graham Campbell (upstream maintainer) and shipped in the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31090" }, "impact_statement": "Target at 7.10.0-p3+tuxcare is NOT AFFECTED by CVE-2022-31090. The vulnerability required only host-based validation when removing curl authentication options on cross-origin redirects, allowing credential leakage when port or scheme changed. The fix (upstream commit 1dd98b05, Guzzle 7.4.5, June 2022) replaced host-only checking with comprehensive origin validation via Psr7\\UriComparator::isCrossOrigin() that validates host, port, AND scheme. Upstream Guzzle 7.10.0 already contained this fix (7.10.0 > 7.4.5). TuxCare onboarded the fixed upstream 7.10.0, so the vulnerable pattern (host-only checking) is not present in the target. The fix was authored by Graham Campbell (upstream maintainer) and shipped in the upstream release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:18:21.473206+00:00", "status_notes": "Vulnerability CVE-2022-31091 does not affect version 7.10.0-p1+tuxcare of guzzlehttp/guzzle. CVE-2022-31091 concerns sensitive header leakage (Authorization, Cookie) when following HTTP redirects to different ports. The vulnerability existed in Guzzle versions prior to 6.5.8 and 7.4.5, where the shouldStripSensitiveHeaders() method only checked for host changes or scheme downgrades, missing port changes. The target repository (guzzlehttp/guzzle version 7.10.0-p3+tuxcare) is NOT AFFECTED because the fix was already present in the upstream Guzzle 7.10.0 release that TuxCare onboarded. The vulnerable code pattern (shouldStripSensitiveHeaders checking only host/scheme) is absent; the fixed code uses Psr7\\UriComparator::isCrossOrigin() which properly treats port changes as cross-origin. The fix was authored by Graham Campbell in upstream Guzzle 7.4.5 (June 2022) and shipped in all subsequent releases including 7.10.0.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31091" }, "impact_statement": "CVE-2022-31091 concerns sensitive header leakage (Authorization, Cookie) when following HTTP redirects to different ports. The vulnerability existed in Guzzle versions prior to 6.5.8 and 7.4.5, where the shouldStripSensitiveHeaders() method only checked for host changes or scheme downgrades, missing port changes. The target repository (guzzlehttp/guzzle version 7.10.0-p3+tuxcare) is NOT AFFECTED because the fix was already present in the upstream Guzzle 7.10.0 release that TuxCare onboarded. The vulnerable code pattern (shouldStripSensitiveHeaders checking only host/scheme) is absent; the fixed code uses Psr7\\UriComparator::isCrossOrigin() which properly treats port changes as cross-origin. The fix was authored by Graham Campbell in upstream Guzzle 7.4.5 (June 2022) and shipped in all subsequent releases including 7.10.0." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55568 is fixed in version 7.10.0-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55568" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55767 is fixed in version 7.10.0-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55767" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59883 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-59883" }, "action_statement": "Vulnerability CVE-2026-59883 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67339 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-67339" }, "action_statement": "Vulnerability CVE-2026-67339 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67353 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-67353" }, "action_statement": "Vulnerability CVE-2026-67353 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67354 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-67354" }, "action_statement": "Vulnerability CVE-2026-67354 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67355 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-67355" }, "action_statement": "Vulnerability CVE-2026-67355 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69245 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-69245" }, "action_statement": "Vulnerability CVE-2026-69245 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69246 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-69246" }, "action_statement": "Vulnerability CVE-2026-69246 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 7.10.0-p1+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 7.10.0-p1+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" }, "action_statement": "Vulnerability GHSA-94pj-82f3-465w affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" }, "action_statement": "Vulnerability GHSA-f283-ghqc-fg79 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" }, "action_statement": "Vulnerability GHSA-h95v-h523-3mw8 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 7.10.0-p1+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 7.10.0-p1+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" }, "action_statement": "Vulnerability GHSA-wm3w-8rrp-j577 affects version 7.10.0-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.10.0-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-29T05:10:28.546830+00:00", "status_notes": "Vulnerability CVE-2022-25270 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal core version 10.5.12 is NOT affected by CVE-2022-25270. The vulnerability exists in the Quick Edit module's MetadataGenerator class, which fails to perform proper access checks before exposing entity labels. However, the Quick Edit module was completely removed from Drupal core in version 10.0.0-beta1 (August 2022), which is well before the target version 10.5.12. The vulnerab...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25270" }, "impact_statement": "not_affected \u2014 The target Drupal core version 10.5.12 is NOT affected by CVE-2022-25270. The vulnerability exists in the Quick Edit module's MetadataGenerator class, which fails to perform proper access checks before exposing entity labels. However, the Quick Edit module was completely removed from Drupal core in version 10.0.0-beta1 (August 2022), which is well before the target version 10.5.12. The vulnerab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:12:46.442569+00:00", "status_notes": "Vulnerability CVE-2022-25271 does not affect version 10.5.12-p1+tuxcare of drupal/core. CVE-2022-25271 is NOT present in drupal/core 10.5.12-p2+tuxcare. The vulnerable code pattern (missing type check for 'value' form elements) was fixed in the upstream Drupal release before version 10.5.12 was published. The target code contains an enhanced version of the fix that checks `!in_array($element['#type'], ['item', 'value'], TRUE)` before processing form input, preventing attackers from overwriting protected 'value' and 'item' type form elements. This fix was included in the upstream Drupal 10.5.12 release that TuxCare onboarded in July 2026.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25271" }, "impact_statement": "CVE-2022-25271 is NOT present in drupal/core 10.5.12-p2+tuxcare. The vulnerable code pattern (missing type check for 'value' form elements) was fixed in the upstream Drupal release before version 10.5.12 was published. The target code contains an enhanced version of the fix that checks `!in_array($element['#type'], ['item', 'value'], TRUE)` before processing form input, preventing attackers from overwriting protected 'value' and 'item' type form elements. This fix was included in the upstream Drupal 10.5.12 release that TuxCare onboarded in July 2026." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25273 does not affect version 10.5.12-p1+tuxcare of drupal/core. Target Drupal 10.5.12 includes the upstream fix for CVE-2022-25273/SA-CORE-2022-008. The vulnerable code pattern (checking only `$element['#type'] !== 'value'`) is not present. The target has the fixed pattern at FormBuilder.php:1225 that excludes both 'item' and 'value' types from input processing: `!in_array($element['#type'], ['item', 'value'], TRUE)`. This prevents attackers from injecting values into display-only form elements. The fix was included in upstream Drupal 10.5.12 when it was released, and was imported via TuxCare's onboarding snapshot commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25273" }, "impact_statement": "Target Drupal 10.5.12 includes the upstream fix for CVE-2022-25273/SA-CORE-2022-008. The vulnerable code pattern (checking only `$element['#type'] !== 'value'`) is not present. The target has the fixed pattern at FormBuilder.php:1225 that excludes both 'item' and 'value' types from input processing: `!in_array($element['#type'], ['item', 'value'], TRUE)`. This prevents attackers from injecting values into display-only form elements. The fix was included in upstream Drupal 10.5.12 when it was released, and was imported via TuxCare's onboarding snapshot commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25275 does not affect version 10.5.12-p1+tuxcare of drupal/core. CVE-2022-25275 is not present in Drupal 10.5.12-p2+tuxcare. The fix for SA-CORE-2022-012 (released July 2022) was already included in the upstream Drupal 10.5.12 release. All three defensive mechanisms from the security patch are present: (1) ImageStyleDownloadController properly determines public vs non-public schemes and invokes access control hooks for non-public schemes, (2) PublicStream prevents path confusion where public:// URIs resolve to private directories, and (3) system_file_download grants access to additional public schemes. The fix was onboarded via snapshot commit b5de532105c by bashebr@cloudlinux.com on 2026-07-16.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25275" }, "impact_statement": "CVE-2022-25275 is not present in Drupal 10.5.12-p2+tuxcare. The fix for SA-CORE-2022-012 (released July 2022) was already included in the upstream Drupal 10.5.12 release. All three defensive mechanisms from the security patch are present: (1) ImageStyleDownloadController properly determines public vs non-public schemes and invokes access control hooks for non-public schemes, (2) PublicStream prevents path confusion where public:// URIs resolve to private directories, and (3) system_file_download grants access to additional public schemes. The fix was onboarded via snapshot commit b5de532105c by bashebr@cloudlinux.com on 2026-07-16." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-29T01:56:43.326000+00:00", "status_notes": "Vulnerability CVE-2022-25276 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2022-25276 affects Drupal's Media oEmbed iframe route due to missing domain validation. The target repository (Drupal core 10.5.12-p2+tuxcare) is NOT AFFECTED because the security fix from SA-CORE-2022-015 was already present in upstream Drupal 10.5.12 when TuxCare onboarded it. The domain validation logic (lines 127-134 of OEmbedIframeController.php) validates that requests to the oEmbed i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25276" }, "impact_statement": "not_affected \u2014 CVE-2022-25276 affects Drupal's Media oEmbed iframe route due to missing domain validation. The target repository (Drupal core 10.5.12-p2+tuxcare) is NOT AFFECTED because the security fix from SA-CORE-2022-015 was already present in upstream Drupal 10.5.12 when TuxCare onboarded it. The domain validation logic (lines 127-134 of OEmbedIframeController.php) validates that requests to the oEmbed i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25277 does not affect version 10.5.12-p1+tuxcare of drupal/core. The target repository (drupal/core 10.5.12-p2+tuxcare) is NOT AFFECTED by CVE-2022-25277. The SA-CORE-2022-014 security fix was already present in the upstream Drupal 10.5.12 release when TuxCare onboarded it. The fix includes: (1) adding 'htaccess' to INSECURE_EXTENSIONS and INSECURE_EXTENSION_REGEX in FileSystemInterface.php, and (2) adding special handling in SecurityFileUploadEventSubscriber.php to detect dot-prefixed insecure extension files like .htaccess and properly sanitize them. The fix was authored by xjm@65776.no-reply.drupal.org in July 2022 and shipped with the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25277" }, "impact_statement": "The target repository (drupal/core 10.5.12-p2+tuxcare) is NOT AFFECTED by CVE-2022-25277. The SA-CORE-2022-014 security fix was already present in the upstream Drupal 10.5.12 release when TuxCare onboarded it. The fix includes: (1) adding 'htaccess' to INSECURE_EXTENSIONS and INSECURE_EXTENSION_REGEX in FileSystemInterface.php, and (2) adding special handling in SecurityFileUploadEventSubscriber.php to detect dot-prefixed insecure extension files like .htaccess and properly sanitize them. The fix was authored by xjm@65776.no-reply.drupal.org in July 2022 and shipped with the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2022-25278 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2022-25278 does not affect this Drupal 10.5.12 target. The vulnerability (incorrect form element access evaluation) was fixed in upstream Drupal via SA-CORE-2022-013 (July 2022), before Drupal 10's initial release (December 2022). The target code shows proper AccessResultInterface->isAllowed() checking in FormBuilder.php lines 1224-1229, matching the patched version. TuxCare onboarded the a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25278" }, "impact_statement": "not_affected \u2014 CVE-2022-25278 does not affect this Drupal 10.5.12 target. The vulnerability (incorrect form element access evaluation) was fixed in upstream Drupal via SA-CORE-2022-013 (July 2022), before Drupal 10's initial release (December 2022). The target code shows proper AccessResultInterface->isAllowed() checking in FormBuilder.php lines 1224-1229, matching the patched version. TuxCare onboarded the a..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2023-5256 does not affect version 10.5.12-p1+tuxcare of drupal/core. CVE-2023-5256 (SA-CORE-2023-006) is NOT present in target Drupal 10.5.12-p2+tuxcare. The vulnerability involved JSON:API module error responses leaking sensitive information (backtraces with file paths, line numbers) to unauthorized users via cacheable responses. The fix requires BOTH \"access site reports\" permission AND verbose error reporting config (previously only checked permission), and prevents caching of verbose errors. All three fix components are present in HEAD at modules/jsonapi/src/Normalizer/HttpExceptionNormalizer.php: cache tag added (line 48), cache max-age set to 0 for verbose mode (line 50), and double authorization check (line 94). The fix was already present in upstream Drupal 10.5.12 release when TuxCare onboarded it via snapshot commit b5de532105. No TuxCare backport to 10.5.12 was needed (backport 4973c83e91 was only for version 8.9.20).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-5256" }, "impact_statement": "CVE-2023-5256 (SA-CORE-2023-006) is NOT present in target Drupal 10.5.12-p2+tuxcare. The vulnerability involved JSON:API module error responses leaking sensitive information (backtraces with file paths, line numbers) to unauthorized users via cacheable responses. The fix requires BOTH \"access site reports\" permission AND verbose error reporting config (previously only checked permission), and prevents caching of verbose errors. All three fix components are present in HEAD at modules/jsonapi/src/Normalizer/HttpExceptionNormalizer.php: cache tag added (line 48), cache max-age set to 0 for verbose mode (line 50), and double authorization check (line 94). The fix was already present in upstream Drupal 10.5.12 release when TuxCare onboarded it via snapshot commit b5de532105. No TuxCare backport to 10.5.12 was needed (backport 4973c83e91 was only for version 8.9.20)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:36:14.768306+00:00", "status_notes": "Vulnerability CVE-2024-12393 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2024-12393 (SA-CORE-2024-003) is not present in the target. The vulnerability concerns inadequate sanitization of status messages in Drupal's AJAX MessageCommand, allowing XSS attacks. The fix (applying Xss::filterAdmin to string messages while preserving safe MarkupInterface objects) was released upstream in November 2024 for Drupal 10.2.11 and 10.3.9. The target version (10.5.12) was rele...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-12393" }, "impact_statement": "not_affected \u2014 CVE-2024-12393 (SA-CORE-2024-003) is not present in the target. The vulnerability concerns inadequate sanitization of status messages in Drupal's AJAX MessageCommand, allowing XSS attacks. The fix (applying Xss::filterAdmin to string messages while preserving safe MarkupInterface objects) was released upstream in November 2024 for Drupal 10.2.11 and 10.3.9. The target version (10.5.12) was rele..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:22:41.069903+00:00", "status_notes": "Vulnerability CVE-2024-45440 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2024-45440 (Full Path Disclosure in maintenance pages) is not present in the target. The fix was already included in the upstream Drupal 10.5.12 release via commit 8830f76c72 by Alex Pott (alex.a.pott@googlemail.com) on 2024-10-02. TuxCare onboarded this already-fixed version via snapshot commit b5de532105, which captured the upstream release state including all security fixes.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45440" }, "impact_statement": "not_affected \u2014 CVE-2024-45440 (Full Path Disclosure in maintenance pages) is not present in the target. The fix was already included in the upstream Drupal 10.5.12 release via commit 8830f76c72 by Alex Pott (alex.a.pott@googlemail.com) on 2024-10-02. TuxCare onboarded this already-fixed version via snapshot commit b5de532105, which captured the upstream release state including all security fixes." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2024-55634 does not affect version 10.5.12-p1+tuxcare of drupal/core. The target is not affected by CVE-2024-55634. The vulnerability (database-collation-dependent case sensitivity in uniqueness validation allowing duplicate user emails differing only by case) was fixed in upstream Drupal 10.5.12 via commit 13e9e9e182 (SA-CORE-2024-004) by Dave Long. TuxCare imported this already-fixed version as snapshot b5de532105. All four security patches are present: UniqueFieldConstraint has $caseSensitive=FALSE, UniqueFieldValueValidator implements case-insensitive LIKE queries, FileUriUnique sets $caseSensitive=TRUE, and user.install detects conflicting emails. This is an upstream fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-55634" }, "impact_statement": "The target is not affected by CVE-2024-55634. The vulnerability (database-collation-dependent case sensitivity in uniqueness validation allowing duplicate user emails differing only by case) was fixed in upstream Drupal 10.5.12 via commit 13e9e9e182 (SA-CORE-2024-004) by Dave Long. TuxCare imported this already-fixed version as snapshot b5de532105. All four security patches are present: UniqueFieldConstraint has $caseSensitive=FALSE, UniqueFieldValueValidator implements case-insensitive LIKE queries, FileUriUnique sets $caseSensitive=TRUE, and user.install detects conflicting emails. This is an upstream fix, not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2024-55636 does not affect version 10.5.12-p1+tuxcare of drupal/core. Target Drupal 10.5.12 is NOT affected by CVE-2024-55636. The vulnerability requires the absence of a type declaration on the $targetCacheStorage property in StorageComparer.php to enable a PHP object injection gadget chain leading to arbitrary file deletion. The target contains the fix: line 89 declares 'protected CacheBackendInterface $targetCacheStorage;' which causes PHP to throw TypeError when incompatible objects are assigned during unserialize(), breaking the attack chain. This fix was authored by the upstream Drupal project (Dave Long) in commit 9f46c64eec (SA-CORE-2024-006, Nov 2024) and shipped in the upstream Drupal 10.5.12 release (Jun 2026). TuxCare imported this already-fixed release via snapshot commit b5de532105 (Jul 2026).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-55636" }, "impact_statement": "Target Drupal 10.5.12 is NOT affected by CVE-2024-55636. The vulnerability requires the absence of a type declaration on the $targetCacheStorage property in StorageComparer.php to enable a PHP object injection gadget chain leading to arbitrary file deletion. The target contains the fix: line 89 declares 'protected CacheBackendInterface $targetCacheStorage;' which causes PHP to throw TypeError when incompatible objects are assigned during unserialize(), breaking the attack chain. This fix was authored by the upstream Drupal project (Dave Long) in commit 9f46c64eec (SA-CORE-2024-006, Nov 2024) and shipped in the upstream Drupal 10.5.12 release (Jun 2026). TuxCare imported this already-fixed release via snapshot commit b5de532105 (Jul 2026)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2024-55637 does not affect version 10.5.12-p1+tuxcare of drupal/core. CVE-2024-55637 (SA-CORE-2024-007) is NOT present in drupal/core 10.5.12-p2+tuxcare. The vulnerability involved a PHP Object Injection gadget chain in ViewExecutable::$query that lacked type constraints. The fix adds a strict type declaration (`?QueryPluginBase`) to the $query property, preventing arbitrary type injection during unserialization. This fix was already included in the upstream Drupal 10.5.12 release (published after SA-CORE-2024-007 on 2024-11-20) and was onboarded by TuxCare via snapshot commit b5de532105cf in July 2026. No separate TuxCare backport was needed. The target code at line 223 of ViewExecutable.php contains the fixed version: `public ?QueryPluginBase $query = NULL;`", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-55637" }, "impact_statement": "CVE-2024-55637 (SA-CORE-2024-007) is NOT present in drupal/core 10.5.12-p2+tuxcare. The vulnerability involved a PHP Object Injection gadget chain in ViewExecutable::$query that lacked type constraints. The fix adds a strict type declaration (`?QueryPluginBase`) to the $query property, preventing arbitrary type injection during unserialization. This fix was already included in the upstream Drupal 10.5.12 release (published after SA-CORE-2024-007 on 2024-11-20) and was onboarded by TuxCare via snapshot commit b5de532105cf in July 2026. No separate TuxCare backport was needed. The target code at line 223 of ViewExecutable.php contains the fixed version: `public ?QueryPluginBase $query = NULL;`" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2024-55638 does not affect version 10.5.12-p1+tuxcare of drupal/core. The target repository (Drupal core 10.5.12-p2+tuxcare) is NOT AFFECTED by CVE-2024-55638. All three defensive fixes from the upstream patch (SA-CORE-2024-008) are already present in the target: (1) Select.php validates that internal properties (fields, expressions, tables, order, group, union) are arrays before string conversion; (2) Update.php validates fields, arguments, and expressionFields are arrays; (3) StatementPrefetch.php allowlists database drivers before reflection-based instantiation with constructor arguments. These defenses prevent deserialized objects with corrupted internal state from being used to achieve arbitrary code execution. The fix was included in the upstream Drupal 10.5.12 release (authored by dave@longwaveconsulting.com, committed 2024-11-20) before TuxCare onboarded it via snapshot commit b5de532105 on 2026-07-16. Since the fix came with the upstream release, the vulnerable code pattern was never present in this TuxCare-maintained version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-55638" }, "impact_statement": "The target repository (Drupal core 10.5.12-p2+tuxcare) is NOT AFFECTED by CVE-2024-55638. All three defensive fixes from the upstream patch (SA-CORE-2024-008) are already present in the target: (1) Select.php validates that internal properties (fields, expressions, tables, order, group, union) are arrays before string conversion; (2) Update.php validates fields, arguments, and expressionFields are arrays; (3) StatementPrefetch.php allowlists database drivers before reflection-based instantiation with constructor arguments. These defenses prevent deserialized objects with corrupted internal state from being used to achieve arbitrary code execution. The fix was included in the upstream Drupal 10.5.12 release (authored by dave@longwaveconsulting.com, committed 2024-11-20) before TuxCare onboarded it via snapshot commit b5de532105 on 2026-07-16. Since the fix came with the upstream release, the vulnerable code pattern was never present in this TuxCare-maintained version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:22:41.069903+00:00", "status_notes": "Vulnerability CVE-2025-13080 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 The target drupal/core 10.5.12-p2+tuxcare is NOT vulnerable to CVE-2025-13080. The vulnerability (HTTP method override to safe methods allowing forceful browsing) was fixed in upstream Drupal 10.5.12, which is the base version TuxCare onboarded. The fix is present at lib/Drupal/Core/Security/RequestSanitizer.php:44-46, rejecting requests where getMethod() != getRealMethod() and the overridden m...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-13080" }, "impact_statement": "not_affected \u2014 The target drupal/core 10.5.12-p2+tuxcare is NOT vulnerable to CVE-2025-13080. The vulnerability (HTTP method override to safe methods allowing forceful browsing) was fixed in upstream Drupal 10.5.12, which is the base version TuxCare onboarded. The fix is present at lib/Drupal/Core/Security/RequestSanitizer.php:44-46, rejecting requests where getMethod() != getRealMethod() and the overridden m..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:22:41.069903+00:00", "status_notes": "Vulnerability CVE-2025-13081 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2025-13081 (Object Injection via Transaction deserialization) does not affect Drupal 10.5.12. The vulnerability affects versions 10.5.0 before 10.5.6, but the target is version 10.5.12, which already contains the upstream fix. The fix (adding __wakeup() to prevent Transaction object unserialization) was present in upstream Drupal 10.5.12 when TuxCare onboarded it via snapshot commit b5de532...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-13081" }, "impact_statement": "not_affected \u2014 CVE-2025-13081 (Object Injection via Transaction deserialization) does not affect Drupal 10.5.12. The vulnerability affects versions 10.5.0 before 10.5.6, but the target is version 10.5.12, which already contains the upstream fix. The fix (adding __wakeup() to prevent Transaction object unserialization) was present in upstream Drupal 10.5.12 when TuxCare onboarded it via snapshot commit b5de532..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:36:14.768306+00:00", "status_notes": "Vulnerability CVE-2025-13082 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2025-13082 is a content spoofing vulnerability affecting Drupal core versions prior to SA-CORE-2025-007 (November 2025). The vulnerability allows attackers to inject arbitrary text into HTTP error responses by supplying malicious format parameters. The target repository (Drupal 10.5.12-p2+tuxcare) is NOT AFFECTED because the upstream Drupal 10.5.12 release (June 2026) already contained the ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-13082" }, "impact_statement": "not_affected \u2014 CVE-2025-13082 is a content spoofing vulnerability affecting Drupal core versions prior to SA-CORE-2025-007 (November 2025). The vulnerability allows attackers to inject arbitrary text into HTTP error responses by supplying malicious format parameters. The target repository (Drupal 10.5.12-p2+tuxcare) is NOT AFFECTED because the upstream Drupal 10.5.12 release (June 2026) already contained the ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:16:38.201074+00:00", "status_notes": "Vulnerability CVE-2025-13083 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 10.5.12-p2+tuxcare is NOT affected by CVE-2025-13083. This vulnerability (SA-CORE-2025-008) affects Drupal versions 10.5.0-10.5.5, and the fix was released in upstream version 10.5.6. The target version 10.5.12 already contains the complete fix in modules/system/src/FileDownloadController.php (lines 81-95), which properly manages Cache-Control headers for file downloads t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-13083" }, "impact_statement": "not_affected \u2014 The target Drupal core 10.5.12-p2+tuxcare is NOT affected by CVE-2025-13083. This vulnerability (SA-CORE-2025-008) affects Drupal versions 10.5.0-10.5.5, and the fix was released in upstream version 10.5.6. The target version 10.5.12 already contains the complete fix in modules/system/src/FileDownloadController.php (lines 81-95), which properly manages Cache-Control headers for file downloads t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:16:38.201074+00:00", "status_notes": "Vulnerability CVE-2025-3057 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 Target drupal/core 10.5.12-p2+tuxcare is not affected by CVE-2025-3057 (XSS via error messages). The security fix (forcing Content-Type: text/plain for HTTP exception responses and preventing subrequests for 400 errors) was already present in the upstream Drupal 10.5.12 release when TuxCare onboarded it. The vulnerable code pattern is not present in HEAD.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-3057" }, "impact_statement": "not_affected \u2014 Target drupal/core 10.5.12-p2+tuxcare is not affected by CVE-2025-3057 (XSS via error messages). The security fix (forcing Content-Type: text/plain for HTTP exception responses and preventing subrequests for 400 errors) was already present in the upstream Drupal 10.5.12 release when TuxCare onboarded it. The vulnerable code pattern is not present in HEAD." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2025-31673 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 Drupal 10.5.12 is NOT vulnerable to CVE-2025-31673. The vulnerability affects Drupal versions \"from 10.4.0 before 10.4.3\". The security fix (SA-CORE-2025-002) was released on 2025-02-18 with Drupal 10.4.3. The target version 10.5.12 was released on 2026-06-17, well after the fix was applied upstream. The file lib/Drupal/Core/Field/FieldUpdateActionBase.php:56 contains the fixed code that proper...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31673" }, "impact_statement": "not_affected \u2014 Drupal 10.5.12 is NOT vulnerable to CVE-2025-31673. The vulnerability affects Drupal versions \"from 10.4.0 before 10.4.3\". The security fix (SA-CORE-2025-002) was released on 2025-02-18 with Drupal 10.4.3. The target version 10.5.12 was released on 2026-06-17, well after the fix was applied upstream. The file lib/Drupal/Core/Field/FieldUpdateActionBase.php:56 contains the fixed code that proper..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-31T21:18:55.288253+00:00", "status_notes": "Vulnerability CVE-2025-31674 does not affect version 10.5.12-p1+tuxcare of drupal/core. The target Drupal 10.5.12 repository is NOT AFFECTED by CVE-2025-31674. The vulnerability (object injection via missing type validation in DisplayPluginCollection::clear()) has already been fixed in the upstream Drupal 10.5.12 release. The fix adds an instanceof DisplayPluginInterface check before calling destroy() on objects in the plugin collection, preventing arbitrary method invocation on injected objects. This fix was part of SA-CORE-2025-003 and was already present when TuxCare onboarded the 10.5.12 release via snapshot commit b5de532105.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31674" }, "impact_statement": "The target Drupal 10.5.12 repository is NOT AFFECTED by CVE-2025-31674. The vulnerability (object injection via missing type validation in DisplayPluginCollection::clear()) has already been fixed in the upstream Drupal 10.5.12 release. The fix adds an instanceof DisplayPluginInterface check before calling destroy() on objects in the plugin collection, preventing arbitrary method invocation on injected objects. This fix was part of SA-CORE-2025-003 and was already present when TuxCare onboarded the 10.5.12 release via snapshot commit b5de532105." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2025-31675 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 Drupal 10.5.12 is not affected by CVE-2025-31675. The security fix (SA-CORE-2025-004) for the XSS vulnerability in link field attributes was released in March 2025. Drupal 10.5.12 was released in July 2026, 15+ months after the fix, and therefore already includes the AttributeXss sanitization class and its proper application in LinkFormatter and MenuLinkContent. The CVE's affected version range...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31675" }, "impact_statement": "not_affected \u2014 Drupal 10.5.12 is not affected by CVE-2025-31675. The security fix (SA-CORE-2025-004) for the XSS vulnerability in link field attributes was released in March 2025. Drupal 10.5.12 was released in July 2026, 15+ months after the fix, and therefore already includes the AttributeXss sanitization class and its proper application in LinkFormatter and MenuLinkContent. The CVE's affected version range..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-20T20:21:00.073652+00:00", "status_notes": "Vulnerability CVE-2026-108097 affects version 10.5.12-p1+tuxcare of drupal/core, and is fixed in 10.5.12-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-108097" }, "action_statement": "Vulnerability CVE-2026-108097 affects version 10.5.12-p1+tuxcare of drupal/core, and is fixed in 10.5.12-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-20T20:21:00.073652+00:00", "status_notes": "Vulnerability CVE-2026-108514 affects version 10.5.12-p1+tuxcare of drupal/core, and is fixed in 10.5.12-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-108514" }, "action_statement": "Vulnerability CVE-2026-108514 affects version 10.5.12-p1+tuxcare of drupal/core, and is fixed in 10.5.12-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-20T20:21:00.073652+00:00", "status_notes": "Vulnerability CVE-2026-108515 affects version 10.5.12-p1+tuxcare of drupal/core, and is fixed in 10.5.12-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-108515" }, "action_statement": "Vulnerability CVE-2026-108515 affects version 10.5.12-p1+tuxcare of drupal/core, and is fixed in 10.5.12-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-01T16:33:11.394606+00:00", "status_notes": "Vulnerability CVE-2026-15916 is fixed in version 10.5.12-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-15916" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-01T16:33:11.394606+00:00", "status_notes": "Vulnerability CVE-2026-55805 is fixed in version 10.5.12-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-55805" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:16:38.201074+00:00", "status_notes": "Vulnerability CVE-2026-6365 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2026-6365 (XSS in jQuery AJAX modal dialog buttons) is NOT present in target Drupal 10.5.12-p2+tuxcare. The SA-CORE-2026-001 fix (button attribute whitelisting + XSS filtering) was included in upstream Drupal 10.5.9 (released 2026-04-15) and is present in the target at lib/Drupal/Core/Ajax/OpenDialogCommand.php lines 146-157. The fix was authored by upstream (xjm@65776.no-reply.drupal.org) ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6365" }, "impact_statement": "not_affected \u2014 CVE-2026-6365 (XSS in jQuery AJAX modal dialog buttons) is NOT present in target Drupal 10.5.12-p2+tuxcare. The SA-CORE-2026-001 fix (button attribute whitelisting + XSS filtering) was included in upstream Drupal 10.5.9 (released 2026-04-15) and is present in the target at lib/Drupal/Core/Ajax/OpenDialogCommand.php lines 146-157. The fix was authored by upstream (xjm@65776.no-reply.drupal.org) ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:29:56.875680+00:00", "status_notes": "Vulnerability CVE-2026-6366 does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal 10.5.12-p2+tuxcare is not affected by CVE-2026-6366 (Object Injection via PHP unserialization). The SA-CORE-2026-002 security fix was shipped in upstream Drupal 10.5.9, and the target is based on Drupal 10.5.12 which includes this fix. Both defense mechanisms are present: (1) ViewExecutable::__wakeup() validates that unserialized properties match expected defaults and whitelis...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6366" }, "impact_statement": "not_affected \u2014 The target Drupal 10.5.12-p2+tuxcare is not affected by CVE-2026-6366 (Object Injection via PHP unserialization). The SA-CORE-2026-002 security fix was shipped in upstream Drupal 10.5.9, and the target is based on Drupal 10.5.12 which includes this fix. Both defense mechanisms are present: (1) ViewExecutable::__wakeup() validates that unserialized properties match expected defaults and whitelis..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-31T21:16:06.652991+00:00", "status_notes": "Vulnerability CVE-2026-9082 does not affect version 10.5.12-p1+tuxcare of drupal/core. CVE-2026-9082 (SA-CORE-2026-004) is a SQL injection vulnerability in Drupal core's entity query system that allows attackers to inject malicious SQL via associative array keys in query conditions. The target repository (drupal/core 10.5.12-p2+tuxcare) is NOT affected because the upstream fix was already present in Drupal 10.5.12 when TuxCare onboarded that version. All three vulnerable files (Condition.php, ConditionAggregate.php, pgsql/Condition.php) contain the array_values() fix that prevents string keys from being used in SQL placeholder construction. The vulnerable code pattern never existed in this released version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9082" }, "impact_statement": "CVE-2026-9082 (SA-CORE-2026-004) is a SQL injection vulnerability in Drupal core's entity query system that allows attackers to inject malicious SQL via associative array keys in query conditions. The target repository (drupal/core 10.5.12-p2+tuxcare) is NOT affected because the upstream fix was already present in Drupal 10.5.12 when TuxCare onboarded that version. All three vulnerable files (Condition.php, ConditionAggregate.php, pgsql/Condition.php) contain the array_values() fix that prevents string keys from being used in SQL placeholder construction. The vulnerable code pattern never existed in this released version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:08:54.384014+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw does not affect version 10.5.12-p1+tuxcare of drupal/core. not_affected \u2014 The target is not affected by GHSA-6ccv-8fgf-cjpw (Drupal Comment module DoS via PathBasedBreadcrumbBuilder). The vulnerability pattern\u2014unhandled NotFoundHttpException in breadcrumb path resolution\u2014is not present because the upstream Drupal vendor fixed it in SA-CORE-2024-001 (commit bd803acb29) before the 10.5.12 release. TuxCare onboarded version 10.5.12 which already included this fix. The f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" }, "impact_statement": "not_affected \u2014 The target is not affected by GHSA-6ccv-8fgf-cjpw (Drupal Comment module DoS via PathBasedBreadcrumbBuilder). The vulnerability pattern\u2014unhandled NotFoundHttpException in breadcrumb path resolution\u2014is not present because the upstream Drupal vendor fixed it in SA-CORE-2024-001 (commit bd803acb29) before the 10.5.12 release. TuxCare onboarded version 10.5.12 which already included this fix. The f..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-10-29T05:10:28.546830+00:00", "status_notes": "Vulnerability CVE-2022-25270 does not affect version 9.5.11-p2+tuxcare of drupal/core. not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25270" }, "impact_statement": "not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:12:46.442569+00:00", "status_notes": "Vulnerability CVE-2022-25271 does not affect version 9.5.11-p2+tuxcare of drupal/core. CVE-2022-25271 is NOT present in the target. The vulnerable pattern (allowing user input to overwrite 'value' type form elements) was fixed in upstream Drupal releases SA-CORE-2022-003 (Feb 2022) and SA-CORE-2022-008 (Apr 2022). Drupal 9.5.11 (released Sept 2023) shipped with the comprehensive fix that excludes both 'item' and 'value' type elements from being processed as user input. The target repository's snapshot commit imported this already-fixed upstream version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25271" }, "impact_statement": "CVE-2022-25271 is NOT present in the target. The vulnerable pattern (allowing user input to overwrite 'value' type form elements) was fixed in upstream Drupal releases SA-CORE-2022-003 (Feb 2022) and SA-CORE-2022-008 (Apr 2022). Drupal 9.5.11 (released Sept 2023) shipped with the comprehensive fix that excludes both 'item' and 'value' type elements from being processed as user input. The target repository's snapshot commit imported this already-fixed upstream version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25273 does not affect version 9.5.11-p2+tuxcare of drupal/core. CVE-2022-25273 is not present in Drupal 9.5.11-p7+tuxcare. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-008 (April 2022), and the fix was already included in the Drupal 9.5.11 release (September 2023) that TuxCare later imported. The target code contains the patched version that excludes both 'item' and 'value' type form elements from input processing, preventing attackers from overwriting display-only form element values.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25273" }, "impact_statement": "CVE-2022-25273 is not present in Drupal 9.5.11-p7+tuxcare. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-008 (April 2022), and the fix was already included in the Drupal 9.5.11 release (September 2023) that TuxCare later imported. The target code contains the patched version that excludes both 'item' and 'value' type form elements from input processing, preventing attackers from overwriting display-only form element values." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25275 does not affect version 9.5.11-p2+tuxcare of drupal/core. The target repository (Drupal 9.5.11) is not affected by CVE-2022-25275. The SA-CORE-2022-012 security fix was already present in the upstream Drupal 9.5.11 release when TuxCare created the initial snapshot (commit 8233a54800). All three components of the fix are present: (1) ImageStyleDownloadController.php uses `$is_public` logic with `file_additional_public_schemes` support instead of hardcoded `$scheme == 'private'` check; (2) PublicStream.php has the `getLocalPath()` override that prevents accessing private files via public scheme; (3) system.module implements `system_file_download()` hook for additional public schemes. No TuxCare backport was required for version 9.5.11 (backport e12f4968b6 exists only for 8.9.20). The vulnerable pattern is not present in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25275" }, "impact_statement": "The target repository (Drupal 9.5.11) is not affected by CVE-2022-25275. The SA-CORE-2022-012 security fix was already present in the upstream Drupal 9.5.11 release when TuxCare created the initial snapshot (commit 8233a54800). All three components of the fix are present: (1) ImageStyleDownloadController.php uses `$is_public` logic with `file_additional_public_schemes` support instead of hardcoded `$scheme == 'private'` check; (2) PublicStream.php has the `getLocalPath()` override that prevents accessing private files via public scheme; (3) system.module implements `system_file_download()` hook for additional public schemes. No TuxCare backport was required for version 9.5.11 (backport e12f4968b6 exists only for 8.9.20). The vulnerable pattern is not present in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-10-29T01:55:18.385525+00:00", "status_notes": "Vulnerability CVE-2022-25276 does not affect version 9.5.11-p2+tuxcare of drupal/core. not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25276" }, "impact_statement": "not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25277 does not affect version 9.5.11-p2+tuxcare of drupal/core. The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25277. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-014 on July 20, 2022, and the fix was already present in the upstream Drupal 9.5.11 release (September 19, 2023) that TuxCare imported via snapshot commit 8233a54800. Both required defenses are present: (1) 'htaccess' added to INSECURE_EXTENSIONS array, and (2) special handling for dot-files that are also insecure extensions (e.g., .htaccess) to prevent bypass when administrators configure htaccess as an allowed extension.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25277" }, "impact_statement": "The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25277. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-014 on July 20, 2022, and the fix was already present in the upstream Drupal 9.5.11 release (September 19, 2023) that TuxCare imported via snapshot commit 8233a54800. Both required defenses are present: (1) 'htaccess' added to INSECURE_EXTENSIONS array, and (2) special handling for dot-files that are also insecure extensions (e.g., .htaccess) to prevent bypass when administrators configure htaccess as an allowed extension." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2022-25278 does not affect version 9.5.11-p2+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25278" }, "impact_statement": "not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2023-5256 does not affect version 9.5.11-p2+tuxcare of drupal/core. The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2023-5256. The vulnerability fix (SA-CORE-2023-006) was already included in the upstream Drupal 9.5.11 release that TuxCare onboarded. The fix prevents sensitive error backtraces from being cached and exposed to unauthorized users by adding two protections: (1) setting cache max-age to 0 when verbose error reporting is enabled, and (2) requiring both 'access site reports' permission AND ERROR_REPORTING_DISPLAY_VERBOSE setting to show backtraces, instead of only checking the permission.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-5256" }, "impact_statement": "The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2023-5256. The vulnerability fix (SA-CORE-2023-006) was already included in the upstream Drupal 9.5.11 release that TuxCare onboarded. The fix prevents sensitive error backtraces from being cached and exposed to unauthorized users by adding two protections: (1) setting cache max-age to 0 when verbose error reporting is enabled, and (2) requiring both 'access site reports' permission AND ERROR_REPORTING_DISPLAY_VERBOSE setting to show backtraces, instead of only checking the permission." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 9.5.11-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45440 is fixed in version 9.5.11-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-45440" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 9.5.11-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 9.5.11-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 9.5.11-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 9.5.11-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13080 affects version 9.5.11-p2+tuxcare of drupal/core, and is fixed in 9.5.11-p4+tuxcare.", "vulnerability": { "name": "CVE-2025-13080" }, "action_statement": "Vulnerability CVE-2025-13080 affects version 9.5.11-p2+tuxcare of drupal/core, and is fixed in 9.5.11-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13081 affects version 9.5.11-p2+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13081" }, "action_statement": "Vulnerability CVE-2025-13081 affects version 9.5.11-p2+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13082 affects version 9.5.11-p2+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13082" }, "action_statement": "Vulnerability CVE-2025-13082 affects version 9.5.11-p2+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13083 affects version 9.5.11-p2+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13083" }, "action_statement": "Vulnerability CVE-2025-13083 affects version 9.5.11-p2+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 9.5.11-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 9.5.11-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 9.5.11-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 9.5.11-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2026-108097 affects version 9.5.11-p2+tuxcare of drupal/core, and is fixed in 9.5.11-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-108097" }, "action_statement": "Vulnerability CVE-2026-108097 affects version 9.5.11-p2+tuxcare of drupal/core, and is fixed in 9.5.11-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-10-16T16:27:00.115201+00:00", "status_notes": "Vulnerability CVE-2026-108515 does not affect version 9.5.11-p2+tuxcare of drupal/core. not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-108515" }, "impact_statement": "not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 9.5.11-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6366 affects version 9.5.11-p2+tuxcare of drupal/core, and is fixed in 9.5.11-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-6366" }, "action_statement": "Vulnerability CVE-2026-6366 affects version 9.5.11-p2+tuxcare of drupal/core, and is fixed in 9.5.11-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9082 affects version 9.5.11-p2+tuxcare of drupal/core, and is fixed in 9.5.11-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-9082" }, "action_statement": "Vulnerability CVE-2026-9082 affects version 9.5.11-p2+tuxcare of drupal/core, and is fixed in 9.5.11-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6CCV-8FGF-CJPW is fixed in version 9.5.11-p2+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6CCV-8FGF-CJPW" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw does not affect version 9.5.11-p2+tuxcare of drupal/core. already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" }, "impact_statement": "already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-10-29T05:10:28.546830+00:00", "status_notes": "Vulnerability CVE-2022-25270 does not affect version 9.5.11-p6+tuxcare of drupal/core. not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25270" }, "impact_statement": "not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-11-03T10:12:46.442569+00:00", "status_notes": "Vulnerability CVE-2022-25271 does not affect version 9.5.11-p6+tuxcare of drupal/core. CVE-2022-25271 is NOT present in the target. The vulnerable pattern (allowing user input to overwrite 'value' type form elements) was fixed in upstream Drupal releases SA-CORE-2022-003 (Feb 2022) and SA-CORE-2022-008 (Apr 2022). Drupal 9.5.11 (released Sept 2023) shipped with the comprehensive fix that excludes both 'item' and 'value' type elements from being processed as user input. The target repository's snapshot commit imported this already-fixed upstream version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25271" }, "impact_statement": "CVE-2022-25271 is NOT present in the target. The vulnerable pattern (allowing user input to overwrite 'value' type form elements) was fixed in upstream Drupal releases SA-CORE-2022-003 (Feb 2022) and SA-CORE-2022-008 (Apr 2022). Drupal 9.5.11 (released Sept 2023) shipped with the comprehensive fix that excludes both 'item' and 'value' type elements from being processed as user input. The target repository's snapshot commit imported this already-fixed upstream version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25273 does not affect version 9.5.11-p6+tuxcare of drupal/core. CVE-2022-25273 is not present in Drupal 9.5.11-p7+tuxcare. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-008 (April 2022), and the fix was already included in the Drupal 9.5.11 release (September 2023) that TuxCare later imported. The target code contains the patched version that excludes both 'item' and 'value' type form elements from input processing, preventing attackers from overwriting display-only form element values.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25273" }, "impact_statement": "CVE-2022-25273 is not present in Drupal 9.5.11-p7+tuxcare. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-008 (April 2022), and the fix was already included in the Drupal 9.5.11 release (September 2023) that TuxCare later imported. The target code contains the patched version that excludes both 'item' and 'value' type form elements from input processing, preventing attackers from overwriting display-only form element values." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25275 does not affect version 9.5.11-p6+tuxcare of drupal/core. The target repository (Drupal 9.5.11) is not affected by CVE-2022-25275. The SA-CORE-2022-012 security fix was already present in the upstream Drupal 9.5.11 release when TuxCare created the initial snapshot (commit 8233a54800). All three components of the fix are present: (1) ImageStyleDownloadController.php uses `$is_public` logic with `file_additional_public_schemes` support instead of hardcoded `$scheme == 'private'` check; (2) PublicStream.php has the `getLocalPath()` override that prevents accessing private files via public scheme; (3) system.module implements `system_file_download()` hook for additional public schemes. No TuxCare backport was required for version 9.5.11 (backport e12f4968b6 exists only for 8.9.20). The vulnerable pattern is not present in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25275" }, "impact_statement": "The target repository (Drupal 9.5.11) is not affected by CVE-2022-25275. The SA-CORE-2022-012 security fix was already present in the upstream Drupal 9.5.11 release when TuxCare created the initial snapshot (commit 8233a54800). All three components of the fix are present: (1) ImageStyleDownloadController.php uses `$is_public` logic with `file_additional_public_schemes` support instead of hardcoded `$scheme == 'private'` check; (2) PublicStream.php has the `getLocalPath()` override that prevents accessing private files via public scheme; (3) system.module implements `system_file_download()` hook for additional public schemes. No TuxCare backport was required for version 9.5.11 (backport e12f4968b6 exists only for 8.9.20). The vulnerable pattern is not present in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-10-29T01:55:18.385525+00:00", "status_notes": "Vulnerability CVE-2022-25276 does not affect version 9.5.11-p6+tuxcare of drupal/core. not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25276" }, "impact_statement": "not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25277 does not affect version 9.5.11-p6+tuxcare of drupal/core. The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25277. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-014 on July 20, 2022, and the fix was already present in the upstream Drupal 9.5.11 release (September 19, 2023) that TuxCare imported via snapshot commit 8233a54800. Both required defenses are present: (1) 'htaccess' added to INSECURE_EXTENSIONS array, and (2) special handling for dot-files that are also insecure extensions (e.g., .htaccess) to prevent bypass when administrators configure htaccess as an allowed extension.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25277" }, "impact_statement": "The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25277. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-014 on July 20, 2022, and the fix was already present in the upstream Drupal 9.5.11 release (September 19, 2023) that TuxCare imported via snapshot commit 8233a54800. Both required defenses are present: (1) 'htaccess' added to INSECURE_EXTENSIONS array, and (2) special handling for dot-files that are also insecure extensions (e.g., .htaccess) to prevent bypass when administrators configure htaccess as an allowed extension." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2022-25278 does not affect version 9.5.11-p6+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25278" }, "impact_statement": "not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2023-5256 does not affect version 9.5.11-p6+tuxcare of drupal/core. The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2023-5256. The vulnerability fix (SA-CORE-2023-006) was already included in the upstream Drupal 9.5.11 release that TuxCare onboarded. The fix prevents sensitive error backtraces from being cached and exposed to unauthorized users by adding two protections: (1) setting cache max-age to 0 when verbose error reporting is enabled, and (2) requiring both 'access site reports' permission AND ERROR_REPORTING_DISPLAY_VERBOSE setting to show backtraces, instead of only checking the permission.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-5256" }, "impact_statement": "The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2023-5256. The vulnerability fix (SA-CORE-2023-006) was already included in the upstream Drupal 9.5.11 release that TuxCare onboarded. The fix prevents sensitive error backtraces from being cached and exposed to unauthorized users by adding two protections: (1) setting cache max-age to 0 when verbose error reporting is enabled, and (2) requiring both 'access site reports' permission AND ERROR_REPORTING_DISPLAY_VERBOSE setting to show backtraces, instead of only checking the permission." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45440 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-45440" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13081 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13081" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13082 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13083 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13083" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2026-108097 affects version 9.5.11-p6+tuxcare of drupal/core, and is fixed in 9.5.11-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-108097" }, "action_statement": "Vulnerability CVE-2026-108097 affects version 9.5.11-p6+tuxcare of drupal/core, and is fixed in 9.5.11-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-10-16T16:27:00.115201+00:00", "status_notes": "Vulnerability CVE-2026-108515 does not affect version 9.5.11-p6+tuxcare of drupal/core. not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-108515" }, "impact_statement": "not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6CCV-8FGF-CJPW is fixed in version 9.5.11-p6+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6CCV-8FGF-CJPW" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p6+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw does not affect version 9.5.11-p6+tuxcare of drupal/core. already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" }, "impact_statement": "already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-10-29T05:10:28.546830+00:00", "status_notes": "Vulnerability CVE-2022-25270 does not affect version 9.5.11-p4+tuxcare of drupal/core. not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25270" }, "impact_statement": "not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-11-03T10:12:46.442569+00:00", "status_notes": "Vulnerability CVE-2022-25271 does not affect version 9.5.11-p4+tuxcare of drupal/core. CVE-2022-25271 is NOT present in the target. The vulnerable pattern (allowing user input to overwrite 'value' type form elements) was fixed in upstream Drupal releases SA-CORE-2022-003 (Feb 2022) and SA-CORE-2022-008 (Apr 2022). Drupal 9.5.11 (released Sept 2023) shipped with the comprehensive fix that excludes both 'item' and 'value' type elements from being processed as user input. The target repository's snapshot commit imported this already-fixed upstream version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25271" }, "impact_statement": "CVE-2022-25271 is NOT present in the target. The vulnerable pattern (allowing user input to overwrite 'value' type form elements) was fixed in upstream Drupal releases SA-CORE-2022-003 (Feb 2022) and SA-CORE-2022-008 (Apr 2022). Drupal 9.5.11 (released Sept 2023) shipped with the comprehensive fix that excludes both 'item' and 'value' type elements from being processed as user input. The target repository's snapshot commit imported this already-fixed upstream version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25273 does not affect version 9.5.11-p4+tuxcare of drupal/core. CVE-2022-25273 is not present in Drupal 9.5.11-p7+tuxcare. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-008 (April 2022), and the fix was already included in the Drupal 9.5.11 release (September 2023) that TuxCare later imported. The target code contains the patched version that excludes both 'item' and 'value' type form elements from input processing, preventing attackers from overwriting display-only form element values.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25273" }, "impact_statement": "CVE-2022-25273 is not present in Drupal 9.5.11-p7+tuxcare. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-008 (April 2022), and the fix was already included in the Drupal 9.5.11 release (September 2023) that TuxCare later imported. The target code contains the patched version that excludes both 'item' and 'value' type form elements from input processing, preventing attackers from overwriting display-only form element values." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25275 does not affect version 9.5.11-p4+tuxcare of drupal/core. The target repository (Drupal 9.5.11) is not affected by CVE-2022-25275. The SA-CORE-2022-012 security fix was already present in the upstream Drupal 9.5.11 release when TuxCare created the initial snapshot (commit 8233a54800). All three components of the fix are present: (1) ImageStyleDownloadController.php uses `$is_public` logic with `file_additional_public_schemes` support instead of hardcoded `$scheme == 'private'` check; (2) PublicStream.php has the `getLocalPath()` override that prevents accessing private files via public scheme; (3) system.module implements `system_file_download()` hook for additional public schemes. No TuxCare backport was required for version 9.5.11 (backport e12f4968b6 exists only for 8.9.20). The vulnerable pattern is not present in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25275" }, "impact_statement": "The target repository (Drupal 9.5.11) is not affected by CVE-2022-25275. The SA-CORE-2022-012 security fix was already present in the upstream Drupal 9.5.11 release when TuxCare created the initial snapshot (commit 8233a54800). All three components of the fix are present: (1) ImageStyleDownloadController.php uses `$is_public` logic with `file_additional_public_schemes` support instead of hardcoded `$scheme == 'private'` check; (2) PublicStream.php has the `getLocalPath()` override that prevents accessing private files via public scheme; (3) system.module implements `system_file_download()` hook for additional public schemes. No TuxCare backport was required for version 9.5.11 (backport e12f4968b6 exists only for 8.9.20). The vulnerable pattern is not present in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-10-29T01:55:18.385525+00:00", "status_notes": "Vulnerability CVE-2022-25276 does not affect version 9.5.11-p4+tuxcare of drupal/core. not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25276" }, "impact_statement": "not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25277 does not affect version 9.5.11-p4+tuxcare of drupal/core. The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25277. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-014 on July 20, 2022, and the fix was already present in the upstream Drupal 9.5.11 release (September 19, 2023) that TuxCare imported via snapshot commit 8233a54800. Both required defenses are present: (1) 'htaccess' added to INSECURE_EXTENSIONS array, and (2) special handling for dot-files that are also insecure extensions (e.g., .htaccess) to prevent bypass when administrators configure htaccess as an allowed extension.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25277" }, "impact_statement": "The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25277. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-014 on July 20, 2022, and the fix was already present in the upstream Drupal 9.5.11 release (September 19, 2023) that TuxCare imported via snapshot commit 8233a54800. Both required defenses are present: (1) 'htaccess' added to INSECURE_EXTENSIONS array, and (2) special handling for dot-files that are also insecure extensions (e.g., .htaccess) to prevent bypass when administrators configure htaccess as an allowed extension." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2022-25278 does not affect version 9.5.11-p4+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25278" }, "impact_statement": "not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2023-5256 does not affect version 9.5.11-p4+tuxcare of drupal/core. The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2023-5256. The vulnerability fix (SA-CORE-2023-006) was already included in the upstream Drupal 9.5.11 release that TuxCare onboarded. The fix prevents sensitive error backtraces from being cached and exposed to unauthorized users by adding two protections: (1) setting cache max-age to 0 when verbose error reporting is enabled, and (2) requiring both 'access site reports' permission AND ERROR_REPORTING_DISPLAY_VERBOSE setting to show backtraces, instead of only checking the permission.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-5256" }, "impact_statement": "The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2023-5256. The vulnerability fix (SA-CORE-2023-006) was already included in the upstream Drupal 9.5.11 release that TuxCare onboarded. The fix prevents sensitive error backtraces from being cached and exposed to unauthorized users by adding two protections: (1) setting cache max-age to 0 when verbose error reporting is enabled, and (2) requiring both 'access site reports' permission AND ERROR_REPORTING_DISPLAY_VERBOSE setting to show backtraces, instead of only checking the permission." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45440 is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-45440" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13081 affects version 9.5.11-p4+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13081" }, "action_statement": "Vulnerability CVE-2025-13081 affects version 9.5.11-p4+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13082 affects version 9.5.11-p4+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13082" }, "action_statement": "Vulnerability CVE-2025-13082 affects version 9.5.11-p4+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13083 affects version 9.5.11-p4+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13083" }, "action_statement": "Vulnerability CVE-2025-13083 affects version 9.5.11-p4+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2026-108097 affects version 9.5.11-p4+tuxcare of drupal/core, and is fixed in 9.5.11-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-108097" }, "action_statement": "Vulnerability CVE-2026-108097 affects version 9.5.11-p4+tuxcare of drupal/core, and is fixed in 9.5.11-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-10-16T16:27:00.115201+00:00", "status_notes": "Vulnerability CVE-2026-108515 does not affect version 9.5.11-p4+tuxcare of drupal/core. not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-108515" }, "impact_statement": "not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6CCV-8FGF-CJPW is fixed in version 9.5.11-p4+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6CCV-8FGF-CJPW" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p4+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw does not affect version 9.5.11-p4+tuxcare of drupal/core. already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" }, "impact_statement": "already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2025-46734 does not affect version 2.7.1-p3+tuxcare of league/commonmark. not_affected \u2014 CVE-2025-46734 describes an XSS vulnerability in league/commonmark versions 1.5.0 through 2.6.x where the Attributes extension allows injection of malicious JavaScript via event handler attributes like `onerror`. Version 2.7.0 introduced three defenses: (1) blocking attributes starting with `on`, (2) enforcing an attribute allowlist, and (3) making href/src respect `allow_unsafe_links` configur...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46734" }, "impact_statement": "not_affected \u2014 CVE-2025-46734 describes an XSS vulnerability in league/commonmark versions 1.5.0 through 2.6.x where the Attributes extension allows injection of malicious JavaScript via event handler attributes like `onerror`. Version 2.7.0 introduced three defenses: (1) blocking attributes starting with `on`, (2) enforcing an attribute allowlist, and (3) making href/src respect `allow_unsafe_links` configur..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-30838 is fixed in version 2.7.1-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-30838" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 is fixed in version 2.7.1-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-33347" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71478 is fixed in version 2.7.1-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71478" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71488 is fixed in version 2.7.1-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71488" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 2.7.1-p3+tuxcare of league/commonmark, and is fixed in 2.7.1-p4+tuxcare.", "vulnerability": { "name": "GHSA-3q6v-r5mr-hxv8" }, "action_statement": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 2.7.1-p3+tuxcare of league/commonmark, and is fixed in 2.7.1-p4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8rr7-cvq3-gmfh is fixed in version 2.7.1-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-8rr7-cvq3-gmfh" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 2.7.1-p3+tuxcare of league/commonmark, and is fixed in 2.7.1-p4+tuxcare.", "vulnerability": { "name": "GHSA-97jj-33gv-5xf9" }, "action_statement": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 2.7.1-p3+tuxcare of league/commonmark, and is fixed in 2.7.1-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-11-03T10:18:21.473206+00:00", "status_notes": "Vulnerability GHSA-c2pc-g5qf-rfrf does not affect version 2.7.1-p3+tuxcare of league/commonmark. Target version 2.7.1 is not affected by GHSA-c2pc-g5qf-rfrf. This CVE was fixed in version 2.6.0 (released 2024-12-07), and the target version 2.7.1 (released 2025-07-20) already includes all the upstream security defenses. The polynomial time complexity vulnerabilities are not present because the necessary rate-limiting mechanisms (max_delimiters_per_line, table/max_autocompleted_cells, URL subdomain limits, reference link expansion limits, and optimized bracket parsing) are all active in the shipped code. These fixes came with the upstream 2.7.1 release that TuxCare onboarded, not from TuxCare backports.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c2pc-g5qf-rfrf" }, "impact_statement": "Target version 2.7.1 is not affected by GHSA-c2pc-g5qf-rfrf. This CVE was fixed in version 2.6.0 (released 2024-12-07), and the target version 2.7.1 (released 2025-07-20) already includes all the upstream security defenses. The polynomial time complexity vulnerabilities are not present because the necessary rate-limiting mechanisms (max_delimiters_per_line, table/max_autocompleted_cells, URL subdomain limits, reference link expansion limits, and optimized bracket parsing) are all active in the shipped code. These fixes came with the upstream 2.7.1 release that TuxCare onboarded, not from TuxCare backports." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f8fg-pg57-v4j8 is fixed in version 2.7.1-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-f8fg-pg57-v4j8" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g2gp-3wwq-f4ph is fixed in version 2.7.1-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-g2gp-3wwq-f4ph" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-j8pm-gj4c-rq4x is fixed in version 2.7.1-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-j8pm-gj4c-rq4x" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jfm3-95jq-q3rf is fixed in version 2.7.1-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jfm3-95jq-q3rf" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jjv6-8j6v-6j52 is fixed in version 2.7.1-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jjv6-8j6v-6j52" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mh25-x5hq-wrqp is fixed in version 2.7.1-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mh25-x5hq-wrqp" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mj63-m3rc-8ppr is fixed in version 2.7.1-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mj63-m3rc-8ppr" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-29T05:10:28.546830+00:00", "status_notes": "Vulnerability CVE-2022-25270 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 The target Drupal core version 10.5.12 is NOT affected by CVE-2022-25270. The vulnerability exists in the Quick Edit module's MetadataGenerator class, which fails to perform proper access checks before exposing entity labels. However, the Quick Edit module was completely removed from Drupal core in version 10.0.0-beta1 (August 2022), which is well before the target version 10.5.12. The vulnerab...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25270" }, "impact_statement": "not_affected \u2014 The target Drupal core version 10.5.12 is NOT affected by CVE-2022-25270. The vulnerability exists in the Quick Edit module's MetadataGenerator class, which fails to perform proper access checks before exposing entity labels. However, the Quick Edit module was completely removed from Drupal core in version 10.0.0-beta1 (August 2022), which is well before the target version 10.5.12. The vulnerab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:12:46.442569+00:00", "status_notes": "Vulnerability CVE-2022-25271 does not affect version 10.5.12-p2+tuxcare of drupal/core. CVE-2022-25271 is NOT present in drupal/core 10.5.12-p2+tuxcare. The vulnerable code pattern (missing type check for 'value' form elements) was fixed in the upstream Drupal release before version 10.5.12 was published. The target code contains an enhanced version of the fix that checks `!in_array($element['#type'], ['item', 'value'], TRUE)` before processing form input, preventing attackers from overwriting protected 'value' and 'item' type form elements. This fix was included in the upstream Drupal 10.5.12 release that TuxCare onboarded in July 2026.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25271" }, "impact_statement": "CVE-2022-25271 is NOT present in drupal/core 10.5.12-p2+tuxcare. The vulnerable code pattern (missing type check for 'value' form elements) was fixed in the upstream Drupal release before version 10.5.12 was published. The target code contains an enhanced version of the fix that checks `!in_array($element['#type'], ['item', 'value'], TRUE)` before processing form input, preventing attackers from overwriting protected 'value' and 'item' type form elements. This fix was included in the upstream Drupal 10.5.12 release that TuxCare onboarded in July 2026." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25273 does not affect version 10.5.12-p2+tuxcare of drupal/core. Target Drupal 10.5.12 includes the upstream fix for CVE-2022-25273/SA-CORE-2022-008. The vulnerable code pattern (checking only `$element['#type'] !== 'value'`) is not present. The target has the fixed pattern at FormBuilder.php:1225 that excludes both 'item' and 'value' types from input processing: `!in_array($element['#type'], ['item', 'value'], TRUE)`. This prevents attackers from injecting values into display-only form elements. The fix was included in upstream Drupal 10.5.12 when it was released, and was imported via TuxCare's onboarding snapshot commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25273" }, "impact_statement": "Target Drupal 10.5.12 includes the upstream fix for CVE-2022-25273/SA-CORE-2022-008. The vulnerable code pattern (checking only `$element['#type'] !== 'value'`) is not present. The target has the fixed pattern at FormBuilder.php:1225 that excludes both 'item' and 'value' types from input processing: `!in_array($element['#type'], ['item', 'value'], TRUE)`. This prevents attackers from injecting values into display-only form elements. The fix was included in upstream Drupal 10.5.12 when it was released, and was imported via TuxCare's onboarding snapshot commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25275 does not affect version 10.5.12-p2+tuxcare of drupal/core. CVE-2022-25275 is not present in Drupal 10.5.12-p2+tuxcare. The fix for SA-CORE-2022-012 (released July 2022) was already included in the upstream Drupal 10.5.12 release. All three defensive mechanisms from the security patch are present: (1) ImageStyleDownloadController properly determines public vs non-public schemes and invokes access control hooks for non-public schemes, (2) PublicStream prevents path confusion where public:// URIs resolve to private directories, and (3) system_file_download grants access to additional public schemes. The fix was onboarded via snapshot commit b5de532105c by bashebr@cloudlinux.com on 2026-07-16.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25275" }, "impact_statement": "CVE-2022-25275 is not present in Drupal 10.5.12-p2+tuxcare. The fix for SA-CORE-2022-012 (released July 2022) was already included in the upstream Drupal 10.5.12 release. All three defensive mechanisms from the security patch are present: (1) ImageStyleDownloadController properly determines public vs non-public schemes and invokes access control hooks for non-public schemes, (2) PublicStream prevents path confusion where public:// URIs resolve to private directories, and (3) system_file_download grants access to additional public schemes. The fix was onboarded via snapshot commit b5de532105c by bashebr@cloudlinux.com on 2026-07-16." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-29T01:56:43.326000+00:00", "status_notes": "Vulnerability CVE-2022-25276 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 CVE-2022-25276 affects Drupal's Media oEmbed iframe route due to missing domain validation. The target repository (Drupal core 10.5.12-p2+tuxcare) is NOT AFFECTED because the security fix from SA-CORE-2022-015 was already present in upstream Drupal 10.5.12 when TuxCare onboarded it. The domain validation logic (lines 127-134 of OEmbedIframeController.php) validates that requests to the oEmbed i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25276" }, "impact_statement": "not_affected \u2014 CVE-2022-25276 affects Drupal's Media oEmbed iframe route due to missing domain validation. The target repository (Drupal core 10.5.12-p2+tuxcare) is NOT AFFECTED because the security fix from SA-CORE-2022-015 was already present in upstream Drupal 10.5.12 when TuxCare onboarded it. The domain validation logic (lines 127-134 of OEmbedIframeController.php) validates that requests to the oEmbed i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25277 does not affect version 10.5.12-p2+tuxcare of drupal/core. The target repository (drupal/core 10.5.12-p2+tuxcare) is NOT AFFECTED by CVE-2022-25277. The SA-CORE-2022-014 security fix was already present in the upstream Drupal 10.5.12 release when TuxCare onboarded it. The fix includes: (1) adding 'htaccess' to INSECURE_EXTENSIONS and INSECURE_EXTENSION_REGEX in FileSystemInterface.php, and (2) adding special handling in SecurityFileUploadEventSubscriber.php to detect dot-prefixed insecure extension files like .htaccess and properly sanitize them. The fix was authored by xjm@65776.no-reply.drupal.org in July 2022 and shipped with the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25277" }, "impact_statement": "The target repository (drupal/core 10.5.12-p2+tuxcare) is NOT AFFECTED by CVE-2022-25277. The SA-CORE-2022-014 security fix was already present in the upstream Drupal 10.5.12 release when TuxCare onboarded it. The fix includes: (1) adding 'htaccess' to INSECURE_EXTENSIONS and INSECURE_EXTENSION_REGEX in FileSystemInterface.php, and (2) adding special handling in SecurityFileUploadEventSubscriber.php to detect dot-prefixed insecure extension files like .htaccess and properly sanitize them. The fix was authored by xjm@65776.no-reply.drupal.org in July 2022 and shipped with the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2022-25278 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 CVE-2022-25278 does not affect this Drupal 10.5.12 target. The vulnerability (incorrect form element access evaluation) was fixed in upstream Drupal via SA-CORE-2022-013 (July 2022), before Drupal 10's initial release (December 2022). The target code shows proper AccessResultInterface->isAllowed() checking in FormBuilder.php lines 1224-1229, matching the patched version. TuxCare onboarded the a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25278" }, "impact_statement": "not_affected \u2014 CVE-2022-25278 does not affect this Drupal 10.5.12 target. The vulnerability (incorrect form element access evaluation) was fixed in upstream Drupal via SA-CORE-2022-013 (July 2022), before Drupal 10's initial release (December 2022). The target code shows proper AccessResultInterface->isAllowed() checking in FormBuilder.php lines 1224-1229, matching the patched version. TuxCare onboarded the a..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2023-5256 does not affect version 10.5.12-p2+tuxcare of drupal/core. CVE-2023-5256 (SA-CORE-2023-006) is NOT present in target Drupal 10.5.12-p2+tuxcare. The vulnerability involved JSON:API module error responses leaking sensitive information (backtraces with file paths, line numbers) to unauthorized users via cacheable responses. The fix requires BOTH \"access site reports\" permission AND verbose error reporting config (previously only checked permission), and prevents caching of verbose errors. All three fix components are present in HEAD at modules/jsonapi/src/Normalizer/HttpExceptionNormalizer.php: cache tag added (line 48), cache max-age set to 0 for verbose mode (line 50), and double authorization check (line 94). The fix was already present in upstream Drupal 10.5.12 release when TuxCare onboarded it via snapshot commit b5de532105. No TuxCare backport to 10.5.12 was needed (backport 4973c83e91 was only for version 8.9.20).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-5256" }, "impact_statement": "CVE-2023-5256 (SA-CORE-2023-006) is NOT present in target Drupal 10.5.12-p2+tuxcare. The vulnerability involved JSON:API module error responses leaking sensitive information (backtraces with file paths, line numbers) to unauthorized users via cacheable responses. The fix requires BOTH \"access site reports\" permission AND verbose error reporting config (previously only checked permission), and prevents caching of verbose errors. All three fix components are present in HEAD at modules/jsonapi/src/Normalizer/HttpExceptionNormalizer.php: cache tag added (line 48), cache max-age set to 0 for verbose mode (line 50), and double authorization check (line 94). The fix was already present in upstream Drupal 10.5.12 release when TuxCare onboarded it via snapshot commit b5de532105. No TuxCare backport to 10.5.12 was needed (backport 4973c83e91 was only for version 8.9.20)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:36:14.768306+00:00", "status_notes": "Vulnerability CVE-2024-12393 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 CVE-2024-12393 (SA-CORE-2024-003) is not present in the target. The vulnerability concerns inadequate sanitization of status messages in Drupal's AJAX MessageCommand, allowing XSS attacks. The fix (applying Xss::filterAdmin to string messages while preserving safe MarkupInterface objects) was released upstream in November 2024 for Drupal 10.2.11 and 10.3.9. The target version (10.5.12) was rele...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-12393" }, "impact_statement": "not_affected \u2014 CVE-2024-12393 (SA-CORE-2024-003) is not present in the target. The vulnerability concerns inadequate sanitization of status messages in Drupal's AJAX MessageCommand, allowing XSS attacks. The fix (applying Xss::filterAdmin to string messages while preserving safe MarkupInterface objects) was released upstream in November 2024 for Drupal 10.2.11 and 10.3.9. The target version (10.5.12) was rele..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:22:41.069903+00:00", "status_notes": "Vulnerability CVE-2024-45440 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 CVE-2024-45440 (Full Path Disclosure in maintenance pages) is not present in the target. The fix was already included in the upstream Drupal 10.5.12 release via commit 8830f76c72 by Alex Pott (alex.a.pott@googlemail.com) on 2024-10-02. TuxCare onboarded this already-fixed version via snapshot commit b5de532105, which captured the upstream release state including all security fixes.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45440" }, "impact_statement": "not_affected \u2014 CVE-2024-45440 (Full Path Disclosure in maintenance pages) is not present in the target. The fix was already included in the upstream Drupal 10.5.12 release via commit 8830f76c72 by Alex Pott (alex.a.pott@googlemail.com) on 2024-10-02. TuxCare onboarded this already-fixed version via snapshot commit b5de532105, which captured the upstream release state including all security fixes." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2024-55634 does not affect version 10.5.12-p2+tuxcare of drupal/core. The target is not affected by CVE-2024-55634. The vulnerability (database-collation-dependent case sensitivity in uniqueness validation allowing duplicate user emails differing only by case) was fixed in upstream Drupal 10.5.12 via commit 13e9e9e182 (SA-CORE-2024-004) by Dave Long. TuxCare imported this already-fixed version as snapshot b5de532105. All four security patches are present: UniqueFieldConstraint has $caseSensitive=FALSE, UniqueFieldValueValidator implements case-insensitive LIKE queries, FileUriUnique sets $caseSensitive=TRUE, and user.install detects conflicting emails. This is an upstream fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-55634" }, "impact_statement": "The target is not affected by CVE-2024-55634. The vulnerability (database-collation-dependent case sensitivity in uniqueness validation allowing duplicate user emails differing only by case) was fixed in upstream Drupal 10.5.12 via commit 13e9e9e182 (SA-CORE-2024-004) by Dave Long. TuxCare imported this already-fixed version as snapshot b5de532105. All four security patches are present: UniqueFieldConstraint has $caseSensitive=FALSE, UniqueFieldValueValidator implements case-insensitive LIKE queries, FileUriUnique sets $caseSensitive=TRUE, and user.install detects conflicting emails. This is an upstream fix, not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2024-55636 does not affect version 10.5.12-p2+tuxcare of drupal/core. Target Drupal 10.5.12 is NOT affected by CVE-2024-55636. The vulnerability requires the absence of a type declaration on the $targetCacheStorage property in StorageComparer.php to enable a PHP object injection gadget chain leading to arbitrary file deletion. The target contains the fix: line 89 declares 'protected CacheBackendInterface $targetCacheStorage;' which causes PHP to throw TypeError when incompatible objects are assigned during unserialize(), breaking the attack chain. This fix was authored by the upstream Drupal project (Dave Long) in commit 9f46c64eec (SA-CORE-2024-006, Nov 2024) and shipped in the upstream Drupal 10.5.12 release (Jun 2026). TuxCare imported this already-fixed release via snapshot commit b5de532105 (Jul 2026).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-55636" }, "impact_statement": "Target Drupal 10.5.12 is NOT affected by CVE-2024-55636. The vulnerability requires the absence of a type declaration on the $targetCacheStorage property in StorageComparer.php to enable a PHP object injection gadget chain leading to arbitrary file deletion. The target contains the fix: line 89 declares 'protected CacheBackendInterface $targetCacheStorage;' which causes PHP to throw TypeError when incompatible objects are assigned during unserialize(), breaking the attack chain. This fix was authored by the upstream Drupal project (Dave Long) in commit 9f46c64eec (SA-CORE-2024-006, Nov 2024) and shipped in the upstream Drupal 10.5.12 release (Jun 2026). TuxCare imported this already-fixed release via snapshot commit b5de532105 (Jul 2026)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2024-55637 does not affect version 10.5.12-p2+tuxcare of drupal/core. CVE-2024-55637 (SA-CORE-2024-007) is NOT present in drupal/core 10.5.12-p2+tuxcare. The vulnerability involved a PHP Object Injection gadget chain in ViewExecutable::$query that lacked type constraints. The fix adds a strict type declaration (`?QueryPluginBase`) to the $query property, preventing arbitrary type injection during unserialization. This fix was already included in the upstream Drupal 10.5.12 release (published after SA-CORE-2024-007 on 2024-11-20) and was onboarded by TuxCare via snapshot commit b5de532105cf in July 2026. No separate TuxCare backport was needed. The target code at line 223 of ViewExecutable.php contains the fixed version: `public ?QueryPluginBase $query = NULL;`", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-55637" }, "impact_statement": "CVE-2024-55637 (SA-CORE-2024-007) is NOT present in drupal/core 10.5.12-p2+tuxcare. The vulnerability involved a PHP Object Injection gadget chain in ViewExecutable::$query that lacked type constraints. The fix adds a strict type declaration (`?QueryPluginBase`) to the $query property, preventing arbitrary type injection during unserialization. This fix was already included in the upstream Drupal 10.5.12 release (published after SA-CORE-2024-007 on 2024-11-20) and was onboarded by TuxCare via snapshot commit b5de532105cf in July 2026. No separate TuxCare backport was needed. The target code at line 223 of ViewExecutable.php contains the fixed version: `public ?QueryPluginBase $query = NULL;`" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2024-55638 does not affect version 10.5.12-p2+tuxcare of drupal/core. The target repository (Drupal core 10.5.12-p2+tuxcare) is NOT AFFECTED by CVE-2024-55638. All three defensive fixes from the upstream patch (SA-CORE-2024-008) are already present in the target: (1) Select.php validates that internal properties (fields, expressions, tables, order, group, union) are arrays before string conversion; (2) Update.php validates fields, arguments, and expressionFields are arrays; (3) StatementPrefetch.php allowlists database drivers before reflection-based instantiation with constructor arguments. These defenses prevent deserialized objects with corrupted internal state from being used to achieve arbitrary code execution. The fix was included in the upstream Drupal 10.5.12 release (authored by dave@longwaveconsulting.com, committed 2024-11-20) before TuxCare onboarded it via snapshot commit b5de532105 on 2026-07-16. Since the fix came with the upstream release, the vulnerable code pattern was never present in this TuxCare-maintained version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-55638" }, "impact_statement": "The target repository (Drupal core 10.5.12-p2+tuxcare) is NOT AFFECTED by CVE-2024-55638. All three defensive fixes from the upstream patch (SA-CORE-2024-008) are already present in the target: (1) Select.php validates that internal properties (fields, expressions, tables, order, group, union) are arrays before string conversion; (2) Update.php validates fields, arguments, and expressionFields are arrays; (3) StatementPrefetch.php allowlists database drivers before reflection-based instantiation with constructor arguments. These defenses prevent deserialized objects with corrupted internal state from being used to achieve arbitrary code execution. The fix was included in the upstream Drupal 10.5.12 release (authored by dave@longwaveconsulting.com, committed 2024-11-20) before TuxCare onboarded it via snapshot commit b5de532105 on 2026-07-16. Since the fix came with the upstream release, the vulnerable code pattern was never present in this TuxCare-maintained version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:22:41.069903+00:00", "status_notes": "Vulnerability CVE-2025-13080 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 The target drupal/core 10.5.12-p2+tuxcare is NOT vulnerable to CVE-2025-13080. The vulnerability (HTTP method override to safe methods allowing forceful browsing) was fixed in upstream Drupal 10.5.12, which is the base version TuxCare onboarded. The fix is present at lib/Drupal/Core/Security/RequestSanitizer.php:44-46, rejecting requests where getMethod() != getRealMethod() and the overridden m...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-13080" }, "impact_statement": "not_affected \u2014 The target drupal/core 10.5.12-p2+tuxcare is NOT vulnerable to CVE-2025-13080. The vulnerability (HTTP method override to safe methods allowing forceful browsing) was fixed in upstream Drupal 10.5.12, which is the base version TuxCare onboarded. The fix is present at lib/Drupal/Core/Security/RequestSanitizer.php:44-46, rejecting requests where getMethod() != getRealMethod() and the overridden m..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:22:41.069903+00:00", "status_notes": "Vulnerability CVE-2025-13081 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 CVE-2025-13081 (Object Injection via Transaction deserialization) does not affect Drupal 10.5.12. The vulnerability affects versions 10.5.0 before 10.5.6, but the target is version 10.5.12, which already contains the upstream fix. The fix (adding __wakeup() to prevent Transaction object unserialization) was present in upstream Drupal 10.5.12 when TuxCare onboarded it via snapshot commit b5de532...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-13081" }, "impact_statement": "not_affected \u2014 CVE-2025-13081 (Object Injection via Transaction deserialization) does not affect Drupal 10.5.12. The vulnerability affects versions 10.5.0 before 10.5.6, but the target is version 10.5.12, which already contains the upstream fix. The fix (adding __wakeup() to prevent Transaction object unserialization) was present in upstream Drupal 10.5.12 when TuxCare onboarded it via snapshot commit b5de532..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:36:14.768306+00:00", "status_notes": "Vulnerability CVE-2025-13082 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 CVE-2025-13082 is a content spoofing vulnerability affecting Drupal core versions prior to SA-CORE-2025-007 (November 2025). The vulnerability allows attackers to inject arbitrary text into HTTP error responses by supplying malicious format parameters. The target repository (Drupal 10.5.12-p2+tuxcare) is NOT AFFECTED because the upstream Drupal 10.5.12 release (June 2026) already contained the ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-13082" }, "impact_statement": "not_affected \u2014 CVE-2025-13082 is a content spoofing vulnerability affecting Drupal core versions prior to SA-CORE-2025-007 (November 2025). The vulnerability allows attackers to inject arbitrary text into HTTP error responses by supplying malicious format parameters. The target repository (Drupal 10.5.12-p2+tuxcare) is NOT AFFECTED because the upstream Drupal 10.5.12 release (June 2026) already contained the ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:16:38.201074+00:00", "status_notes": "Vulnerability CVE-2025-13083 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 10.5.12-p2+tuxcare is NOT affected by CVE-2025-13083. This vulnerability (SA-CORE-2025-008) affects Drupal versions 10.5.0-10.5.5, and the fix was released in upstream version 10.5.6. The target version 10.5.12 already contains the complete fix in modules/system/src/FileDownloadController.php (lines 81-95), which properly manages Cache-Control headers for file downloads t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-13083" }, "impact_statement": "not_affected \u2014 The target Drupal core 10.5.12-p2+tuxcare is NOT affected by CVE-2025-13083. This vulnerability (SA-CORE-2025-008) affects Drupal versions 10.5.0-10.5.5, and the fix was released in upstream version 10.5.6. The target version 10.5.12 already contains the complete fix in modules/system/src/FileDownloadController.php (lines 81-95), which properly manages Cache-Control headers for file downloads t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:16:38.201074+00:00", "status_notes": "Vulnerability CVE-2025-3057 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 Target drupal/core 10.5.12-p2+tuxcare is not affected by CVE-2025-3057 (XSS via error messages). The security fix (forcing Content-Type: text/plain for HTTP exception responses and preventing subrequests for 400 errors) was already present in the upstream Drupal 10.5.12 release when TuxCare onboarded it. The vulnerable code pattern is not present in HEAD.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-3057" }, "impact_statement": "not_affected \u2014 Target drupal/core 10.5.12-p2+tuxcare is not affected by CVE-2025-3057 (XSS via error messages). The security fix (forcing Content-Type: text/plain for HTTP exception responses and preventing subrequests for 400 errors) was already present in the upstream Drupal 10.5.12 release when TuxCare onboarded it. The vulnerable code pattern is not present in HEAD." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2025-31673 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 Drupal 10.5.12 is NOT vulnerable to CVE-2025-31673. The vulnerability affects Drupal versions \"from 10.4.0 before 10.4.3\". The security fix (SA-CORE-2025-002) was released on 2025-02-18 with Drupal 10.4.3. The target version 10.5.12 was released on 2026-06-17, well after the fix was applied upstream. The file lib/Drupal/Core/Field/FieldUpdateActionBase.php:56 contains the fixed code that proper...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31673" }, "impact_statement": "not_affected \u2014 Drupal 10.5.12 is NOT vulnerable to CVE-2025-31673. The vulnerability affects Drupal versions \"from 10.4.0 before 10.4.3\". The security fix (SA-CORE-2025-002) was released on 2025-02-18 with Drupal 10.4.3. The target version 10.5.12 was released on 2026-06-17, well after the fix was applied upstream. The file lib/Drupal/Core/Field/FieldUpdateActionBase.php:56 contains the fixed code that proper..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-31T21:18:55.288253+00:00", "status_notes": "Vulnerability CVE-2025-31674 does not affect version 10.5.12-p2+tuxcare of drupal/core. The target Drupal 10.5.12 repository is NOT AFFECTED by CVE-2025-31674. The vulnerability (object injection via missing type validation in DisplayPluginCollection::clear()) has already been fixed in the upstream Drupal 10.5.12 release. The fix adds an instanceof DisplayPluginInterface check before calling destroy() on objects in the plugin collection, preventing arbitrary method invocation on injected objects. This fix was part of SA-CORE-2025-003 and was already present when TuxCare onboarded the 10.5.12 release via snapshot commit b5de532105.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31674" }, "impact_statement": "The target Drupal 10.5.12 repository is NOT AFFECTED by CVE-2025-31674. The vulnerability (object injection via missing type validation in DisplayPluginCollection::clear()) has already been fixed in the upstream Drupal 10.5.12 release. The fix adds an instanceof DisplayPluginInterface check before calling destroy() on objects in the plugin collection, preventing arbitrary method invocation on injected objects. This fix was part of SA-CORE-2025-003 and was already present when TuxCare onboarded the 10.5.12 release via snapshot commit b5de532105." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2025-31675 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 Drupal 10.5.12 is not affected by CVE-2025-31675. The security fix (SA-CORE-2025-004) for the XSS vulnerability in link field attributes was released in March 2025. Drupal 10.5.12 was released in July 2026, 15+ months after the fix, and therefore already includes the AttributeXss sanitization class and its proper application in LinkFormatter and MenuLinkContent. The CVE's affected version range...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31675" }, "impact_statement": "not_affected \u2014 Drupal 10.5.12 is not affected by CVE-2025-31675. The security fix (SA-CORE-2025-004) for the XSS vulnerability in link field attributes was released in March 2025. Drupal 10.5.12 was released in July 2026, 15+ months after the fix, and therefore already includes the AttributeXss sanitization class and its proper application in LinkFormatter and MenuLinkContent. The CVE's affected version range..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-20T20:21:00.073652+00:00", "status_notes": "Vulnerability CVE-2026-108097 is fixed in version 10.5.12-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-108097" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-20T20:21:00.073652+00:00", "status_notes": "Vulnerability CVE-2026-108514 is fixed in version 10.5.12-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-108514" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-20T20:21:00.073652+00:00", "status_notes": "Vulnerability CVE-2026-108515 is fixed in version 10.5.12-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-108515" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-20T20:21:00.073652+00:00", "status_notes": "Vulnerability CVE-2026-15916 is fixed in version 10.5.12-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-15916" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-20T20:21:00.073652+00:00", "status_notes": "Vulnerability CVE-2026-55805 is fixed in version 10.5.12-p2+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-55805" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:16:38.201074+00:00", "status_notes": "Vulnerability CVE-2026-6365 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 CVE-2026-6365 (XSS in jQuery AJAX modal dialog buttons) is NOT present in target Drupal 10.5.12-p2+tuxcare. The SA-CORE-2026-001 fix (button attribute whitelisting + XSS filtering) was included in upstream Drupal 10.5.9 (released 2026-04-15) and is present in the target at lib/Drupal/Core/Ajax/OpenDialogCommand.php lines 146-157. The fix was authored by upstream (xjm@65776.no-reply.drupal.org) ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6365" }, "impact_statement": "not_affected \u2014 CVE-2026-6365 (XSS in jQuery AJAX modal dialog buttons) is NOT present in target Drupal 10.5.12-p2+tuxcare. The SA-CORE-2026-001 fix (button attribute whitelisting + XSS filtering) was included in upstream Drupal 10.5.9 (released 2026-04-15) and is present in the target at lib/Drupal/Core/Ajax/OpenDialogCommand.php lines 146-157. The fix was authored by upstream (xjm@65776.no-reply.drupal.org) ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:29:56.875680+00:00", "status_notes": "Vulnerability CVE-2026-6366 does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 The target Drupal 10.5.12-p2+tuxcare is not affected by CVE-2026-6366 (Object Injection via PHP unserialization). The SA-CORE-2026-002 security fix was shipped in upstream Drupal 10.5.9, and the target is based on Drupal 10.5.12 which includes this fix. Both defense mechanisms are present: (1) ViewExecutable::__wakeup() validates that unserialized properties match expected defaults and whitelis...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6366" }, "impact_statement": "not_affected \u2014 The target Drupal 10.5.12-p2+tuxcare is not affected by CVE-2026-6366 (Object Injection via PHP unserialization). The SA-CORE-2026-002 security fix was shipped in upstream Drupal 10.5.9, and the target is based on Drupal 10.5.12 which includes this fix. Both defense mechanisms are present: (1) ViewExecutable::__wakeup() validates that unserialized properties match expected defaults and whitelis..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-31T21:16:06.652991+00:00", "status_notes": "Vulnerability CVE-2026-9082 does not affect version 10.5.12-p2+tuxcare of drupal/core. CVE-2026-9082 (SA-CORE-2026-004) is a SQL injection vulnerability in Drupal core's entity query system that allows attackers to inject malicious SQL via associative array keys in query conditions. The target repository (drupal/core 10.5.12-p2+tuxcare) is NOT affected because the upstream fix was already present in Drupal 10.5.12 when TuxCare onboarded that version. All three vulnerable files (Condition.php, ConditionAggregate.php, pgsql/Condition.php) contain the array_values() fix that prevents string keys from being used in SQL placeholder construction. The vulnerable code pattern never existed in this released version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9082" }, "impact_statement": "CVE-2026-9082 (SA-CORE-2026-004) is a SQL injection vulnerability in Drupal core's entity query system that allows attackers to inject malicious SQL via associative array keys in query conditions. The target repository (drupal/core 10.5.12-p2+tuxcare) is NOT affected because the upstream fix was already present in Drupal 10.5.12 when TuxCare onboarded that version. All three vulnerable files (Condition.php, ConditionAggregate.php, pgsql/Condition.php) contain the array_values() fix that prevents string keys from being used in SQL placeholder construction. The vulnerable code pattern never existed in this released version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.5.12-p2+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.5.12-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:08:54.384014+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw does not affect version 10.5.12-p2+tuxcare of drupal/core. not_affected \u2014 The target is not affected by GHSA-6ccv-8fgf-cjpw (Drupal Comment module DoS via PathBasedBreadcrumbBuilder). The vulnerability pattern\u2014unhandled NotFoundHttpException in breadcrumb path resolution\u2014is not present because the upstream Drupal vendor fixed it in SA-CORE-2024-001 (commit bd803acb29) before the 10.5.12 release. TuxCare onboarded version 10.5.12 which already included this fix. The f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" }, "impact_statement": "not_affected \u2014 The target is not affected by GHSA-6ccv-8fgf-cjpw (Drupal Comment module DoS via PathBasedBreadcrumbBuilder). The vulnerability pattern\u2014unhandled NotFoundHttpException in breadcrumb path resolution\u2014is not present because the upstream Drupal vendor fixed it in SA-CORE-2024-001 (commit bd803acb29) before the 10.5.12 release. TuxCare onboarded version 10.5.12 which already included this fix. The f..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-29T05:10:28.546830+00:00", "status_notes": "Vulnerability CVE-2022-25270 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal 10.6.17 is NOT AFFECTED by CVE-2022-25270. The vulnerable QuickEdit module was completely removed from Drupal 10.x before version 10.0.0 was released (removed on 2022-08-29, Drupal 10.0.0 released 2022-12-15). The target contains zero QuickEdit files; the vulnerable file `modules/quickedit/src/MetadataGenerator.php` does not exist. This satisfies Rule 5 Type A1: the INPUT type...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25270" }, "impact_statement": "not_affected \u2014 The target Drupal 10.6.17 is NOT AFFECTED by CVE-2022-25270. The vulnerable QuickEdit module was completely removed from Drupal 10.x before version 10.0.0 was released (removed on 2022-08-29, Drupal 10.0.0 released 2022-12-15). The target contains zero QuickEdit files; the vulnerable file `modules/quickedit/src/MetadataGenerator.php` does not exist. This satisfies Rule 5 Type A1: the INPUT type..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:12:46.442569+00:00", "status_notes": "Vulnerability CVE-2022-25271 does not affect version 10.6.17-p1+tuxcare of drupal/core. CVE-2022-25271 is not present in the target. The vulnerability allowed attackers to overwrite developer-controlled data in form elements of type 'value' by submitting crafted form data. The upstream Drupal vendor fixed this in SA-CORE-2022-003 (Feb 2022) by excluding 'value' type elements from user input processing, and enhanced it in SA-CORE-2022-008 (Apr 2022) to also exclude 'item' type elements. The fix was already present in the upstream Drupal 10.6.17 release that TuxCare onboarded. The target code at lib/Drupal/Core/Form/FormBuilder.php:1225 contains the defense: !in_array($element['#type'], ['item', 'value'], TRUE), which prevents all user input processing for these element types.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25271" }, "impact_statement": "CVE-2022-25271 is not present in the target. The vulnerability allowed attackers to overwrite developer-controlled data in form elements of type 'value' by submitting crafted form data. The upstream Drupal vendor fixed this in SA-CORE-2022-003 (Feb 2022) by excluding 'value' type elements from user input processing, and enhanced it in SA-CORE-2022-008 (Apr 2022) to also exclude 'item' type elements. The fix was already present in the upstream Drupal 10.6.17 release that TuxCare onboarded. The target code at lib/Drupal/Core/Form/FormBuilder.php:1225 contains the defense: !in_array($element['#type'], ['item', 'value'], TRUE), which prevents all user input processing for these element types." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25273 does not affect version 10.6.17-p1+tuxcare of drupal/core. CVE-2022-25273 (SA-CORE-2022-008) describes a Drupal form API vulnerability where form elements with #type='item' could have their values improperly overwritten by attackers. The upstream fix adds 'item' to the list of element types excluded from input processing. This fix was already present in upstream Drupal 10.6.17 (released September 2026), which TuxCare onboarded as the base for this version. The vulnerable code pattern does not exist in the target; the fix is present at lib/Drupal/Core/Form/FormBuilder.php:1224-1226.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25273" }, "impact_statement": "CVE-2022-25273 (SA-CORE-2022-008) describes a Drupal form API vulnerability where form elements with #type='item' could have their values improperly overwritten by attackers. The upstream fix adds 'item' to the list of element types excluded from input processing. This fix was already present in upstream Drupal 10.6.17 (released September 2026), which TuxCare onboarded as the base for this version. The vulnerable code pattern does not exist in the target; the fix is present at lib/Drupal/Core/Form/FormBuilder.php:1224-1226." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25275 does not affect version 10.6.17-p1+tuxcare of drupal/core. CVE-2022-25275 (SA-CORE-2022-012) is NOT present in the target. The security fix was committed to Drupal core on July 20, 2022, and Drupal 10.6.17 was released on September 16, 2026\u2014over 4 years later. The upstream release already includes the fix. Code inspection confirms all three fix components are present: (1) ImageStyleDownloadController.php uses `$is_public` logic with `file_additional_public_schemes` to enforce access control on all non-public schemes (not just 'private'), (2) PublicStream.php has `getLocalPath()` override preventing access to files in private directories, and (3) system.module implements `system_file_download()` hook granting access to additional public schemes. The vulnerable pattern (checking only `$scheme == 'private'`) is absent; the fixed pattern (checking `!$is_public`) is present. This is an upstream vendor fix that shipped with the Drupal 10.6.17 release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25275" }, "impact_statement": "CVE-2022-25275 (SA-CORE-2022-012) is NOT present in the target. The security fix was committed to Drupal core on July 20, 2022, and Drupal 10.6.17 was released on September 16, 2026\u2014over 4 years later. The upstream release already includes the fix. Code inspection confirms all three fix components are present: (1) ImageStyleDownloadController.php uses `$is_public` logic with `file_additional_public_schemes` to enforce access control on all non-public schemes (not just 'private'), (2) PublicStream.php has `getLocalPath()` override preventing access to files in private directories, and (3) system.module implements `system_file_download()` hook granting access to additional public schemes. The vulnerable pattern (checking only `$scheme == 'private'`) is absent; the fixed pattern (checking `!$is_public`) is present. This is an upstream vendor fix that shipped with the Drupal 10.6.17 release." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-29T01:57:26.789422+00:00", "status_notes": "Vulnerability CVE-2022-25276 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2022-25276 is not present in drupal/core 10.6.17-p1+tuxcare. The vulnerability concerned missing domain validation in the Media oEmbed iframe controller's render() method. The fix (domain validation logic at lines 126-134 of OEmbedIframeController.php) was already included in the upstream Drupal 10.6.17 release, which this TuxCare branch was initialized from via snapshot commit 88bf9d33ba. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25276" }, "impact_statement": "not_affected \u2014 CVE-2022-25276 is not present in drupal/core 10.6.17-p1+tuxcare. The vulnerability concerned missing domain validation in the Media oEmbed iframe controller's render() method. The fix (domain validation logic at lines 126-134 of OEmbedIframeController.php) was already included in the upstream Drupal 10.6.17 release, which this TuxCare branch was initialized from via snapshot commit 88bf9d33ba. ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25277 does not affect version 10.6.17-p1+tuxcare of drupal/core. The target Drupal 10.6.17-p1+tuxcare is not affected by CVE-2022-25277. The upstream Drupal 10.6.17 release already contained the SA-CORE-2022-014 fix (commit 96211434c6) before TuxCare onboarded it. The fix includes: (1) adding 'htaccess' to INSECURE_EXTENSIONS, and (2) special handling for dot files whose basename (after dot removal) matches an insecure extension. The vulnerable pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25277" }, "impact_statement": "The target Drupal 10.6.17-p1+tuxcare is not affected by CVE-2022-25277. The upstream Drupal 10.6.17 release already contained the SA-CORE-2022-014 fix (commit 96211434c6) before TuxCare onboarded it. The fix includes: (1) adding 'htaccess' to INSECURE_EXTENSIONS, and (2) special handling for dot files whose basename (after dot removal) matches an insecure extension. The vulnerable pattern is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2022-25278 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2022-25278 is not present in Drupal 10.6.17. The vulnerability involved improper evaluation of form element access control - the code treated AccessResultInterface objects as truthy boolean values instead of calling isAllowed(). The upstream fix was already included in Drupal 10.6.17 when TuxCare onboarded this version. The target code at lib/Drupal/Core/Form/FormBuilder.php:1228 correctly ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25278" }, "impact_statement": "not_affected \u2014 CVE-2022-25278 is not present in Drupal 10.6.17. The vulnerability involved improper evaluation of form element access control - the code treated AccessResultInterface objects as truthy boolean values instead of calling isAllowed(). The upstream fix was already included in Drupal 10.6.17 when TuxCare onboarded this version. The target code at lib/Drupal/Core/Form/FormBuilder.php:1228 correctly ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2023-5256 does not affect version 10.6.17-p1+tuxcare of drupal/core. CVE-2023-5256 is not present in Drupal 10.6.17. The vulnerability (CVE-2023-5256 / SA-CORE-2023-006) affected Drupal versions >=8.7.0 <9.5.11, >=10.0 <10.0.11, and >=10.1 <10.1.4. The fix was included in upstream Drupal 10.1.4, and the target version 10.6.17 already contains the fix from the upstream release. The security mitigations are present in HttpExceptionNormalizer.php: (1) cache max-age set to 0 when verbose error reporting is enabled, preventing sensitive error backtraces from being cached, and (2) error backtraces only shown when both 'access site reports' permission AND verbose error reporting are enabled, preventing exposure to unauthorized users.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-5256" }, "impact_statement": "CVE-2023-5256 is not present in Drupal 10.6.17. The vulnerability (CVE-2023-5256 / SA-CORE-2023-006) affected Drupal versions >=8.7.0 <9.5.11, >=10.0 <10.0.11, and >=10.1 <10.1.4. The fix was included in upstream Drupal 10.1.4, and the target version 10.6.17 already contains the fix from the upstream release. The security mitigations are present in HttpExceptionNormalizer.php: (1) cache max-age set to 0 when verbose error reporting is enabled, preventing sensitive error backtraces from being cached, and (2) error backtraces only shown when both 'access site reports' permission AND verbose error reporting are enabled, preventing exposure to unauthorized users." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:36:14.768306+00:00", "status_notes": "Vulnerability CVE-2024-12393 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2024-12393 affects Drupal Core's MessageCommand class where status messages rendered via JavaScript lacked adequate sanitization, allowing XSS attacks. The target (drupal/core 10.6.17-p1+tuxcare) is NOT AFFECTED because the fix was already present in upstream Drupal 10.6.17 before TuxCare onboarded this version. The MessageCommand::render() method correctly applies Xss::filterAdmin() saniti...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-12393" }, "impact_statement": "not_affected \u2014 CVE-2024-12393 affects Drupal Core's MessageCommand class where status messages rendered via JavaScript lacked adequate sanitization, allowing XSS attacks. The target (drupal/core 10.6.17-p1+tuxcare) is NOT AFFECTED because the fix was already present in upstream Drupal 10.6.17 before TuxCare onboarded this version. The MessageCommand::render() method correctly applies Xss::filterAdmin() saniti..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:22:41.069903+00:00", "status_notes": "Vulnerability CVE-2024-45440 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2024-45440 (Full Path Disclosure in maintenance pages) is not present in the target. The upstream vendor's fix (Drupal issue #3457781, commit 8830f76c72) was already included in Drupal 10.6.17, which TuxCare onboarded. The fix strips full filesystem paths from error messages by converting them to relative paths, sets up error handlers early in install.php, and ensures DrupalKernel::bootEnvi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45440" }, "impact_statement": "not_affected \u2014 CVE-2024-45440 (Full Path Disclosure in maintenance pages) is not present in the target. The upstream vendor's fix (Drupal issue #3457781, commit 8830f76c72) was already included in Drupal 10.6.17, which TuxCare onboarded. The fix strips full filesystem paths from error messages by converting them to relative paths, sets up error handlers early in install.php, and ensures DrupalKernel::bootEnvi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2024-55634 does not affect version 10.6.17-p1+tuxcare of drupal/core. Target Drupal 10.6.17-p1+tuxcare is NOT AFFECTED by CVE-2024-55634. The vulnerability (database-collation-dependent uniqueness checking allowing case-variant duplicate email addresses) was fixed in upstream Drupal before the 10.6.17 release. TuxCare onboarded version 10.6.17 on 2026-10-03, and the snapshot already contained the upstream SA-CORE-2024-004 fix code (caseSensitive property, LIKE-based case-insensitive validation, and user.install conflict detection). The fix was authored by upstream developers (dave@longwaveconsulting.com), not TuxCare, and shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-55634" }, "impact_statement": "Target Drupal 10.6.17-p1+tuxcare is NOT AFFECTED by CVE-2024-55634. The vulnerability (database-collation-dependent uniqueness checking allowing case-variant duplicate email addresses) was fixed in upstream Drupal before the 10.6.17 release. TuxCare onboarded version 10.6.17 on 2026-10-03, and the snapshot already contained the upstream SA-CORE-2024-004 fix code (caseSensitive property, LIKE-based case-insensitive validation, and user.install conflict detection). The fix was authored by upstream developers (dave@longwaveconsulting.com), not TuxCare, and shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:41:57.354813+00:00", "status_notes": "Vulnerability CVE-2024-55636 does not affect version 10.6.17-p1+tuxcare of drupal/core. The target Drupal 10.6.17-p1+tuxcare is NOT AFFECTED by CVE-2024-55636. The PHP Object Injection gadget chain vulnerability has been fixed by the upstream vendor. The critical type hint `protected CacheBackendInterface $targetCacheStorage;` is present on line 89 of StorageComparer.php, preventing attackers from injecting incompatible objects during unserialization. The CVE states affected versions are \"< 10.2.11 || >= 10.3.0 < 10.3.9\"; since 10.6.17 > 10.3.9, the fix was already present in the upstream release that TuxCare onboarded via snapshot commit 88bf9d33ba.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-55636" }, "impact_statement": "The target Drupal 10.6.17-p1+tuxcare is NOT AFFECTED by CVE-2024-55636. The PHP Object Injection gadget chain vulnerability has been fixed by the upstream vendor. The critical type hint `protected CacheBackendInterface $targetCacheStorage;` is present on line 89 of StorageComparer.php, preventing attackers from injecting incompatible objects during unserialization. The CVE states affected versions are \"< 10.2.11 || >= 10.3.0 < 10.3.9\"; since 10.6.17 > 10.3.9, the fix was already present in the upstream release that TuxCare onboarded via snapshot commit 88bf9d33ba." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2024-55637 does not affect version 10.6.17-p1+tuxcare of drupal/core. The target repository (Drupal 10.6.17-p1+tuxcare) is NOT AFFECTED by CVE-2024-55637. The vulnerability fix (typed property declaration on ViewExecutable::$query) was already present in upstream Drupal 10.6.17 before TuxCare onboarded the release. The property at modules/views/src/ViewExecutable.php:223 has the required type enforcement: `public ?QueryPluginBase $query = NULL;`. This prevents PHP object injection by rejecting arbitrary object types during unserialization. The fix was authored by Dave Long (dave@longwaveconsulting.com) in upstream commit 8c9e92b45a (SA-CORE-2024-007) and shipped in Drupal 10.6.17, which TuxCare imported via snapshot commit 88bf9d33ba on 2026-10-03.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-55637" }, "impact_statement": "The target repository (Drupal 10.6.17-p1+tuxcare) is NOT AFFECTED by CVE-2024-55637. The vulnerability fix (typed property declaration on ViewExecutable::$query) was already present in upstream Drupal 10.6.17 before TuxCare onboarded the release. The property at modules/views/src/ViewExecutable.php:223 has the required type enforcement: `public ?QueryPluginBase $query = NULL;`. This prevents PHP object injection by rejecting arbitrary object types during unserialization. The fix was authored by Dave Long (dave@longwaveconsulting.com) in upstream commit 8c9e92b45a (SA-CORE-2024-007) and shipped in Drupal 10.6.17, which TuxCare imported via snapshot commit 88bf9d33ba on 2026-10-03." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2024-55638 does not affect version 10.6.17-p1+tuxcare of drupal/core. The target repository at version 10.6.17-p1+tuxcare is NOT AFFECTED by CVE-2024-55638. All SA-CORE-2024-008 security fixes were already present in the upstream Drupal 10.6.17 release that TuxCare onboarded. The vulnerable PHP Object Injection patterns have been mitigated through: (1) runtime type validation in Select.php and Update.php __toString() methods that throw UnexpectedValueException if properties are not arrays, (2) database driver restrictions in StatementPrefetch.php before ReflectionClass instantiation, and (3) typed array property declarations in DependencySerializationTrait, Attribute, and Connection classes. The fix was authored by the upstream Drupal security team (dave@longwaveconsulting.com) and shipped in Drupal 10.6.17, which TuxCare imported via snapshot commit 88bf9d33ba.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-55638" }, "impact_statement": "The target repository at version 10.6.17-p1+tuxcare is NOT AFFECTED by CVE-2024-55638. All SA-CORE-2024-008 security fixes were already present in the upstream Drupal 10.6.17 release that TuxCare onboarded. The vulnerable PHP Object Injection patterns have been mitigated through: (1) runtime type validation in Select.php and Update.php __toString() methods that throw UnexpectedValueException if properties are not arrays, (2) database driver restrictions in StatementPrefetch.php before ReflectionClass instantiation, and (3) typed array property declarations in DependencySerializationTrait, Attribute, and Connection classes. The fix was authored by the upstream Drupal security team (dave@longwaveconsulting.com) and shipped in Drupal 10.6.17, which TuxCare imported via snapshot commit 88bf9d33ba." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:29:56.875680+00:00", "status_notes": "Vulnerability CVE-2025-13080 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2025-13080 is not present in this target. The security fix for the HTTP method override vulnerability (SA-CORE-2025-005) was already included in the upstream Drupal 10.6.17 release that TuxCare onboarded. The fix adds validation in RequestSanitizer::sanitize() to reject requests that override their HTTP method from an unsafe method to a safe method, preventing CSRF bypass attacks. This prot...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-13080" }, "impact_statement": "not_affected \u2014 CVE-2025-13080 is not present in this target. The security fix for the HTTP method override vulnerability (SA-CORE-2025-005) was already included in the upstream Drupal 10.6.17 release that TuxCare onboarded. The fix adds validation in RequestSanitizer::sanitize() to reject requests that override their HTTP method from an unsafe method to a safe method, preventing CSRF bypass attacks. This prot..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:22:41.069903+00:00", "status_notes": "Vulnerability CVE-2025-13081 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 10.6.17-p1+tuxcare is not affected by CVE-2025-13081. The vulnerability (unsafe Transaction object deserialization) was fixed by upstream Drupal in SA-CORE-2025-006 (November 2025) by adding a __wakeup() method that prevents Transaction objects from being unserialized. This fix was already present in the upstream Drupal 10.6.17 release (September 2026) that TuxCare subseq...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-13081" }, "impact_statement": "not_affected \u2014 The target Drupal core 10.6.17-p1+tuxcare is not affected by CVE-2025-13081. The vulnerability (unsafe Transaction object deserialization) was fixed by upstream Drupal in SA-CORE-2025-006 (November 2025) by adding a __wakeup() method that prevents Transaction objects from being unserialized. This fix was already present in the upstream Drupal 10.6.17 release (September 2026) that TuxCare subseq..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:36:14.768306+00:00", "status_notes": "Vulnerability CVE-2025-13082 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 10.6.17-p1+tuxcare is not affected by CVE-2025-13082. The vulnerability (content spoofing via user-controlled format strings in error messages) was already fixed in the upstream Drupal 10.6.17 release through SA-CORE-2025-007. All three affected files contain the patched code that removes user input from error messages to prevent content spoofing.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-13082" }, "impact_statement": "not_affected \u2014 The target Drupal core 10.6.17-p1+tuxcare is not affected by CVE-2025-13082. The vulnerability (content spoofing via user-controlled format strings in error messages) was already fixed in the upstream Drupal 10.6.17 release through SA-CORE-2025-007. All three affected files contain the patched code that removes user input from error messages to prevent content spoofing." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:16:38.201074+00:00", "status_notes": "Vulnerability CVE-2025-13083 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 Target Drupal core 10.6.17-p1+tuxcare is NOT AFFECTED by CVE-2025-13083. The vulnerability fix (SA-CORE-2025-008) was already present in the upstream Drupal 10.6.17 release before TuxCare onboarding. The FileDownloadController.php contains the complete fix: proper Cache-Control header management that prevents sensitive files from being cached in browsers/proxies by explicitly setting responses ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-13083" }, "impact_statement": "not_affected \u2014 Target Drupal core 10.6.17-p1+tuxcare is NOT AFFECTED by CVE-2025-13083. The vulnerability fix (SA-CORE-2025-008) was already present in the upstream Drupal 10.6.17 release before TuxCare onboarding. The FileDownloadController.php contains the complete fix: proper Cache-Control header management that prevents sensitive files from being cached in browsers/proxies by explicitly setting responses ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:16:38.201074+00:00", "status_notes": "Vulnerability CVE-2025-3057 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal 10.6.17 is not affected by CVE-2025-3057 (XSS via HTTP exception messages). Both required defense mechanisms from the upstream fix are present: (1) DrupalKernel.php:782 sets Content-Type to 'text/plain' for all HttpException responses, preventing browsers from interpreting exception messages as HTML; (2) DefaultExceptionHtmlSubscriber.php:93 prevents 400 Bad Request errors fro...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-3057" }, "impact_statement": "not_affected \u2014 The target Drupal 10.6.17 is not affected by CVE-2025-3057 (XSS via HTTP exception messages). Both required defense mechanisms from the upstream fix are present: (1) DrupalKernel.php:782 sets Content-Type to 'text/plain' for all HttpException responses, preventing browsers from interpreting exception messages as HTML; (2) DefaultExceptionHtmlSubscriber.php:93 prevents 400 Bad Request errors fro..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2025-31673 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2025-31673: The target Drupal 10.6.17 is not affected. The vulnerability (missing assignment in FieldUpdateActionBase.php line 56 causing incorrect authorization checks) was fixed by upstream Drupal in February 2025 (SA-CORE-2025-002), 7 months before the 10.6.17 release in September 2026. The fix was already present in the upstream 10.6.17 release that TuxCare onboarded. The target code co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31673" }, "impact_statement": "not_affected \u2014 CVE-2025-31673: The target Drupal 10.6.17 is not affected. The vulnerability (missing assignment in FieldUpdateActionBase.php line 56 causing incorrect authorization checks) was fixed by upstream Drupal in February 2025 (SA-CORE-2025-002), 7 months before the 10.6.17 release in September 2026. The fix was already present in the upstream 10.6.17 release that TuxCare onboarded. The target code co..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-31T21:20:32.141683+00:00", "status_notes": "Vulnerability CVE-2025-31674 does not affect version 10.6.17-p1+tuxcare of drupal/core. CVE-2025-31674 (SA-CORE-2025-003) is an object injection vulnerability in Drupal's Views DisplayPluginCollection that allowed arbitrary code execution via unvalidated destroy() method calls. The target repository (Drupal core 10.6.17-p1+tuxcare) is NOT affected because the upstream release 10.6.17 already contained the security fix before TuxCare onboarded it. The fix (instanceof DisplayPluginInterface type check) is present at DisplayPluginCollection.php:63-65. This is an upstream fix that shipped in the original Drupal 10.6.17 release (February 2025), not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31674" }, "impact_statement": "CVE-2025-31674 (SA-CORE-2025-003) is an object injection vulnerability in Drupal's Views DisplayPluginCollection that allowed arbitrary code execution via unvalidated destroy() method calls. The target repository (Drupal core 10.6.17-p1+tuxcare) is NOT affected because the upstream release 10.6.17 already contained the security fix before TuxCare onboarded it. The fix (instanceof DisplayPluginInterface type check) is present at DisplayPluginCollection.php:63-65. This is an upstream fix that shipped in the original Drupal 10.6.17 release (February 2025), not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2025-31675 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2025-31675 (SA-CORE-2025-004) affects Drupal core 8.0.0-11.1.5 via XSS in link field attributes. The target repository at version 10.6.17-p1+tuxcare is NOT affected because the upstream vendor fix was already included in the Drupal 10.6.17 release that TuxCare onboarded in September 2026. The fix (AttributeXss.php sanitization + calls in LinkFormatter.php and MenuLinkContent.php) is present...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31675" }, "impact_statement": "not_affected \u2014 CVE-2025-31675 (SA-CORE-2025-004) affects Drupal core 8.0.0-11.1.5 via XSS in link field attributes. The target repository at version 10.6.17-p1+tuxcare is NOT affected because the upstream vendor fix was already included in the Drupal 10.6.17 release that TuxCare onboarded in September 2026. The fix (AttributeXss.php sanitization + calls in LinkFormatter.php and MenuLinkContent.php) is present..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-20T20:19:00.117037+00:00", "status_notes": "Vulnerability CVE-2026-108097 is fixed in version 10.6.17-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-108097" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-20T20:19:00.117037+00:00", "status_notes": "Vulnerability CVE-2026-108514 is fixed in version 10.6.17-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-108514" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-20T20:19:00.117037+00:00", "status_notes": "Vulnerability CVE-2026-108515 is fixed in version 10.6.17-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-108515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:12:47.728703+00:00", "status_notes": "Vulnerability CVE-2026-6365 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 The target repository (Drupal core 10.6.17-p1+tuxcare) is NOT AFFECTED by CVE-2026-6365. The XSS vulnerability in the OpenDialogCommand class was already fixed in upstream Drupal version 10.6.7, and version 10.6.17 shipped with the fix already applied. The CVE states that versions \"from 10.6.0 before 10.6.7\" are affected, confirming that 10.6.17 is safe. When TuxCare onboarded version 10.6.17 v...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6365" }, "impact_statement": "not_affected \u2014 The target repository (Drupal core 10.6.17-p1+tuxcare) is NOT AFFECTED by CVE-2026-6365. The XSS vulnerability in the OpenDialogCommand class was already fixed in upstream Drupal version 10.6.7, and version 10.6.17 shipped with the fix already applied. The CVE states that versions \"from 10.6.0 before 10.6.7\" are affected, confirming that 10.6.17 is safe. When TuxCare onboarded version 10.6.17 v..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:29:56.875680+00:00", "status_notes": "Vulnerability CVE-2026-6366 does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2026-6366 affects Drupal core versions from 10.6.0 before 10.6.7. The target repository is at version 10.6.17-p1+tuxcare, which includes the upstream fix that was released in Drupal 10.6.7 on 2026-04-15. The fix adds validation during object unserialization (__wakeup in ViewExecutable.php) to prevent property injection, and type checking during rendering (__toString in Attribute.php) to pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6366" }, "impact_statement": "not_affected \u2014 CVE-2026-6366 affects Drupal core versions from 10.6.0 before 10.6.7. The target repository is at version 10.6.17-p1+tuxcare, which includes the upstream fix that was released in Drupal 10.6.7 on 2026-04-15. The fix adds validation during object unserialization (__wakeup in ViewExecutable.php) to prevent property injection, and type checking during rendering (__toString in Attribute.php) to pre..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-31T21:16:51.996676+00:00", "status_notes": "Vulnerability CVE-2026-9082 does not affect version 10.6.17-p1+tuxcare of drupal/core. Target Drupal 10.6.17 is NOT AFFECTED by CVE-2026-9082. The SQL injection vulnerability was fixed upstream in Drupal 10.6.9, and the target version 10.6.17 includes this fix. The vulnerability allowed attackers to inject SQL through associative array keys used in entity query conditions. The fix (array_values() normalization) is present in all three affected files, having been imported via the upstream Drupal 10.6.17 release snapshot before any TuxCare modifications.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-9082" }, "impact_statement": "Target Drupal 10.6.17 is NOT AFFECTED by CVE-2026-9082. The SQL injection vulnerability was fixed upstream in Drupal 10.6.9, and the target version 10.6.17 includes this fix. The vulnerability allowed attackers to inject SQL through associative array keys used in entity query conditions. The fix (array_values() normalization) is present in all three affected files, having been imported via the upstream Drupal 10.6.17 release snapshot before any TuxCare modifications." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@10.6.17-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@10.6.17-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:12:47.728703+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw does not affect version 10.6.17-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 10.6.17-p1+tuxcare is not affected by GHSA-6ccv-8fgf-cjpw. The vulnerability, which could cause denial of service through unhandled NotFoundHttpException in PathBasedBreadcrumbBuilder, was fixed upstream in SA-CORE-2024-001 (commit bd803acb29) and was already present in Drupal 10.6.17 when TuxCare onboarded it. The fix adds exception handling for NotFoundHttpException in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" }, "impact_statement": "not_affected \u2014 The target Drupal core 10.6.17-p1+tuxcare is not affected by GHSA-6ccv-8fgf-cjpw. The vulnerability, which could cause denial of service through unhandled NotFoundHttpException in PathBasedBreadcrumbBuilder, was fixed upstream in SA-CORE-2024-001 (commit bd803acb29) and was already present in Drupal 10.6.17 when TuxCare onboarded it. The fix adds exception handling for NotFoundHttpException in ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.9.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.9.1-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2022-24775 does not affect version 1.9.1-p1+tuxcare of guzzlehttp/psr7. The target repository at version 1.9.1-p2+tuxcare is NOT affected by CVE-2022-24775. The vulnerability pattern (missing validation of carriage return/newline characters in HTTP headers) is not present because the fix was already included in the upstream 1.9.1 release that TuxCare onboarded. The assertValue() method in src/MessageTrait.php (lines 277-295) validates header values using regex /^[\\x20\\x09\\x21-\\x7E\\x80-\\xFF]*$/D which properly rejects control characters including \\r (0x0D) and \\n (0x0A), preventing HTTP header injection attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-24775" }, "impact_statement": "The target repository at version 1.9.1-p2+tuxcare is NOT affected by CVE-2022-24775. The vulnerability pattern (missing validation of carriage return/newline characters in HTTP headers) is not present because the fix was already included in the upstream 1.9.1 release that TuxCare onboarded. The assertValue() method in src/MessageTrait.php (lines 277-295) validates header values using regex /^[\\x20\\x09\\x21-\\x7E\\x80-\\xFF]*$/D which properly rejects control characters including \\r (0x0D) and \\n (0x0A), preventing HTTP header injection attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.9.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.9.1-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:40:33.053070+00:00", "status_notes": "Vulnerability CVE-2023-29197 does not affect version 1.9.1-p1+tuxcare of guzzlehttp/psr7. not_affected \u2014 The target repository (guzzlehttp/psr7 version 1.9.1-p2+tuxcare) is not affected by CVE-2023-29197. The vulnerability involves improper header validation allowing newline injection in HTTP header names and values. The fix (adding PCRE /D modifier to regex patterns to prevent $ from matching before trailing newlines) was included in upstream release 1.9.1 (April 17, 2023) by Graham Campbell and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-29197" }, "impact_statement": "not_affected \u2014 The target repository (guzzlehttp/psr7 version 1.9.1-p2+tuxcare) is not affected by CVE-2023-29197. The vulnerability involves improper header validation allowing newline injection in HTTP header names and values. The fix (adding PCRE /D modifier to regex patterns to prevent $ from matching before trailing newlines) was included in upstream release 1.9.1 (April 17, 2023) by Graham Campbell and ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.9.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.9.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48998 is fixed in version 1.9.1-p1+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-48998" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.9.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.9.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49214 is fixed in version 1.9.1-p1+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-49214" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.9.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.9.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55766 is fixed in version 1.9.1-p1+tuxcare of guzzlehttp/psr7.", "vulnerability": { "name": "CVE-2026-55766" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/psr7@1.9.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/psr7@1.9.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59882 affects version 1.9.1-p1+tuxcare of guzzlehttp/psr7, and is fixed in 1.9.1-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-59882" }, "action_statement": "Vulnerability CVE-2026-59882 affects version 1.9.1-p1+tuxcare of guzzlehttp/psr7, and is fixed in 1.9.1-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-10-29T05:10:28.546830+00:00", "status_notes": "Vulnerability CVE-2022-25270 does not affect version 9.5.11-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25270" }, "impact_statement": "not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:12:46.442569+00:00", "status_notes": "Vulnerability CVE-2022-25271 does not affect version 9.5.11-p1+tuxcare of drupal/core. CVE-2022-25271 is NOT present in the target. The vulnerable pattern (allowing user input to overwrite 'value' type form elements) was fixed in upstream Drupal releases SA-CORE-2022-003 (Feb 2022) and SA-CORE-2022-008 (Apr 2022). Drupal 9.5.11 (released Sept 2023) shipped with the comprehensive fix that excludes both 'item' and 'value' type elements from being processed as user input. The target repository's snapshot commit imported this already-fixed upstream version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25271" }, "impact_statement": "CVE-2022-25271 is NOT present in the target. The vulnerable pattern (allowing user input to overwrite 'value' type form elements) was fixed in upstream Drupal releases SA-CORE-2022-003 (Feb 2022) and SA-CORE-2022-008 (Apr 2022). Drupal 9.5.11 (released Sept 2023) shipped with the comprehensive fix that excludes both 'item' and 'value' type elements from being processed as user input. The target repository's snapshot commit imported this already-fixed upstream version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25273 does not affect version 9.5.11-p1+tuxcare of drupal/core. CVE-2022-25273 is not present in Drupal 9.5.11-p7+tuxcare. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-008 (April 2022), and the fix was already included in the Drupal 9.5.11 release (September 2023) that TuxCare later imported. The target code contains the patched version that excludes both 'item' and 'value' type form elements from input processing, preventing attackers from overwriting display-only form element values.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25273" }, "impact_statement": "CVE-2022-25273 is not present in Drupal 9.5.11-p7+tuxcare. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-008 (April 2022), and the fix was already included in the Drupal 9.5.11 release (September 2023) that TuxCare later imported. The target code contains the patched version that excludes both 'item' and 'value' type form elements from input processing, preventing attackers from overwriting display-only form element values." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25275 does not affect version 9.5.11-p1+tuxcare of drupal/core. The target repository (Drupal 9.5.11) is not affected by CVE-2022-25275. The SA-CORE-2022-012 security fix was already present in the upstream Drupal 9.5.11 release when TuxCare created the initial snapshot (commit 8233a54800). All three components of the fix are present: (1) ImageStyleDownloadController.php uses `$is_public` logic with `file_additional_public_schemes` support instead of hardcoded `$scheme == 'private'` check; (2) PublicStream.php has the `getLocalPath()` override that prevents accessing private files via public scheme; (3) system.module implements `system_file_download()` hook for additional public schemes. No TuxCare backport was required for version 9.5.11 (backport e12f4968b6 exists only for 8.9.20). The vulnerable pattern is not present in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25275" }, "impact_statement": "The target repository (Drupal 9.5.11) is not affected by CVE-2022-25275. The SA-CORE-2022-012 security fix was already present in the upstream Drupal 9.5.11 release when TuxCare created the initial snapshot (commit 8233a54800). All three components of the fix are present: (1) ImageStyleDownloadController.php uses `$is_public` logic with `file_additional_public_schemes` support instead of hardcoded `$scheme == 'private'` check; (2) PublicStream.php has the `getLocalPath()` override that prevents accessing private files via public scheme; (3) system.module implements `system_file_download()` hook for additional public schemes. No TuxCare backport was required for version 9.5.11 (backport e12f4968b6 exists only for 8.9.20). The vulnerable pattern is not present in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-10-29T01:55:18.385525+00:00", "status_notes": "Vulnerability CVE-2022-25276 does not affect version 9.5.11-p1+tuxcare of drupal/core. not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25276" }, "impact_statement": "not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25277 does not affect version 9.5.11-p1+tuxcare of drupal/core. The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25277. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-014 on July 20, 2022, and the fix was already present in the upstream Drupal 9.5.11 release (September 19, 2023) that TuxCare imported via snapshot commit 8233a54800. Both required defenses are present: (1) 'htaccess' added to INSECURE_EXTENSIONS array, and (2) special handling for dot-files that are also insecure extensions (e.g., .htaccess) to prevent bypass when administrators configure htaccess as an allowed extension.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25277" }, "impact_statement": "The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25277. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-014 on July 20, 2022, and the fix was already present in the upstream Drupal 9.5.11 release (September 19, 2023) that TuxCare imported via snapshot commit 8233a54800. Both required defenses are present: (1) 'htaccess' added to INSECURE_EXTENSIONS array, and (2) special handling for dot-files that are also insecure extensions (e.g., .htaccess) to prevent bypass when administrators configure htaccess as an allowed extension." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2022-25278 does not affect version 9.5.11-p1+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25278" }, "impact_statement": "not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2023-5256 does not affect version 9.5.11-p1+tuxcare of drupal/core. The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2023-5256. The vulnerability fix (SA-CORE-2023-006) was already included in the upstream Drupal 9.5.11 release that TuxCare onboarded. The fix prevents sensitive error backtraces from being cached and exposed to unauthorized users by adding two protections: (1) setting cache max-age to 0 when verbose error reporting is enabled, and (2) requiring both 'access site reports' permission AND ERROR_REPORTING_DISPLAY_VERBOSE setting to show backtraces, instead of only checking the permission.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-5256" }, "impact_statement": "The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2023-5256. The vulnerability fix (SA-CORE-2023-006) was already included in the upstream Drupal 9.5.11 release that TuxCare onboarded. The fix prevents sensitive error backtraces from being cached and exposed to unauthorized users by adding two protections: (1) setting cache max-age to 0 when verbose error reporting is enabled, and (2) requiring both 'access site reports' permission AND ERROR_REPORTING_DISPLAY_VERBOSE setting to show backtraces, instead of only checking the permission." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 9.5.11-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45440 is fixed in version 9.5.11-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-45440" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 9.5.11-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 9.5.11-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 9.5.11-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 9.5.11-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13080 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p4+tuxcare.", "vulnerability": { "name": "CVE-2025-13080" }, "action_statement": "Vulnerability CVE-2025-13080 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13081 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13081" }, "action_statement": "Vulnerability CVE-2025-13081 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13082 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13082" }, "action_statement": "Vulnerability CVE-2025-13082 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13083 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13083" }, "action_statement": "Vulnerability CVE-2025-13083 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 9.5.11-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 9.5.11-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 9.5.11-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 9.5.11-p1+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2026-108097 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-108097" }, "action_statement": "Vulnerability CVE-2026-108097 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-10-16T16:27:00.115201+00:00", "status_notes": "Vulnerability CVE-2026-108515 does not affect version 9.5.11-p1+tuxcare of drupal/core. not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-108515" }, "impact_statement": "not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6365 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-6365" }, "action_statement": "Vulnerability CVE-2026-6365 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6366 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-6366" }, "action_statement": "Vulnerability CVE-2026-6366 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9082 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-9082" }, "action_statement": "Vulnerability CVE-2026-9082 affects version 9.5.11-p1+tuxcare of drupal/core, and is fixed in 9.5.11-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6CCV-8FGF-CJPW is fixed in version 9.5.11-p1+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6CCV-8FGF-CJPW" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw does not affect version 9.5.11-p1+tuxcare of drupal/core. already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" }, "impact_statement": "already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2025-46734 does not affect version 2.8.2-p4+tuxcare of league/commonmark. not_affected \u2014 Target version 2.8.2-p4+tuxcare is not affected by CVE-2025-46734. The XSS vulnerability in the Attributes extension was fixed by upstream maintainer Colin O'Dell in commit 43207253 (May 5, 2025), which was included in upstream release 2.7.0. When TuxCare onboarded version 2.8.2 via snapshot commit 9e8d7678 (May 13, 2026), the fix was already present. All three mitigation measures from the CVE ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46734" }, "impact_statement": "not_affected \u2014 Target version 2.8.2-p4+tuxcare is not affected by CVE-2025-46734. The XSS vulnerability in the Attributes extension was fixed by upstream maintainer Colin O'Dell in commit 43207253 (May 5, 2025), which was included in upstream release 2.7.0. When TuxCare onboarded version 2.8.2 via snapshot commit 9e8d7678 (May 13, 2026), the fix was already present. All three mitigation measures from the CVE ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2026-30838 does not affect version 2.8.2-p4+tuxcare of league/commonmark. not_affected \u2014 The target (league/commonmark version 2.8.2) is not affected by CVE-2026-30838. The vulnerability involves a DisallowedRawHtml extension regex bypass allowing XSS via whitespace (newline/tab) between HTML tag names and closing `>`. The vulnerable pattern `[ \\/>]` (matches only space) was fixed upstream in version 2.8.1 by changing to `[\\s\\/>]` (matches all whitespace). The TuxCare snapshot impo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-30838" }, "impact_statement": "not_affected \u2014 The target (league/commonmark version 2.8.2) is not affected by CVE-2026-30838. The vulnerability involves a DisallowedRawHtml extension regex bypass allowing XSS via whitespace (newline/tab) between HTML tag names and closing `>`. The vulnerable pattern `[ \\/>]` (matches only space) was fixed upstream in version 2.8.1 by changing to `[\\s\\/>]` (matches all whitespace). The TuxCare snapshot impo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 2.8.2-p4+tuxcare of league/commonmark. not_affected \u2014 CVE-2026-33347 describes a regex-based allowlist bypass in DomainFilteringAdapter where domains like `youtube.com.evil` could match allowlist entry `youtube.com`, enabling SSRF and XSS attacks. The target (version 2.8.2, SHA 48469075) contains the fixed implementation that uses `parse_url()` for explicit hostname extraction and proper boundary checking via `\\str_ends_with($host, '.' . $domain)`...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "not_affected \u2014 CVE-2026-33347 describes a regex-based allowlist bypass in DomainFilteringAdapter where domains like `youtube.com.evil` could match allowlist entry `youtube.com`, enabling SSRF and XSS attacks. The target (version 2.8.2, SHA 48469075) contains the fixed implementation that uses `parse_url()` for explicit hostname extraction and proper boundary checking via `\\str_ends_with($host, '.' . $domain)`..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability CVE-2026-71478 is fixed in version 2.8.2-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71478" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability CVE-2026-71488 is fixed in version 2.8.2-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71488" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability GHSA-3q6v-r5mr-hxv8 is fixed in version 2.8.2-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-3q6v-r5mr-hxv8" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability GHSA-8rr7-cvq3-gmfh is fixed in version 2.8.2-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-8rr7-cvq3-gmfh" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability GHSA-97jj-33gv-5xf9 is fixed in version 2.8.2-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-97jj-33gv-5xf9" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-11-03T10:18:21.473206+00:00", "status_notes": "Vulnerability GHSA-c2pc-g5qf-rfrf does not affect version 2.8.2-p4+tuxcare of league/commonmark. Target version 2.8.2 is NOT vulnerable to GHSA-c2pc-g5qf-rfrf. The advisory states the vulnerability was patched in version 2.6.0, and the target is 2.8.2 > 2.6.0. All required algorithmic defenses against polynomial time complexity are present in the upstream 2.8.2 release that TuxCare onboarded: delimiter stack size limits, openersBottom cache optimization for O(n\u00b2) prevention, memory-limited reference maps, and optimized multibyte handling. The comprehensive pathological test suite covering all referenced CVEs is also present. No TuxCare backport for this GHSA exists; the fixes came with the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c2pc-g5qf-rfrf" }, "impact_statement": "Target version 2.8.2 is NOT vulnerable to GHSA-c2pc-g5qf-rfrf. The advisory states the vulnerability was patched in version 2.6.0, and the target is 2.8.2 > 2.6.0. All required algorithmic defenses against polynomial time complexity are present in the upstream 2.8.2 release that TuxCare onboarded: delimiter stack size limits, openersBottom cache optimization for O(n\u00b2) prevention, memory-limited reference maps, and optimized multibyte handling. The comprehensive pathological test suite covering all referenced CVEs is also present. No TuxCare backport for this GHSA exists; the fixes came with the upstream release." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability GHSA-f8fg-pg57-v4j8 is fixed in version 2.8.2-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-f8fg-pg57-v4j8" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability GHSA-g2gp-3wwq-f4ph is fixed in version 2.8.2-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-g2gp-3wwq-f4ph" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability GHSA-j8pm-gj4c-rq4x is fixed in version 2.8.2-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-j8pm-gj4c-rq4x" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability GHSA-jfm3-95jq-q3rf is fixed in version 2.8.2-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jfm3-95jq-q3rf" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability GHSA-jjv6-8j6v-6j52 is fixed in version 2.8.2-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jjv6-8j6v-6j52" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability GHSA-mh25-x5hq-wrqp is fixed in version 2.8.2-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mh25-x5hq-wrqp" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability GHSA-mj63-m3rc-8ppr is fixed in version 2.8.2-p4+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mj63-m3rc-8ppr" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2025-46734 does not affect version 2.7.1-p2+tuxcare of league/commonmark. not_affected \u2014 CVE-2025-46734 describes an XSS vulnerability in league/commonmark versions 1.5.0 through 2.6.x where the Attributes extension allows injection of malicious JavaScript via event handler attributes like `onerror`. Version 2.7.0 introduced three defenses: (1) blocking attributes starting with `on`, (2) enforcing an attribute allowlist, and (3) making href/src respect `allow_unsafe_links` configur...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46734" }, "impact_statement": "not_affected \u2014 CVE-2025-46734 describes an XSS vulnerability in league/commonmark versions 1.5.0 through 2.6.x where the Attributes extension allows injection of malicious JavaScript via event handler attributes like `onerror`. Version 2.7.0 introduced three defenses: (1) blocking attributes starting with `on`, (2) enforcing an attribute allowlist, and (3) making href/src respect `allow_unsafe_links` configur..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-30838 is fixed in version 2.7.1-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-30838" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 is fixed in version 2.7.1-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-33347" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71478 is fixed in version 2.7.1-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71478" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71488 is fixed in version 2.7.1-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71488" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 2.7.1-p2+tuxcare of league/commonmark, and is fixed in 2.7.1-p4+tuxcare.", "vulnerability": { "name": "GHSA-3q6v-r5mr-hxv8" }, "action_statement": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 2.7.1-p2+tuxcare of league/commonmark, and is fixed in 2.7.1-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8rr7-cvq3-gmfh affects version 2.7.1-p2+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare.", "vulnerability": { "name": "GHSA-8rr7-cvq3-gmfh" }, "action_statement": "Vulnerability GHSA-8rr7-cvq3-gmfh affects version 2.7.1-p2+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-10-08T11:19:43.004255+00:00", "status_notes": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 2.7.1-p2+tuxcare of league/commonmark, and is fixed in 2.7.1-p4+tuxcare.", "vulnerability": { "name": "GHSA-97jj-33gv-5xf9" }, "action_statement": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 2.7.1-p2+tuxcare of league/commonmark, and is fixed in 2.7.1-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:18:21.473206+00:00", "status_notes": "Vulnerability GHSA-c2pc-g5qf-rfrf does not affect version 2.7.1-p2+tuxcare of league/commonmark. Target version 2.7.1 is not affected by GHSA-c2pc-g5qf-rfrf. This CVE was fixed in version 2.6.0 (released 2024-12-07), and the target version 2.7.1 (released 2025-07-20) already includes all the upstream security defenses. The polynomial time complexity vulnerabilities are not present because the necessary rate-limiting mechanisms (max_delimiters_per_line, table/max_autocompleted_cells, URL subdomain limits, reference link expansion limits, and optimized bracket parsing) are all active in the shipped code. These fixes came with the upstream 2.7.1 release that TuxCare onboarded, not from TuxCare backports.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c2pc-g5qf-rfrf" }, "impact_statement": "Target version 2.7.1 is not affected by GHSA-c2pc-g5qf-rfrf. This CVE was fixed in version 2.6.0 (released 2024-12-07), and the target version 2.7.1 (released 2025-07-20) already includes all the upstream security defenses. The polynomial time complexity vulnerabilities are not present because the necessary rate-limiting mechanisms (max_delimiters_per_line, table/max_autocompleted_cells, URL subdomain limits, reference link expansion limits, and optimized bracket parsing) are all active in the shipped code. These fixes came with the upstream 2.7.1 release that TuxCare onboarded, not from TuxCare backports." }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 2.7.1-p2+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare.", "vulnerability": { "name": "GHSA-f8fg-pg57-v4j8" }, "action_statement": "Vulnerability GHSA-f8fg-pg57-v4j8 affects version 2.7.1-p2+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g2gp-3wwq-f4ph is fixed in version 2.7.1-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-g2gp-3wwq-f4ph" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-j8pm-gj4c-rq4x affects version 2.7.1-p2+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare.", "vulnerability": { "name": "GHSA-j8pm-gj4c-rq4x" }, "action_statement": "Vulnerability GHSA-j8pm-gj4c-rq4x affects version 2.7.1-p2+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jfm3-95jq-q3rf is fixed in version 2.7.1-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jfm3-95jq-q3rf" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jjv6-8j6v-6j52 affects version 2.7.1-p2+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare.", "vulnerability": { "name": "GHSA-jjv6-8j6v-6j52" }, "action_statement": "Vulnerability GHSA-jjv6-8j6v-6j52 affects version 2.7.1-p2+tuxcare of league/commonmark, and is fixed in 2.7.1-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mh25-x5hq-wrqp is fixed in version 2.7.1-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mh25-x5hq-wrqp" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.7.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mj63-m3rc-8ppr is fixed in version 2.7.1-p2+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mj63-m3rc-8ppr" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2025-46734 does not affect version 2.8.2-p3+tuxcare of league/commonmark. not_affected \u2014 Target version 2.8.2-p4+tuxcare is not affected by CVE-2025-46734. The XSS vulnerability in the Attributes extension was fixed by upstream maintainer Colin O'Dell in commit 43207253 (May 5, 2025), which was included in upstream release 2.7.0. When TuxCare onboarded version 2.8.2 via snapshot commit 9e8d7678 (May 13, 2026), the fix was already present. All three mitigation measures from the CVE ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46734" }, "impact_statement": "not_affected \u2014 Target version 2.8.2-p4+tuxcare is not affected by CVE-2025-46734. The XSS vulnerability in the Attributes extension was fixed by upstream maintainer Colin O'Dell in commit 43207253 (May 5, 2025), which was included in upstream release 2.7.0. When TuxCare onboarded version 2.8.2 via snapshot commit 9e8d7678 (May 13, 2026), the fix was already present. All three mitigation measures from the CVE ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2026-30838 does not affect version 2.8.2-p3+tuxcare of league/commonmark. not_affected \u2014 The target (league/commonmark version 2.8.2) is not affected by CVE-2026-30838. The vulnerability involves a DisallowedRawHtml extension regex bypass allowing XSS via whitespace (newline/tab) between HTML tag names and closing `>`. The vulnerable pattern `[ \\/>]` (matches only space) was fixed upstream in version 2.8.1 by changing to `[\\s\\/>]` (matches all whitespace). The TuxCare snapshot impo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-30838" }, "impact_statement": "not_affected \u2014 The target (league/commonmark version 2.8.2) is not affected by CVE-2026-30838. The vulnerability involves a DisallowedRawHtml extension regex bypass allowing XSS via whitespace (newline/tab) between HTML tag names and closing `>`. The vulnerable pattern `[ \\/>]` (matches only space) was fixed upstream in version 2.8.1 by changing to `[\\s\\/>]` (matches all whitespace). The TuxCare snapshot impo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 2.8.2-p3+tuxcare of league/commonmark. not_affected \u2014 CVE-2026-33347 describes a regex-based allowlist bypass in DomainFilteringAdapter where domains like `youtube.com.evil` could match allowlist entry `youtube.com`, enabling SSRF and XSS attacks. The target (version 2.8.2, SHA 48469075) contains the fixed implementation that uses `parse_url()` for explicit hostname extraction and proper boundary checking via `\\str_ends_with($host, '.' . $domain)`...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "not_affected \u2014 CVE-2026-33347 describes a regex-based allowlist bypass in DomainFilteringAdapter where domains like `youtube.com.evil` could match allowlist entry `youtube.com`, enabling SSRF and XSS attacks. The target (version 2.8.2, SHA 48469075) contains the fixed implementation that uses `parse_url()` for explicit hostname extraction and proper boundary checking via `\\str_ends_with($host, '.' . $domain)`..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71478 is fixed in version 2.8.2-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71478" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71488 is fixed in version 2.8.2-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "CVE-2026-71488" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 2.8.2-p3+tuxcare of league/commonmark, and is fixed in 2.8.2-p4+tuxcare.", "vulnerability": { "name": "GHSA-3q6v-r5mr-hxv8" }, "action_statement": "Vulnerability GHSA-3q6v-r5mr-hxv8 affects version 2.8.2-p3+tuxcare of league/commonmark, and is fixed in 2.8.2-p4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8rr7-cvq3-gmfh is fixed in version 2.8.2-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-8rr7-cvq3-gmfh" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-10-08T11:21:00.202863+00:00", "status_notes": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 2.8.2-p3+tuxcare of league/commonmark, and is fixed in 2.8.2-p4+tuxcare.", "vulnerability": { "name": "GHSA-97jj-33gv-5xf9" }, "action_statement": "Vulnerability GHSA-97jj-33gv-5xf9 affects version 2.8.2-p3+tuxcare of league/commonmark, and is fixed in 2.8.2-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-11-03T10:18:21.473206+00:00", "status_notes": "Vulnerability GHSA-c2pc-g5qf-rfrf does not affect version 2.8.2-p3+tuxcare of league/commonmark. Target version 2.8.2 is NOT vulnerable to GHSA-c2pc-g5qf-rfrf. The advisory states the vulnerability was patched in version 2.6.0, and the target is 2.8.2 > 2.6.0. All required algorithmic defenses against polynomial time complexity are present in the upstream 2.8.2 release that TuxCare onboarded: delimiter stack size limits, openersBottom cache optimization for O(n\u00b2) prevention, memory-limited reference maps, and optimized multibyte handling. The comprehensive pathological test suite covering all referenced CVEs is also present. No TuxCare backport for this GHSA exists; the fixes came with the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c2pc-g5qf-rfrf" }, "impact_statement": "Target version 2.8.2 is NOT vulnerable to GHSA-c2pc-g5qf-rfrf. The advisory states the vulnerability was patched in version 2.6.0, and the target is 2.8.2 > 2.6.0. All required algorithmic defenses against polynomial time complexity are present in the upstream 2.8.2 release that TuxCare onboarded: delimiter stack size limits, openersBottom cache optimization for O(n\u00b2) prevention, memory-limited reference maps, and optimized multibyte handling. The comprehensive pathological test suite covering all referenced CVEs is also present. No TuxCare backport for this GHSA exists; the fixes came with the upstream release." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f8fg-pg57-v4j8 is fixed in version 2.8.2-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-f8fg-pg57-v4j8" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-g2gp-3wwq-f4ph is fixed in version 2.8.2-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-g2gp-3wwq-f4ph" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-j8pm-gj4c-rq4x is fixed in version 2.8.2-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-j8pm-gj4c-rq4x" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jfm3-95jq-q3rf is fixed in version 2.8.2-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jfm3-95jq-q3rf" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jjv6-8j6v-6j52 is fixed in version 2.8.2-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-jjv6-8j6v-6j52" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mh25-x5hq-wrqp is fixed in version 2.8.2-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mh25-x5hq-wrqp" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/league/commonmark@2.8.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mj63-m3rc-8ppr is fixed in version 2.8.2-p3+tuxcare of league/commonmark.", "vulnerability": { "name": "GHSA-mj63-m3rc-8ppr" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-10-29T05:10:28.546830+00:00", "status_notes": "Vulnerability CVE-2022-25270 does not affect version 9.5.11-p5+tuxcare of drupal/core. not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25270" }, "impact_statement": "not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-11-03T10:12:46.442569+00:00", "status_notes": "Vulnerability CVE-2022-25271 does not affect version 9.5.11-p5+tuxcare of drupal/core. CVE-2022-25271 is NOT present in the target. The vulnerable pattern (allowing user input to overwrite 'value' type form elements) was fixed in upstream Drupal releases SA-CORE-2022-003 (Feb 2022) and SA-CORE-2022-008 (Apr 2022). Drupal 9.5.11 (released Sept 2023) shipped with the comprehensive fix that excludes both 'item' and 'value' type elements from being processed as user input. The target repository's snapshot commit imported this already-fixed upstream version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25271" }, "impact_statement": "CVE-2022-25271 is NOT present in the target. The vulnerable pattern (allowing user input to overwrite 'value' type form elements) was fixed in upstream Drupal releases SA-CORE-2022-003 (Feb 2022) and SA-CORE-2022-008 (Apr 2022). Drupal 9.5.11 (released Sept 2023) shipped with the comprehensive fix that excludes both 'item' and 'value' type elements from being processed as user input. The target repository's snapshot commit imported this already-fixed upstream version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25273 does not affect version 9.5.11-p5+tuxcare of drupal/core. CVE-2022-25273 is not present in Drupal 9.5.11-p7+tuxcare. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-008 (April 2022), and the fix was already included in the Drupal 9.5.11 release (September 2023) that TuxCare later imported. The target code contains the patched version that excludes both 'item' and 'value' type form elements from input processing, preventing attackers from overwriting display-only form element values.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25273" }, "impact_statement": "CVE-2022-25273 is not present in Drupal 9.5.11-p7+tuxcare. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-008 (April 2022), and the fix was already included in the Drupal 9.5.11 release (September 2023) that TuxCare later imported. The target code contains the patched version that excludes both 'item' and 'value' type form elements from input processing, preventing attackers from overwriting display-only form element values." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25275 does not affect version 9.5.11-p5+tuxcare of drupal/core. The target repository (Drupal 9.5.11) is not affected by CVE-2022-25275. The SA-CORE-2022-012 security fix was already present in the upstream Drupal 9.5.11 release when TuxCare created the initial snapshot (commit 8233a54800). All three components of the fix are present: (1) ImageStyleDownloadController.php uses `$is_public` logic with `file_additional_public_schemes` support instead of hardcoded `$scheme == 'private'` check; (2) PublicStream.php has the `getLocalPath()` override that prevents accessing private files via public scheme; (3) system.module implements `system_file_download()` hook for additional public schemes. No TuxCare backport was required for version 9.5.11 (backport e12f4968b6 exists only for 8.9.20). The vulnerable pattern is not present in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25275" }, "impact_statement": "The target repository (Drupal 9.5.11) is not affected by CVE-2022-25275. The SA-CORE-2022-012 security fix was already present in the upstream Drupal 9.5.11 release when TuxCare created the initial snapshot (commit 8233a54800). All three components of the fix are present: (1) ImageStyleDownloadController.php uses `$is_public` logic with `file_additional_public_schemes` support instead of hardcoded `$scheme == 'private'` check; (2) PublicStream.php has the `getLocalPath()` override that prevents accessing private files via public scheme; (3) system.module implements `system_file_download()` hook for additional public schemes. No TuxCare backport was required for version 9.5.11 (backport e12f4968b6 exists only for 8.9.20). The vulnerable pattern is not present in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-10-29T01:55:18.385525+00:00", "status_notes": "Vulnerability CVE-2022-25276 does not affect version 9.5.11-p5+tuxcare of drupal/core. not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25276" }, "impact_statement": "not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2022-25277 does not affect version 9.5.11-p5+tuxcare of drupal/core. The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25277. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-014 on July 20, 2022, and the fix was already present in the upstream Drupal 9.5.11 release (September 19, 2023) that TuxCare imported via snapshot commit 8233a54800. Both required defenses are present: (1) 'htaccess' added to INSECURE_EXTENSIONS array, and (2) special handling for dot-files that are also insecure extensions (e.g., .htaccess) to prevent bypass when administrators configure htaccess as an allowed extension.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25277" }, "impact_statement": "The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25277. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-014 on July 20, 2022, and the fix was already present in the upstream Drupal 9.5.11 release (September 19, 2023) that TuxCare imported via snapshot commit 8233a54800. Both required defenses are present: (1) 'htaccess' added to INSECURE_EXTENSIONS array, and (2) special handling for dot-files that are also insecure extensions (e.g., .htaccess) to prevent bypass when administrators configure htaccess as an allowed extension." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2022-25278 does not affect version 9.5.11-p5+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25278" }, "impact_statement": "not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-11-03T10:12:33.660591+00:00", "status_notes": "Vulnerability CVE-2023-5256 does not affect version 9.5.11-p5+tuxcare of drupal/core. The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2023-5256. The vulnerability fix (SA-CORE-2023-006) was already included in the upstream Drupal 9.5.11 release that TuxCare onboarded. The fix prevents sensitive error backtraces from being cached and exposed to unauthorized users by adding two protections: (1) setting cache max-age to 0 when verbose error reporting is enabled, and (2) requiring both 'access site reports' permission AND ERROR_REPORTING_DISPLAY_VERBOSE setting to show backtraces, instead of only checking the permission.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-5256" }, "impact_statement": "The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2023-5256. The vulnerability fix (SA-CORE-2023-006) was already included in the upstream Drupal 9.5.11 release that TuxCare onboarded. The fix prevents sensitive error backtraces from being cached and exposed to unauthorized users by adding two protections: (1) setting cache max-age to 0 when verbose error reporting is enabled, and (2) requiring both 'access site reports' permission AND ERROR_REPORTING_DISPLAY_VERBOSE setting to show backtraces, instead of only checking the permission." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45440 is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-45440" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13081 affects version 9.5.11-p5+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13081" }, "action_statement": "Vulnerability CVE-2025-13081 affects version 9.5.11-p5+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13082 affects version 9.5.11-p5+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13082" }, "action_statement": "Vulnerability CVE-2025-13082 affects version 9.5.11-p5+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13083 affects version 9.5.11-p5+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare.", "vulnerability": { "name": "CVE-2025-13083" }, "action_statement": "Vulnerability CVE-2025-13083 affects version 9.5.11-p5+tuxcare of drupal/core, and is fixed in 9.5.11-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-10-26T16:23:09.411063+00:00", "status_notes": "Vulnerability CVE-2026-108097 affects version 9.5.11-p5+tuxcare of drupal/core, and is fixed in 9.5.11-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-108097" }, "action_statement": "Vulnerability CVE-2026-108097 affects version 9.5.11-p5+tuxcare of drupal/core, and is fixed in 9.5.11-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-10-16T16:27:00.115201+00:00", "status_notes": "Vulnerability CVE-2026-108515 does not affect version 9.5.11-p5+tuxcare of drupal/core. not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-108515" }, "impact_statement": "not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6CCV-8FGF-CJPW is fixed in version 9.5.11-p5+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6CCV-8FGF-CJPW" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p5+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw does not affect version 9.5.11-p5+tuxcare of drupal/core. already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" }, "impact_statement": "already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laminas/laminas-diactoros@2.22.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laminas/laminas-diactoros@2.22.0-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2022-31109 does not affect version 2.22.0-p1+tuxcare of laminas/laminas-diactoros. Target version 2.22.0 is NOT vulnerable to CVE-2022-31109. The vulnerability affects versions before 2.11.1, where X-Forwarded-* headers from untrusted proxies could modify the ServerRequest URI (host/port/protocol), enabling XSS or URL poisoning. The fix was introduced in upstream version 2.11.1 (June 2022) and is present in version 2.22.0 (November 2022). The target repository contains the complete fix: FilterServerRequestInterface, FilterUsingXForwardedHeaders with trustReservedSubnets() as the secure default, and IPRange validator. The fix was shipped in the upstream release 2.22.0 that TuxCare onboarded at commit c28b499.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31109" }, "impact_statement": "Target version 2.22.0 is NOT vulnerable to CVE-2022-31109. The vulnerability affects versions before 2.11.1, where X-Forwarded-* headers from untrusted proxies could modify the ServerRequest URI (host/port/protocol), enabling XSS or URL poisoning. The fix was introduced in upstream version 2.11.1 (June 2022) and is present in version 2.22.0 (November 2022). The target repository contains the complete fix: FilterServerRequestInterface, FilterUsingXForwardedHeaders with trustReservedSubnets() as the secure default, and IPRange validator. The fix was shipped in the upstream release 2.22.0 that TuxCare onboarded at commit c28b499." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laminas/laminas-diactoros@2.22.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laminas/laminas-diactoros@2.22.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-29530 is fixed in version 2.22.0-p1+tuxcare of laminas/laminas-diactoros.", "vulnerability": { "name": "CVE-2023-29530" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-11-03T10:18:21.473206+00:00", "status_notes": "Vulnerability CVE-2022-29248 does not affect version 7.10.0-p3+tuxcare of guzzlehttp/guzzle. CVE-2022-29248 (cross-domain cookie leakage) is NOT present in the target. The vulnerability was fixed in upstream Guzzle 7.4.3 (May 2022), and the target is at version 7.10.0 (Aug 2025), which already includes the fix. The domain validation check is present in CookieJar.php:261-263 and the improved matchesDomain method in SetCookie.php:478-486. This is an upstream fix that was already part of the 7.10.0 release when TuxCare onboarded it via snapshot commit 3cfa8e02.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-29248" }, "impact_statement": "CVE-2022-29248 (cross-domain cookie leakage) is NOT present in the target. The vulnerability was fixed in upstream Guzzle 7.4.3 (May 2022), and the target is at version 7.10.0 (Aug 2025), which already includes the fix. The domain validation check is present in CookieJar.php:261-263 and the improved matchesDomain method in SetCookie.php:478-486. This is an upstream fix that was already part of the 7.10.0 release when TuxCare onboarded it via snapshot commit 3cfa8e02." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-11-03T10:18:21.473206+00:00", "status_notes": "Vulnerability CVE-2022-31042 does not affect version 7.10.0-p3+tuxcare of guzzlehttp/guzzle. CVE-2022-31042 is NOT present in guzzlehttp/guzzle 7.10.0. The vulnerability (failure to strip manually-added Cookie headers on cross-origin redirects and HTTPS-to-HTTP downgrades) was fixed in upstream Guzzle 7.4.4. The target version 7.10.0 includes this fix using Psr7\\UriComparator::isCrossOrigin() which provides equivalent protection by stripping both Authorization and Cookie headers when redirecting cross-origin (different host, scheme, or port). The fix came from the upstream 7.10.0 release, not from a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31042" }, "impact_statement": "CVE-2022-31042 is NOT present in guzzlehttp/guzzle 7.10.0. The vulnerability (failure to strip manually-added Cookie headers on cross-origin redirects and HTTPS-to-HTTP downgrades) was fixed in upstream Guzzle 7.4.4. The target version 7.10.0 includes this fix using Psr7\\UriComparator::isCrossOrigin() which provides equivalent protection by stripping both Authorization and Cookie headers when redirecting cross-origin (different host, scheme, or port). The fix came from the upstream 7.10.0 release, not from a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-11-03T10:18:21.473206+00:00", "status_notes": "Vulnerability CVE-2022-31043 does not affect version 7.10.0-p3+tuxcare of guzzlehttp/guzzle. CVE-2022-31043 describes a vulnerability where Authorization headers are not stripped on HTTPS\u2192HTTP redirect downgrades. The target version 7.10.0-p3+tuxcare is not affected because the upstream 7.10.0 release already contains a fix that strips sensitive headers on cross-origin redirects, including scheme changes. The target uses Psr7\\UriComparator::isCrossOrigin() which provides protection equivalent to (and actually more conservative than) the original CVE fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31043" }, "impact_statement": "CVE-2022-31043 describes a vulnerability where Authorization headers are not stripped on HTTPS\u2192HTTP redirect downgrades. The target version 7.10.0-p3+tuxcare is not affected because the upstream 7.10.0 release already contains a fix that strips sensitive headers on cross-origin redirects, including scheme changes. The target uses Psr7\\UriComparator::isCrossOrigin() which provides protection equivalent to (and actually more conservative than) the original CVE fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2022-31090 does not affect version 7.10.0-p3+tuxcare of guzzlehttp/guzzle. Target at 7.10.0-p3+tuxcare is NOT AFFECTED by CVE-2022-31090. The vulnerability required only host-based validation when removing curl authentication options on cross-origin redirects, allowing credential leakage when port or scheme changed. The fix (upstream commit 1dd98b05, Guzzle 7.4.5, June 2022) replaced host-only checking with comprehensive origin validation via Psr7\\UriComparator::isCrossOrigin() that validates host, port, AND scheme. Upstream Guzzle 7.10.0 already contained this fix (7.10.0 > 7.4.5). TuxCare onboarded the fixed upstream 7.10.0, so the vulnerable pattern (host-only checking) is not present in the target. The fix was authored by Graham Campbell (upstream maintainer) and shipped in the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31090" }, "impact_statement": "Target at 7.10.0-p3+tuxcare is NOT AFFECTED by CVE-2022-31090. The vulnerability required only host-based validation when removing curl authentication options on cross-origin redirects, allowing credential leakage when port or scheme changed. The fix (upstream commit 1dd98b05, Guzzle 7.4.5, June 2022) replaced host-only checking with comprehensive origin validation via Psr7\\UriComparator::isCrossOrigin() that validates host, port, AND scheme. Upstream Guzzle 7.10.0 already contained this fix (7.10.0 > 7.4.5). TuxCare onboarded the fixed upstream 7.10.0, so the vulnerable pattern (host-only checking) is not present in the target. The fix was authored by Graham Campbell (upstream maintainer) and shipped in the upstream release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-11-03T10:18:21.473206+00:00", "status_notes": "Vulnerability CVE-2022-31091 does not affect version 7.10.0-p3+tuxcare of guzzlehttp/guzzle. CVE-2022-31091 concerns sensitive header leakage (Authorization, Cookie) when following HTTP redirects to different ports. The vulnerability existed in Guzzle versions prior to 6.5.8 and 7.4.5, where the shouldStripSensitiveHeaders() method only checked for host changes or scheme downgrades, missing port changes. The target repository (guzzlehttp/guzzle version 7.10.0-p3+tuxcare) is NOT AFFECTED because the fix was already present in the upstream Guzzle 7.10.0 release that TuxCare onboarded. The vulnerable code pattern (shouldStripSensitiveHeaders checking only host/scheme) is absent; the fixed code uses Psr7\\UriComparator::isCrossOrigin() which properly treats port changes as cross-origin. The fix was authored by Graham Campbell in upstream Guzzle 7.4.5 (June 2022) and shipped in all subsequent releases including 7.10.0.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31091" }, "impact_statement": "CVE-2022-31091 concerns sensitive header leakage (Authorization, Cookie) when following HTTP redirects to different ports. The vulnerability existed in Guzzle versions prior to 6.5.8 and 7.4.5, where the shouldStripSensitiveHeaders() method only checked for host changes or scheme downgrades, missing port changes. The target repository (guzzlehttp/guzzle version 7.10.0-p3+tuxcare) is NOT AFFECTED because the fix was already present in the upstream Guzzle 7.10.0 release that TuxCare onboarded. The vulnerable code pattern (shouldStripSensitiveHeaders checking only host/scheme) is absent; the fixed code uses Psr7\\UriComparator::isCrossOrigin() which properly treats port changes as cross-origin. The fix was authored by Graham Campbell in upstream Guzzle 7.4.5 (June 2022) and shipped in all subsequent releases including 7.10.0." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55568 is fixed in version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55568" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55767 is fixed in version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55767" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59883 is fixed in version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-59883" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67339 is fixed in version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67339" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67353 is fixed in version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67353" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67354 is fixed in version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67354" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67355 is fixed in version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67355" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69245 is fixed in version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-69245" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69246 is fixed in version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-69246" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 7.10.0-p3+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 7.10.0-p3+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w is fixed in version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 is fixed in version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 is fixed in version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 7.10.0-p3+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 7.10.0-p3+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.10.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 is fixed in version 7.10.0-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpunit/phpunit@11.4.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@11.4.4-p1+tuxcare" } } ], "timestamp": "2026-11-04T00:55:03.983563+00:00", "status_notes": "Vulnerability CVE-2026-119193 does not affect version 11.4.4-p1+tuxcare of phpunit/phpunit. not_affected \u2014 PHPUnit 11.4.4 is not affected by CVE-2026-119193. The vulnerability only exists in versions 13.4.0-13.4.3 where PHPT test temporary files are created in a predictable shared directory (sys_get_temp_dir()/phpunit-phpt). Version 11.4.4 writes temporary files to the same directory as the PHPT test file itself, which is protected by standard filesystem permissions and not exploitable via the attac...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-119193" }, "impact_statement": "not_affected \u2014 PHPUnit 11.4.4 is not affected by CVE-2026-119193. The vulnerability only exists in versions 13.4.0-13.4.3 where PHPT test temporary files are created in a predictable shared directory (sys_get_temp_dir()/phpunit-phpt). Version 11.4.4 writes temporary files to the same directory as the PHPT test file itself, which is protected by standard filesystem permissions and not exploitable via the attac..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpunit/phpunit@11.4.4-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@11.4.4-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24765 is fixed in version 11.4.4-p1+tuxcare of phpunit/phpunit.", "vulnerability": { "name": "CVE-2026-24765" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpunit/phpunit@4.8.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@4.8.10-p1+tuxcare" } } ], "timestamp": "2026-11-04T00:56:17.239715+00:00", "status_notes": "Vulnerability CVE-2026-119193 does not affect version 4.8.10-p1+tuxcare of phpunit/phpunit. not_affected \u2014 PHPUnit 4.8.10 is not affected by CVE-2026-119193. This version uses a completely different architecture that does not exhibit the vulnerable pattern of writing PHPT test code to a fixed-name directory in /tmp. The CVE explicitly states \"PHPUnit 12.5 and earlier are not affected: these versions write the temporary files next to the PHPT test file.\" Version 4.8.10 (released years before the affe...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-119193" }, "impact_statement": "not_affected \u2014 PHPUnit 4.8.10 is not affected by CVE-2026-119193. This version uses a completely different architecture that does not exhibit the vulnerable pattern of writing PHPT test code to a fixed-name directory in /tmp. The CVE explicitly states \"PHPUnit 12.5 and earlier are not affected: these versions write the temporary files next to the PHPT test file.\" Version 4.8.10 (released years before the affe..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpunit/phpunit@4.8.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@4.8.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24765 is fixed in version 4.8.10-p1+tuxcare of phpunit/phpunit.", "vulnerability": { "name": "CVE-2026-24765" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpunit/phpunit@5.7.27-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@5.7.27-p1+tuxcare" } } ], "timestamp": "2026-11-04T00:56:04.277251+00:00", "status_notes": "Vulnerability CVE-2026-119193 does not affect version 5.7.27-p1+tuxcare of phpunit/phpunit. not_affected \u2014 PHPUnit version 5.7.27 is NOT affected by CVE-2026-119193. The CVE explicitly states \"PHPUnit 12.5 and earlier are not affected\" and describes a vulnerability introduced in PHPUnit 13.4.0 where temporary files for PHPT tests with code coverage are created in a fixed directory (/tmp/phpunit-phpt) that attackers can pre-create to replace test code. Version 5.7.27 uses the secure tempnam() functio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-119193" }, "impact_statement": "not_affected \u2014 PHPUnit version 5.7.27 is NOT affected by CVE-2026-119193. The CVE explicitly states \"PHPUnit 12.5 and earlier are not affected\" and describes a vulnerability introduced in PHPUnit 13.4.0 where temporary files for PHPT tests with code coverage are created in a fixed directory (/tmp/phpunit-phpt) that attackers can pre-create to replace test code. Version 5.7.27 uses the secure tempnam() functio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpunit/phpunit@5.7.27-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@5.7.27-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24765 does not affect version 5.7.27-p1+tuxcare of phpunit/phpunit. PHPUnit version 5.7.27 does not contain the vulnerable code path. The PHPT code coverage feature, including the cleanupForCoverage() method that performs unsafe deserialization of .coverage files, was introduced in later versions (between 5.7.x and 6.5.x). This version lacks all code coverage functionality for PHPT tests and never processes .coverage files, making the deserialization vulnerability impossible to trigger.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24765" }, "impact_statement": "PHPUnit version 5.7.27 does not contain the vulnerable code path. The PHPT code coverage feature, including the cleanupForCoverage() method that performs unsafe deserialization of .coverage files, was introduced in later versions (between 5.7.x and 6.5.x). This version lacks all code coverage functionality for PHPT tests and never processes .coverage files, making the deserialization vulnerability impossible to trigger." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpunit/phpunit@10.4.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@10.4.2-p1+tuxcare" } } ], "timestamp": "2026-11-04T00:55:15.845404+00:00", "status_notes": "Vulnerability CVE-2026-119193 does not affect version 10.4.2-p1+tuxcare of phpunit/phpunit. not_affected \u2014 PHPUnit 10.4.2 is not affected by CVE-2026-119193. The vulnerability affects PHPUnit 13.4.0-13.4.3, where PHPT test files are written to a fixed, predictable shared temporary directory (/tmp/phpunit-phpt). Version 10.4.2 uses a fundamentally different architecture: it writes PHPT coverage files next to the test file itself (dirname(realpath($this->filename))), not to any shared temporary direct...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-119193" }, "impact_statement": "not_affected \u2014 PHPUnit 10.4.2 is not affected by CVE-2026-119193. The vulnerability affects PHPUnit 13.4.0-13.4.3, where PHPT test files are written to a fixed, predictable shared temporary directory (/tmp/phpunit-phpt). Version 10.4.2 uses a fundamentally different architecture: it writes PHPT coverage files next to the test file itself (dirname(realpath($this->filename))), not to any shared temporary direct..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpunit/phpunit@10.4.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@10.4.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24765 is fixed in version 10.4.2-p1+tuxcare of phpunit/phpunit.", "vulnerability": { "name": "CVE-2026-24765" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpunit/phpunit@12.4.5-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@12.4.5-p1+tuxcare" } } ], "timestamp": "2026-11-04T00:55:15.845404+00:00", "status_notes": "Vulnerability CVE-2026-119193 does not affect version 12.4.5-p1+tuxcare of phpunit/phpunit. not_affected \u2014 CVE-2026-119193 affects PHPUnit 13.4.0 to 13.4.3, where PHPT tests with code coverage use a fixed, predictable temporary directory path (/tmp/phpunit-phpt) that can be pre-created by an attacker to execute arbitrary code. Version 12.4.5 does not contain this vulnerable pattern. The target writes temporary files next to the PHPT test file in the project directory (using dirname(realpath($this->f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-119193" }, "impact_statement": "not_affected \u2014 CVE-2026-119193 affects PHPUnit 13.4.0 to 13.4.3, where PHPT tests with code coverage use a fixed, predictable temporary directory path (/tmp/phpunit-phpt) that can be pre-created by an attacker to execute arbitrary code. Version 12.4.5 does not contain this vulnerable pattern. The target writes temporary files next to the PHPT test file in the project directory (using dirname(realpath($this->f..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpunit/phpunit@12.4.5-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@12.4.5-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24765 is fixed in version 12.4.5-p1+tuxcare of phpunit/phpunit.", "vulnerability": { "name": "CVE-2026-24765" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpunit/phpunit@9.5.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@9.5.28-p1+tuxcare" } } ], "timestamp": "2026-11-04T00:54:55.163264+00:00", "status_notes": "Vulnerability CVE-2026-119193 does not affect version 9.5.28-p1+tuxcare of phpunit/phpunit. not_affected \u2014 PHPUnit 9.5.28 is not affected by CVE-2026-119193. The vulnerability affects PHPUnit 13.4.0 to 13.4.3, which create PHPT test coverage files in a fixed predictable shared temp directory (/tmp/phpunit-phpt). The CVE explicitly states that PHPUnit 12.5 and earlier are not affected because these versions write temporary files next to the PHPT test file. Version 9.5.28 writes temp files to dirname(...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-119193" }, "impact_statement": "not_affected \u2014 PHPUnit 9.5.28 is not affected by CVE-2026-119193. The vulnerability affects PHPUnit 13.4.0 to 13.4.3, which create PHPT test coverage files in a fixed predictable shared temp directory (/tmp/phpunit-phpt). The CVE explicitly states that PHPUnit 12.5 and earlier are not affected because these versions write temporary files next to the PHPT test file. Version 9.5.28 writes temp files to dirname(..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpunit/phpunit@9.5.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@9.5.28-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24765 is fixed in version 9.5.28-p1+tuxcare of phpunit/phpunit.", "vulnerability": { "name": "CVE-2026-24765" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpunit/phpunit@7.5.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@7.5.20-p1+tuxcare" } } ], "timestamp": "2026-11-04T00:54:55.163264+00:00", "status_notes": "Vulnerability CVE-2026-119193 does not affect version 7.5.20-p1+tuxcare of phpunit/phpunit. not_affected \u2014 PHPUnit 7.5.20 is not affected by CVE-2026-119193. The CVE explicitly states that \"PHPUnit 12.5 and earlier are not affected: these versions write the temporary files next to the PHPT test file.\" Version 7.5.20 implements this safe behavior: the getCoverageFiles() method writes coverage temp files to the test file's own directory using dirname(realpath($this->filename)), NOT to a fixed-name sha...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-119193" }, "impact_statement": "not_affected \u2014 PHPUnit 7.5.20 is not affected by CVE-2026-119193. The CVE explicitly states that \"PHPUnit 12.5 and earlier are not affected: these versions write the temporary files next to the PHPT test file.\" Version 7.5.20 implements this safe behavior: the getCoverageFiles() method writes coverage temp files to the test file's own directory using dirname(realpath($this->filename)), NOT to a fixed-name sha..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpunit/phpunit@7.5.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@7.5.20-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24765 is fixed in version 7.5.20-p1+tuxcare of phpunit/phpunit.", "vulnerability": { "name": "CVE-2026-24765" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpunit/phpunit@6.5.14-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@6.5.14-p1+tuxcare" } } ], "timestamp": "2026-11-04T00:54:55.163264+00:00", "status_notes": "Vulnerability CVE-2026-119193 does not affect version 6.5.14-p1+tuxcare of phpunit/phpunit. not_affected \u2014 PHPUnit 6.5.14 is not affected by CVE-2026-119193. The vulnerability requires a fixed-name shared temporary directory (/tmp/phpunit-phpt) that was introduced in PHPUnit 13.4.0. Version 6.5.14 uses a different, safe mechanism: it writes PHPT test coverage files next to the test file (dirname($this->filename)), not in a shared temporary directory. The CVE explicitly states \"PHPUnit 12.5 and earli...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-119193" }, "impact_statement": "not_affected \u2014 PHPUnit 6.5.14 is not affected by CVE-2026-119193. The vulnerability requires a fixed-name shared temporary directory (/tmp/phpunit-phpt) that was introduced in PHPUnit 13.4.0. Version 6.5.14 uses a different, safe mechanism: it writes PHPT test coverage files next to the test file (dirname($this->filename)), not in a shared temporary directory. The CVE explicitly states \"PHPUnit 12.5 and earli..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpunit/phpunit@6.5.14-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@6.5.14-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24765 is fixed in version 6.5.14-p1+tuxcare of phpunit/phpunit.", "vulnerability": { "name": "CVE-2026-24765" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpunit/phpunit@4.8.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@4.8.10-p2+tuxcare" } } ], "timestamp": "2026-11-04T00:56:17.239715+00:00", "status_notes": "Vulnerability CVE-2026-119193 does not affect version 4.8.10-p2+tuxcare of phpunit/phpunit. not_affected \u2014 PHPUnit 4.8.10 is not affected by CVE-2026-119193. This version uses a completely different architecture that does not exhibit the vulnerable pattern of writing PHPT test code to a fixed-name directory in /tmp. The CVE explicitly states \"PHPUnit 12.5 and earlier are not affected: these versions write the temporary files next to the PHPT test file.\" Version 4.8.10 (released years before the affe...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-119193" }, "impact_statement": "not_affected \u2014 PHPUnit 4.8.10 is not affected by CVE-2026-119193. This version uses a completely different architecture that does not exhibit the vulnerable pattern of writing PHPT test code to a fixed-name directory in /tmp. The CVE explicitly states \"PHPUnit 12.5 and earlier are not affected: these versions write the temporary files next to the PHPT test file.\" Version 4.8.10 (released years before the affe..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpunit/phpunit@4.8.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@4.8.10-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24765 is fixed in version 4.8.10-p2+tuxcare of phpunit/phpunit.", "vulnerability": { "name": "CVE-2026-24765" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/phpunit/phpunit@8.4.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@8.4.3-p1+tuxcare" } } ], "timestamp": "2026-11-04T00:54:55.163264+00:00", "status_notes": "Vulnerability CVE-2026-119193 does not affect version 8.4.3-p1+tuxcare of phpunit/phpunit. not_affected \u2014 PHPUnit 8.4.3 is not affected by CVE-2026-119193. This CVE affects versions 13.4.0-13.4.3 where temporary files for PHPT tests with code coverage are created in a predictable shared directory (/tmp/phpunit-phpt). Version 8.4.3 writes temporary files next to the test file in the project directory, not in a shared temp directory, eliminating the attack vector. The CVE explicitly confirms: \"PHPUni...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-119193" }, "impact_statement": "not_affected \u2014 PHPUnit 8.4.3 is not affected by CVE-2026-119193. This CVE affects versions 13.4.0-13.4.3 where temporary files for PHPT tests with code coverage are created in a predictable shared directory (/tmp/phpunit-phpt). Version 8.4.3 writes temporary files next to the test file in the project directory, not in a shared temp directory, eliminating the attack vector. The CVE explicitly confirms: \"PHPUni..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/phpunit/phpunit@8.4.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/phpunit/phpunit@8.4.3-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24765 is fixed in version 8.4.3-p1+tuxcare of phpunit/phpunit.", "vulnerability": { "name": "CVE-2026-24765" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.0-p1+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 8.12.0 is NOT AFFECTED by CVE-2017-14775. The vulnerability (timing attack on remember_me token verification via database string comparison) is not present. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison. The fix was shipped in upstream Laravel 5.5.10 (September 2017) and is present in Laravel 8.12.0, which TuxCare onboarde...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Target Laravel 8.12.0 is NOT AFFECTED by CVE-2017-14775. The vulnerability (timing attack on remember_me token verification via database string comparison) is not present. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison. The fix was shipped in upstream Laravel 5.5.10 (September 2017) and is present in Laravel 8.12.0, which TuxCare onboarde..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.0-p1+tuxcare of laravel/framework. Laravel Framework v8.12.0 is not affected by CVE-2018-15133. The vulnerability involved unserialize being called on untrusted X-XSRF-TOKEN cookie values, enabling remote code execution. The upstream fix (disabling serialization for cookie encryption/decryption) was already present in Laravel v8.12.0 when TuxCare onboarded this version. The fix was originally applied by Taylor Otwell in August 2018 (commits c0eb9073, 7c90d413, 97467e3c, 240d9046), well before the v8.x release line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "Laravel Framework v8.12.0 is not affected by CVE-2018-15133. The vulnerability involved unserialize being called on untrusted X-XSRF-TOKEN cookie values, enabling remote code execution. The upstream fix (disabling serialization for cookie encryption/decryption) was already present in Laravel v8.12.0 when TuxCare onboarded this version. The fix was originally applied by Taylor Otwell in August 2018 (commits c0eb9073, 7c90d413, 97467e3c, 240d9046), well before the v8.x release line." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.0-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.0-p1+tuxcare of laravel/framework. CVE-2020-19316 command injection vulnerability is NOT present in Laravel Framework 8.12.0-p7+tuxcare. The vulnerable pattern (unescaped shell parameters in exec() call) does not exist. The fix (escapeshellarg() wrapping) was already present in upstream Laravel v8.12.0 when TuxCare onboarded it. File src/Illuminate/Filesystem/Filesystem.php line 320 correctly applies escapeshellarg() to both $link and $target parameters before passing them to exec(). Original upstream fix by Taylor Otwell (May 2019, commit 44c3feb604) shipped in Laravel 8.12.0 release (~Nov 2020), 18 months before TuxCare onboarding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 command injection vulnerability is NOT present in Laravel Framework 8.12.0-p7+tuxcare. The vulnerable pattern (unescaped shell parameters in exec() call) does not exist. The fix (escapeshellarg() wrapping) was already present in upstream Laravel v8.12.0 when TuxCare onboarded it. File src/Illuminate/Filesystem/Filesystem.php line 320 correctly applies escapeshellarg() to both $link and $target parameters before passing them to exec(). Original upstream fix by Taylor Otwell (May 2019, commit 44c3feb604) shipped in Laravel 8.12.0 release (~Nov 2020), 18 months before TuxCare onboarding." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:40:50.094173+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.0-p1+tuxcare of laravel/framework. The target Laravel 8.12.0-p7+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability fix was already present in the upstream Laravel 8.12.0 release. The affected code (GuardsAttributes.php) contains the complete patched version with isGuardableColumn() validation that blocks mass assignment to non-existent columns. The TuxCare snapshot commit (9014f5a2) simply onboarded the already-fixed upstream release; no backport was needed. CVE affected versions before 6.18.35 and 7.x before 7.24.0; Laravel 8.12.0 is post-fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel 8.12.0-p7+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability fix was already present in the upstream Laravel 8.12.0 release. The affected code (GuardsAttributes.php) contains the complete patched version with isGuardableColumn() validation that blocks mass assignment to non-existent columns. The TuxCare snapshot commit (9014f5a2) simply onboarded the already-fixed upstream release; no backport was needed. CVE affected versions before 6.18.35 and 7.x before 7.24.0; Laravel 8.12.0 is post-fix." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.0-p1+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 affects version 8.12.0-p1+tuxcare of laravel/framework, and is fixed in 8.12.0-p3+tuxcare.", "vulnerability": { "name": "CVE-2021-43808" }, "action_statement": "Vulnerability CVE-2021-43808 affects version 8.12.0-p1+tuxcare of laravel/framework, and is fixed in 8.12.0-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 8.12.0-p1+tuxcare of laravel/framework, and is fixed in 8.12.0-p3+tuxcare.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 8.12.0-p1+tuxcare of laravel/framework, and is fixed in 8.12.0-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 affects version 8.12.0-p1+tuxcare of laravel/framework, and is fixed in 8.12.0-p3+tuxcare.", "vulnerability": { "name": "CVE-2025-27515" }, "action_statement": "Vulnerability CVE-2025-27515 affects version 8.12.0-p1+tuxcare of laravel/framework, and is fixed in 8.12.0-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.0-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.0-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resource feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, Dec 2025), approximately 5 years after version 8.12.0 (Dec 2020). The target version lacks the entire JSON:API resource system, including the vulnerabl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resource feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, Dec 2025), approximately 5 years after version 8.12.0 (Dec 2020). The target version lacks the entire JSON:API resource system, including the vulnerabl..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-11-04T11:40:03.913990+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.0-p1+tuxcare of laravel/framework, and is fixed in 8.12.0-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.0-p1+tuxcare of laravel/framework, and is fixed in 8.12.0-p8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 8.12.0-p1+tuxcare of laravel/framework, and is fixed in 8.12.0-p3+tuxcare.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "action_statement": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 8.12.0-p1+tuxcare of laravel/framework, and is fixed in 8.12.0-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.12.0-p1+tuxcare of laravel/framework, and is fixed in 8.12.0-p4+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.12.0-p1+tuxcare of laravel/framework, and is fixed in 8.12.0-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:52:55.704640+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.0-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization via cookies). The upstream Laravel 8.12.0 release already contained the fix with `protected static $serialize = false`, which disables cookie serialization globally. This defense was present in the snapshot commit 9014f5a213 that imported upstream Laravel 8.12.0 into the TuxCare repository, preventing the exploita...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization via cookies). The upstream Laravel 8.12.0 release already contained the fix with `protected static $serialize = false`, which disables cookie serialization globally. This defense was present in the snapshot commit 9014f5a213 that imported upstream Laravel 8.12.0 into the TuxCare repository, preventing the exploita..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.0-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework v8.12.0 is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false instead of throwing exception when IV length is invalid) is not present because the IV length validation fix was already included in the upstream Laravel v8.12.0 release. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the defensive che...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel Framework v8.12.0 is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false instead of throwing exception when IV length is invalid) is not present because the IV length validation fix was already included in the upstream Laravel v8.12.0 release. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the defensive che..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.0-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:13:26.008802+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.0-p1+tuxcare of laravel/framework. The target Laravel framework 8.12.0-p7+tuxcare is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (encryption oracle vulnerability). The vulnerable pattern (keyless SHA1 cookie prefix) is not present because the fix was already included in the upstream Laravel 8.12.0 release. The target uses HMAC-based cookie prefixes that incorporate the encryption key, preventing attackers from crafting valid prefixes via encryption oracles.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework 8.12.0-p7+tuxcare is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (encryption oracle vulnerability). The vulnerable pattern (keyless SHA1 cookie prefix) is not present because the fix was already included in the upstream Laravel 8.12.0 release. The target uses HMAC-based cookie prefixes that incorporate the encryption key, preventing attackers from crafting valid prefixes via encryption oracles." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 8.12.0-p1+tuxcare of laravel/framework, and is fixed in 8.12.0-p3+tuxcare.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 8.12.0-p1+tuxcare of laravel/framework, and is fixed in 8.12.0-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.0-p3+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 8.12.0 is NOT AFFECTED by CVE-2017-14775. The vulnerability (timing attack on remember_me token verification via database string comparison) is not present. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison. The fix was shipped in upstream Laravel 5.5.10 (September 2017) and is present in Laravel 8.12.0, which TuxCare onboarde...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Target Laravel 8.12.0 is NOT AFFECTED by CVE-2017-14775. The vulnerability (timing attack on remember_me token verification via database string comparison) is not present. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison. The fix was shipped in upstream Laravel 5.5.10 (September 2017) and is present in Laravel 8.12.0, which TuxCare onboarde..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.0-p3+tuxcare of laravel/framework. Laravel Framework v8.12.0 is not affected by CVE-2018-15133. The vulnerability involved unserialize being called on untrusted X-XSRF-TOKEN cookie values, enabling remote code execution. The upstream fix (disabling serialization for cookie encryption/decryption) was already present in Laravel v8.12.0 when TuxCare onboarded this version. The fix was originally applied by Taylor Otwell in August 2018 (commits c0eb9073, 7c90d413, 97467e3c, 240d9046), well before the v8.x release line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "Laravel Framework v8.12.0 is not affected by CVE-2018-15133. The vulnerability involved unserialize being called on untrusted X-XSRF-TOKEN cookie values, enabling remote code execution. The upstream fix (disabling serialization for cookie encryption/decryption) was already present in Laravel v8.12.0 when TuxCare onboarded this version. The fix was originally applied by Taylor Otwell in August 2018 (commits c0eb9073, 7c90d413, 97467e3c, 240d9046), well before the v8.x release line." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.0-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.0-p3+tuxcare of laravel/framework. CVE-2020-19316 command injection vulnerability is NOT present in Laravel Framework 8.12.0-p7+tuxcare. The vulnerable pattern (unescaped shell parameters in exec() call) does not exist. The fix (escapeshellarg() wrapping) was already present in upstream Laravel v8.12.0 when TuxCare onboarded it. File src/Illuminate/Filesystem/Filesystem.php line 320 correctly applies escapeshellarg() to both $link and $target parameters before passing them to exec(). Original upstream fix by Taylor Otwell (May 2019, commit 44c3feb604) shipped in Laravel 8.12.0 release (~Nov 2020), 18 months before TuxCare onboarding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 command injection vulnerability is NOT present in Laravel Framework 8.12.0-p7+tuxcare. The vulnerable pattern (unescaped shell parameters in exec() call) does not exist. The fix (escapeshellarg() wrapping) was already present in upstream Laravel v8.12.0 when TuxCare onboarded it. File src/Illuminate/Filesystem/Filesystem.php line 320 correctly applies escapeshellarg() to both $link and $target parameters before passing them to exec(). Original upstream fix by Taylor Otwell (May 2019, commit 44c3feb604) shipped in Laravel 8.12.0 release (~Nov 2020), 18 months before TuxCare onboarding." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:40:50.094173+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.0-p3+tuxcare of laravel/framework. The target Laravel 8.12.0-p7+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability fix was already present in the upstream Laravel 8.12.0 release. The affected code (GuardsAttributes.php) contains the complete patched version with isGuardableColumn() validation that blocks mass assignment to non-existent columns. The TuxCare snapshot commit (9014f5a2) simply onboarded the already-fixed upstream release; no backport was needed. CVE affected versions before 6.18.35 and 7.x before 7.24.0; Laravel 8.12.0 is post-fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel 8.12.0-p7+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability fix was already present in the upstream Laravel 8.12.0 release. The affected code (GuardsAttributes.php) contains the complete patched version with isGuardableColumn() validation that blocks mass assignment to non-existent columns. The TuxCare snapshot commit (9014f5a2) simply onboarded the already-fixed upstream release; no backport was needed. CVE affected versions before 6.18.35 and 7.x before 7.24.0; Laravel 8.12.0 is post-fix." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.0-p3+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resource feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, Dec 2025), approximately 5 years after version 8.12.0 (Dec 2020). The target version lacks the entire JSON:API resource system, including the vulnerabl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resource feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, Dec 2025), approximately 5 years after version 8.12.0 (Dec 2020). The target version lacks the entire JSON:API resource system, including the vulnerabl..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:40:03.913990+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.0-p3+tuxcare of laravel/framework, and is fixed in 8.12.0-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.0-p3+tuxcare of laravel/framework, and is fixed in 8.12.0-p8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.12.0-p3+tuxcare of laravel/framework, and is fixed in 8.12.0-p4+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.12.0-p3+tuxcare of laravel/framework, and is fixed in 8.12.0-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:52:55.704640+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization via cookies). The upstream Laravel 8.12.0 release already contained the fix with `protected static $serialize = false`, which disables cookie serialization globally. This defense was present in the snapshot commit 9014f5a213 that imported upstream Laravel 8.12.0 into the TuxCare repository, preventing the exploita...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization via cookies). The upstream Laravel 8.12.0 release already contained the fix with `protected static $serialize = false`, which disables cookie serialization globally. This defense was present in the snapshot commit 9014f5a213 that imported upstream Laravel 8.12.0 into the TuxCare repository, preventing the exploita..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.0-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework v8.12.0 is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false instead of throwing exception when IV length is invalid) is not present because the IV length validation fix was already included in the upstream Laravel v8.12.0 release. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the defensive che...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel Framework v8.12.0 is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false instead of throwing exception when IV length is invalid) is not present because the IV length validation fix was already included in the upstream Laravel v8.12.0 release. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the defensive che..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:13:26.008802+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.0-p3+tuxcare of laravel/framework. The target Laravel framework 8.12.0-p7+tuxcare is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (encryption oracle vulnerability). The vulnerable pattern (keyless SHA1 cookie prefix) is not present because the fix was already included in the upstream Laravel 8.12.0 release. The target uses HMAC-based cookie prefixes that incorporate the encryption key, preventing attackers from crafting valid prefixes via encryption oracles.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework 8.12.0-p7+tuxcare is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (encryption oracle vulnerability). The vulnerable pattern (keyless SHA1 cookie prefix) is not present because the fix was already included in the upstream Laravel 8.12.0 release. The target uses HMAC-based cookie prefixes that incorporate the encryption key, preventing attackers from crafting valid prefixes via encryption oracles." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.2-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.2 (released December 2020) inherited the fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time compa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.2 (released December 2020) inherited the fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time compa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.2-p1+tuxcare of laravel/framework. CVE-2018-15133 describes a PHP deserialization vulnerability in Laravel's cookie decryption, allowing remote code execution via crafted X-XSRF-TOKEN values when the attacker knows the application key. The target version 8.12.2 already contains the upstream fix that disables automatic unserialization of decrypted cookie data. The fix sets static $serialize = false by default and passes this flag through the entire encryption/decryption chain (EncryptCookies::serialized() \u2192 VerifyCsrfToken::decrypt() \u2192 Encrypter::decrypt()), preventing unserialize() from being called on attacker-controlled data. The vulnerability was patched by Laravel in August 2018; version 8.12.2 (released 2020) included the fix when onboarded via snapshot commit 58ccc3bfb7 by contact@bikramlama.com.np, prior to any TuxCare involvement.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 describes a PHP deserialization vulnerability in Laravel's cookie decryption, allowing remote code execution via crafted X-XSRF-TOKEN values when the attacker knows the application key. The target version 8.12.2 already contains the upstream fix that disables automatic unserialization of decrypted cookie data. The fix sets static $serialize = false by default and passes this flag through the entire encryption/decryption chain (EncryptCookies::serialized() \u2192 VerifyCsrfToken::decrypt() \u2192 Encrypter::decrypt()), preventing unserialize() from being called on attacker-controlled data. The vulnerability was patched by Laravel in August 2018; version 8.12.2 (released 2020) included the fix when onboarded via snapshot commit 58ccc3bfb7 by contact@bikramlama.com.np, prior to any TuxCare involvement." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 8.12.2-p1+tuxcare of laravel/framework. Laravel Framework 8.12.2-p5+tuxcare contains the PendingCommand deserialization gadget (__destruct method at line 340-347) that CVE-2019-9081 describes. However, this version is not exploitable in default configuration because: (1) File-based sessions store data server-side in storage/framework/sessions/ which attackers cannot directly modify; (2) Cookie-based sessions use JSON encoding (CookieSessionHandler lines 71, 85), not PHP serialization; (3) Cache data is server-side; (4) No code path exists for attacker-controlled serialized data to reach unserialize() calls in Session\\Store (line 98) or Cache stores (FileStore line 223) without a separate vulnerability. The CVE states the vulnerability exists \"if the content is controllable\" - in default Laravel 8.12.2, serialized content is NOT attacker-controllable. While the gadget chain exists and could be exploited in combination with file upload vulnerabilities, shared hosting scenarios, or custom code that unserializes user input, these require non-default configurations or separate vulnerabilities beyond CVE-2019-9081's scope.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "Laravel Framework 8.12.2-p5+tuxcare contains the PendingCommand deserialization gadget (__destruct method at line 340-347) that CVE-2019-9081 describes. However, this version is not exploitable in default configuration because: (1) File-based sessions store data server-side in storage/framework/sessions/ which attackers cannot directly modify; (2) Cookie-based sessions use JSON encoding (CookieSessionHandler lines 71, 85), not PHP serialization; (3) Cache data is server-side; (4) No code path exists for attacker-controlled serialized data to reach unserialize() calls in Session\\Store (line 98) or Cache stores (FileStore line 223) without a separate vulnerability. The CVE states the vulnerability exists \"if the content is controllable\" - in default Laravel 8.12.2, serialized content is NOT attacker-controllable. While the gadget chain exists and could be exploited in combination with file upload vulnerabilities, shared hosting scenarios, or custom code that unserializes user input, these require non-default configurations or separate vulnerabilities beyond CVE-2019-9081's scope." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.2-p1+tuxcare of laravel/framework. The target laravel/framework version 8.12.2 is not affected by CVE-2020-19316. The vulnerability (OS command injection in the Filesystem::link() method) was fixed upstream by Taylor Otwell in May 2019 (commit 44c3feb6) for Laravel 5.8.17. The fix adds escapeshellarg() to both the $link and $target parameters before passing them to the exec() call. Since the target version 8.12.2 (released in 2020) is significantly newer than 5.8.17, the fix was already present in the upstream release that TuxCare onboarded via snapshot commit 58ccc3bfb7. The vulnerable code pattern does not exist in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target laravel/framework version 8.12.2 is not affected by CVE-2020-19316. The vulnerability (OS command injection in the Filesystem::link() method) was fixed upstream by Taylor Otwell in May 2019 (commit 44c3feb6) for Laravel 5.8.17. The fix adds escapeshellarg() to both the $link and $target parameters before passing them to the exec() call. Since the target version 8.12.2 (released in 2020) is significantly newer than 5.8.17, the fix was already present in the upstream release that TuxCare onboarded via snapshot commit 58ccc3bfb7. The vulnerable code pattern does not exist in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:41:18.186955+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.2-p1+tuxcare of laravel/framework. CVE-2020-24941 is NOT present in Laravel 8.12.2-p5+tuxcare. The vulnerability affects Laravel before 6.18.35 and 7.x before 7.24.0. The fix was committed to Laravel 6.x on August 7, 2020 (commit 897d107775), before Laravel 8.0.0 was released (September 8, 2020). Laravel 8.12.2 shipped with the fix already included. The target repository's snapshot commit (58ccc3bfb7) by contact@bikramlama.com.np brought in Laravel 8.12.2 with the complete fix: the isGuardableColumn() method validates that attribute keys correspond to actual database columns, preventing mass assignment bypass via non-existent column names.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 is NOT present in Laravel 8.12.2-p5+tuxcare. The vulnerability affects Laravel before 6.18.35 and 7.x before 7.24.0. The fix was committed to Laravel 6.x on August 7, 2020 (commit 897d107775), before Laravel 8.0.0 was released (September 8, 2020). Laravel 8.12.2 shipped with the fix already included. The target repository's snapshot commit (58ccc3bfb7) by contact@bikramlama.com.np brought in Laravel 8.12.2 with the complete fix: the isGuardableColumn() method validates that attribute keys correspond to actual database columns, preventing mass assignment bypass via non-existent column names." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.2-p1+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.2-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer which uses Tippy.js tooltips with allowHTML: true. Laravel 8.12.2 uses a completely different exception rendering system (Whoops/filp/whoops) that does not include Tippy.js or any JavaScript tooltip functionality. The vulnerable component was introduced in Laravel 11.x+, sever...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer which uses Tippy.js tooltips with allowHTML: true. Laravel 8.12.2 uses a completely different exception rendering system (Whoops/filp/whoops) that does not include Tippy.js or any JavaScript tooltip functionality. The vulnerable component was introduced in Laravel 11.x+, sever..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.2-p1+tuxcare of laravel/framework. not_affected \u2014 Target version 8.12.2 predates the introduction of Laravel's JSON:API resource feature by approximately 5 years. The vulnerable code (ResolvesJsonApiElements trait with loadMissing() call) does not exist in this version. JSON:API resources were first introduced in Laravel v12.45.0 (December 2025) via commit 2f309363, while the target is from the 8.x series released around 2020. Exhaustive searc...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Target version 8.12.2 predates the introduction of Laravel's JSON:API resource feature by approximately 5 years. The vulnerable code (ResolvesJsonApiElements trait with loadMissing() call) does not exist in this version. JSON:API resources were first introduced in Laravel v12.45.0 (December 2025) via commit 2f309363, while the target is from the 8.x series released around 2020. Exhaustive searc..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-11-04T11:42:00.096965+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.2-p1+tuxcare of laravel/framework, and is fixed in 8.12.2-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.2-p1+tuxcare of laravel/framework, and is fixed in 8.12.2-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.12.2-p1+tuxcare of laravel/framework, and is fixed in 8.12.2-p2+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.12.2-p1+tuxcare of laravel/framework, and is fixed in 8.12.2-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:53:45.635911+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.2-p1+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 8.12.2 is not affected by GHSA-6jvx-8ch9-j2jr (Laravel 5.6.30 cookie deserialization vulnerability). The fix disabling automatic cookie serialization was already present in the upstream Laravel 8.12.2 release, which predates TuxCare's onboarding of this repository. The vulnerable pattern (unsafe cookie deserialization enabling PHP object injection) is absent: EncryptCookies middl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target Laravel 8.12.2 is not affected by GHSA-6jvx-8ch9-j2jr (Laravel 5.6.30 cookie deserialization vulnerability). The fix disabling automatic cookie serialization was already present in the upstream Laravel 8.12.2 release, which predates TuxCare's onboarding of this repository. The vulnerable pattern (unsafe cookie deserialization enabling PHP object injection) is absent: EncryptCookies middl..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.2-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false when IV length is manipulated) was already fixed in the upstream Laravel 8.12.2 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 contains the required IV length validation that matches the vendor ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false when IV length is manipulated) was already fixed in the upstream Laravel 8.12.2 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 contains the required IV length validation that matches the vendor ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.2-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.2 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in Laravel 12.x's LocalFilesystemAdapter class which provides signed URL functionality for local filesystem storage. This feature does not exist in Laravel 8.12.2, which uses a different architecture where local filesystem adapters cannot generate temporary signed URLs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.2 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in Laravel 12.x's LocalFilesystemAdapter class which provides signed URL functionality for local filesystem storage. This feature does not exist in Laravel 8.12.2, which uses a different architecture where local filesystem adapters cannot generate temporary signed URLs." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:14:55.406911+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.2-p1+tuxcare of laravel/framework. Laravel framework 8.12.2 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability involved using plain SHA1 hashes for cookie value prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The fix (using HMAC with the encryption key instead of plain SHA1) was released in Laravel 6.18.31 on July 27, 2020. Laravel 8.0.0 was released on September 8, 2020, after the security fix, so all Laravel 8.x versions including 8.12.2 shipped with the fix from their original upstream release. The target contains CookieValuePrefix class using hash_hmac() at line 16, confirming the fixed pattern is present. The vulnerable pattern (plain sha1) is absent from the codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel framework 8.12.2 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability involved using plain SHA1 hashes for cookie value prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The fix (using HMAC with the encryption key instead of plain SHA1) was released in Laravel 6.18.31 on July 27, 2020. Laravel 8.0.0 was released on September 8, 2020, after the security fix, so all Laravel 8.x versions including 8.12.2 shipped with the fix from their original upstream release. The target contains CookieValuePrefix class using hash_hmac() at line 16, confirming the fixed pattern is present. The vulnerable pattern (plain sha1) is absent from the codebase." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.2-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-7809 does not affect version v2.15.6-p2+tuxcare of twig/twig. already_fixed \u2014 CVE-2015-7809 affects Twig before version 1.20.0. The target repository is running Twig 2.15.6, which is significantly newer than the vulnerable versions. The security fix that prevents arbitrary code execution via the _self variable in Sandbox mode is present in the target code at src/Template.php lines 175-178, with explicit documentation ('avoid RCEs when sandbox is enabled') and test coverage.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-7809" }, "impact_statement": "already_fixed \u2014 CVE-2015-7809 affects Twig before version 1.20.0. The target repository is running Twig 2.15.6, which is significantly newer than the vulnerable versions. The security fix that prevents arbitrary code execution via the _self variable in Sandbox mode is present in the target code at src/Template.php lines 175-178, with explicit documentation ('avoid RCEs when sandbox is enabled') and test coverage." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2019-9942 does not affect version v2.15.6-p2+tuxcare of twig/twig. already_fixed \u2014 CVE-2019-9942 was fixed in Twig version 2.7.0 (released 2019-03-12). The target version 2.15.6 (released 2023-11-21) already contains the complete fix. The vulnerability allowed calling __toString() on objects in sandbox mode even when not allowed by the security policy. The fix introduces ensureToStringAllowed() method and CheckToStringNode wrapping mechanism that validates all implicit __toSt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-9942" }, "impact_statement": "already_fixed \u2014 CVE-2019-9942 was fixed in Twig version 2.7.0 (released 2019-03-12). The target version 2.15.6 (released 2023-11-21) already contains the complete fix. The vulnerability allowed calling __toString() on objects in sandbox mode even when not allowed by the security policy. The fix introduces ensureToStringAllowed() method and CheckToStringNode wrapping mechanism that validates all implicit __toSt..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2022-23614 does not affect version v2.15.6-p2+tuxcare of twig/twig. CVE-2022-23614 fix is already present in target v2.15.6-p2+tuxcare. The vulnerability allowed arbitrary PHP function execution via non-Closure callables in the sort filter's arrow parameter when sandbox mode is enabled. The fix adds validation (twig_check_arrow_in_sandbox) to enforce Closure-only callables in sandbox mode. This fix was authored by Fabien Potencier in upstream Twig v2.14.11 (2022-02-04) and was already present in upstream v2.15.6 when TuxCare onboarded it via snapshot commit 24b89969d.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-23614" }, "impact_statement": "CVE-2022-23614 fix is already present in target v2.15.6-p2+tuxcare. The vulnerability allowed arbitrary PHP function execution via non-Closure callables in the sort filter's arrow parameter when sandbox mode is enabled. The fix adds validation (twig_check_arrow_in_sandbox) to enforce Closure-only callables in sandbox mode. This fix was authored by Fabien Potencier in upstream Twig v2.14.11 (2022-02-04) and was already present in upstream v2.15.6 when TuxCare onboarded it via snapshot commit 24b89969d." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2022-39261 does not affect version v2.15.6-p2+tuxcare of twig/twig. Target version v2.15.6 is NOT AFFECTED by CVE-2022-39261. The path traversal vulnerability in Twig's FilesystemLoader was fixed in upstream Twig v2.15.3 (released 2022-09-28). The target is based on upstream v2.15.6, which already contains the fix. The vulnerable code pattern (validating template name before parsing namespace) is not present; instead, the fixed pattern (validating after parsing) is present at src/Loader/FilesystemLoader.php lines 209-211.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-39261" }, "impact_statement": "Target version v2.15.6 is NOT AFFECTED by CVE-2022-39261. The path traversal vulnerability in Twig's FilesystemLoader was fixed in upstream Twig v2.15.3 (released 2022-09-28). The target is based on upstream v2.15.6, which already contains the fix. The vulnerable code pattern (validating template name before parsing namespace) is not present; instead, the fixed pattern (validating after parsing) is present at src/Loader/FilesystemLoader.php lines 209-211." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45411 is fixed in version v2.15.6-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-45411" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51754 is fixed in version v2.15.6-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-51754" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51755 is fixed in version v2.15.6-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-51755" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2026-24425 does not affect version v2.15.6-p2+tuxcare of twig/twig. CVE-2026-24425 requires SourcePolicyInterface for exploitation, which does not exist in v2.15.6-p2+tuxcare. The vulnerable code pattern (calling isSandboxed() without Source parameter at CoreExtension.php:1714) exists but only becomes exploitable with SourcePolicyInterface. In v2.15.6, the existing sandbox mechanisms (global sandboxing and {% sandbox %} tag) work correctly with the current code. SourcePolicyInterface was added to Twig 2.x in December 2023 (commit a4974b29a, first in v2.16.0), after v2.15.6 was released (November 2023). The fix commits c8dfd6206 and d0579eded are not ancestors of HEAD.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24425" }, "impact_statement": "CVE-2026-24425 requires SourcePolicyInterface for exploitation, which does not exist in v2.15.6-p2+tuxcare. The vulnerable code pattern (calling isSandboxed() without Source parameter at CoreExtension.php:1714) exists but only becomes exploitable with SourcePolicyInterface. In v2.15.6, the existing sandbox mechanisms (global sandboxing and {% sandbox %} tag) work correctly with the current code. SourcePolicyInterface was added to Twig 2.x in December 2023 (commit a4974b29a, first in v2.16.0), after v2.15.6 was released (November 2023). The fix commits c8dfd6206 and d0579eded are not ancestors of HEAD." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46628 is fixed in version v2.15.6-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46628" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46633 is fixed in version v2.15.6-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46633" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:19:23.616509+00:00", "status_notes": "Vulnerability CVE-2026-46634 does not affect version v2.15.6-p2+tuxcare of twig/twig. CVE-2026-46634 describes a sandbox bypass specific to Twig 3.x when using SourcePolicyInterface for per-template sandboxing. The vulnerability occurs because templates created via template_from_string() get synthesized names (__string_template__) that SourcePolicyInterface doesn't recognize, causing sandbox checks to be skipped.\n\nTarget version 2.15.6 does NOT have SourcePolicyInterface (introduced in Twig 3.x). In v2.15.6, sandboxing is controlled by runtime state (SandboxExtension::isSandboxed()) via global configuration or {% sandbox %} tags, NOT by template names/paths. The synthesized template name has no effect on sandbox enforcement.\n\nTests in the target (SandboxTest.php lines 130-154) confirm that templates from template_from_string ARE properly sandboxed in v2.15.6. The attack chain described in the CVE cannot manifest in this architecture.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-46634" }, "impact_statement": "CVE-2026-46634 describes a sandbox bypass specific to Twig 3.x when using SourcePolicyInterface for per-template sandboxing. The vulnerability occurs because templates created via template_from_string() get synthesized names (__string_template__) that SourcePolicyInterface doesn't recognize, causing sandbox checks to be skipped.\n\nTarget version 2.15.6 does NOT have SourcePolicyInterface (introduced in Twig 3.x). In v2.15.6, sandboxing is controlled by runtime state (SandboxExtension::isSandboxed()) via global configuration or {% sandbox %} tags, NOT by template names/paths. The synthesized template name has no effect on sandbox enforcement.\n\nTests in the target (SandboxTest.php lines 130-154) confirm that templates from template_from_string ARE properly sandboxed in v2.15.6. The attack chain described in the CVE cannot manifest in this architecture." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46635 is fixed in version v2.15.6-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46635" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46638 is fixed in version v2.15.6-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46638" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:19:23.616509+00:00", "status_notes": "Vulnerability CVE-2026-46640 does not affect version v2.15.6-p2+tuxcare of twig/twig. CVE-2026-46640 affects Twig 3.15.0+ where the obj.(expr) parenthesized dynamic-attribute syntax was introduced. This syntax allows arbitrary expressions after a dot operator, enabling PHP code injection when used with _self or import aliases due to unchecked string concatenation in MacroReferenceExpression. Twig v2.15.6 does not support this syntax\u2014the parser (ExpressionParser.php:490-492) explicitly rejects parentheses after dots, throwing \"Expected name or number, got value '(' of type punctuation.\" The vulnerable MacroReferenceExpression class does not exist in 2.x. While 2.x handles macro calls via MethodCallExpression, it properly escapes method names through repr()->string() using addcslashes(), preventing code injection. The target predates the vulnerable feature by multiple major versions.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-46640" }, "impact_statement": "CVE-2026-46640 affects Twig 3.15.0+ where the obj.(expr) parenthesized dynamic-attribute syntax was introduced. This syntax allows arbitrary expressions after a dot operator, enabling PHP code injection when used with _self or import aliases due to unchecked string concatenation in MacroReferenceExpression. Twig v2.15.6 does not support this syntax\u2014the parser (ExpressionParser.php:490-492) explicitly rejects parentheses after dots, throwing \"Expected name or number, got value '(' of type punctuation.\" The vulnerable MacroReferenceExpression class does not exist in 2.x. While 2.x handles macro calls via MethodCallExpression, it properly escapes method names through repr()->string() using addcslashes(), preventing code injection. The target predates the vulnerable feature by multiple major versions." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-11-04T11:48:00.196671+00:00", "status_notes": "Vulnerability CVE-2026-47730 affects version v2.15.6-p2+tuxcare of twig/twig, and is fixed in v2.15.6-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-47730" }, "action_statement": "Vulnerability CVE-2026-47730 affects version v2.15.6-p2+tuxcare of twig/twig, and is fixed in v2.15.6-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47732 is fixed in version v2.15.6-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-47732" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48805 does not affect version v2.15.6-p2+tuxcare of twig/twig. not_affected \u2014 Twig v2.15.6 is not affected by CVE-2026-48805. The vulnerability exists only in Twig 3.26.0+ where architectural changes introduced deprecated wrapper functions in src/Resources/core.php that fail to forward sandbox state to CoreExtension methods. This architectural pattern does not exist in v2.15.6, which uses a different implementation where sandbox enforcement is correctly handled.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48805" }, "impact_statement": "not_affected \u2014 Twig v2.15.6 is not affected by CVE-2026-48805. The vulnerability exists only in Twig 3.26.0+ where architectural changes introduced deprecated wrapper functions in src/Resources/core.php that fail to forward sandbox state to CoreExtension methods. This architectural pattern does not exist in v2.15.6, which uses a different implementation where sandbox enforcement is correctly handled." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48806 is fixed in version v2.15.6-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48806" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48807 is fixed in version v2.15.6-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48807" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48808 does not affect version v2.15.6-p2+tuxcare of twig/twig. not_affected \u2014 CVE-2026-48808 does not affect Twig 2.15.6 because it specifically targets a vulnerability in sandboxing enabled through SourcePolicyInterface, which does not exist in this version. The target uses a fundamentally different architecture predating the SourcePolicyInterface feature.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48808" }, "impact_statement": "not_affected \u2014 CVE-2026-48808 does not affect Twig 2.15.6 because it specifically targets a vulnerability in sandboxing enabled through SourcePolicyInterface, which does not exist in this version. The target uses a fundamentally different architecture predating the SourcePolicyInterface feature." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49981 is fixed in version v2.15.6-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-49981" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-7809 does not affect version v2.16.1-p2+tuxcare of twig/twig. already_fixed \u2014 CVE-2015-7809 affects Twig before version 1.20.0. The target repository is Twig version 2.16.1, which contains the fix introduced in 1.20.0. The vulnerability allowed remote code execution via the _self variable in templates when Sandbox mode was enabled. The fix adds a type validation check in the displayBlock function that ensures template blocks must be instances of \\Twig\\Template, preventin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-7809" }, "impact_statement": "already_fixed \u2014 CVE-2015-7809 affects Twig before version 1.20.0. The target repository is Twig version 2.16.1, which contains the fix introduced in 1.20.0. The vulnerability allowed remote code execution via the _self variable in templates when Sandbox mode was enabled. The fix adds a type validation check in the displayBlock function that ensures template blocks must be instances of \\Twig\\Template, preventin..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2019-9942 does not affect version v2.16.1-p2+tuxcare of twig/twig. already_fixed \u2014 CVE-2019-9942 has been fixed in Twig 2.16.1. The target contains the complete mitigation introduced in Twig 2.7.0 that prevents __toString() method calls from bypassing sandbox security policy restrictions.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-9942" }, "impact_statement": "already_fixed \u2014 CVE-2019-9942 has been fixed in Twig 2.16.1. The target contains the complete mitigation introduced in Twig 2.7.0 that prevents __toString() method calls from bypassing sandbox security policy restrictions." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2022-23614 does not affect version v2.16.1-p2+tuxcare of twig/twig. The target repository (Twig v2.16.1-p2+tuxcare) is NOT AFFECTED by CVE-2022-23614. The vulnerability (sandbox bypass via non-Closure callables in the sort filter) was fixed in upstream Twig v2.14.11 (released 2022-02-04). Since the target version v2.16.1 is newer than v2.14.11, the fix was already present in the upstream release that TuxCare onboarded. The defense code (twig_check_arrow_in_sandbox validation) is present in CoreExtension.php at line 954 and blocks the attack by throwing a RuntimeError when a non-Closure callable is passed to the sort filter in sandbox mode.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-23614" }, "impact_statement": "The target repository (Twig v2.16.1-p2+tuxcare) is NOT AFFECTED by CVE-2022-23614. The vulnerability (sandbox bypass via non-Closure callables in the sort filter) was fixed in upstream Twig v2.14.11 (released 2022-02-04). Since the target version v2.16.1 is newer than v2.14.11, the fix was already present in the upstream release that TuxCare onboarded. The defense code (twig_check_arrow_in_sandbox validation) is present in CoreExtension.php at line 954 and blocks the attack by throwing a RuntimeError when a non-Closure callable is passed to the sort filter in sandbox mode." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2022-39261 does not affect version v2.16.1-p2+tuxcare of twig/twig. CVE-2022-39261 describes a path traversal vulnerability in Twig's FilesystemLoader where namespaced template names like `@foo/../file.txt` could bypass validation to read arbitrary files outside configured template directories. The target repository (twig/twig v2.16.1-p2+tuxcare) is NOT AFFECTED because the upstream fix was already present in the v2.16.1 release that TuxCare onboarded. The fix changed validation order in FilesystemLoader::findTemplate() to validate the shortname AFTER namespace parsing (lines 209-211), ensuring path traversal sequences are detected. This was an upstream fix by Fabien Potencier, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-39261" }, "impact_statement": "CVE-2022-39261 describes a path traversal vulnerability in Twig's FilesystemLoader where namespaced template names like `@foo/../file.txt` could bypass validation to read arbitrary files outside configured template directories. The target repository (twig/twig v2.16.1-p2+tuxcare) is NOT AFFECTED because the upstream fix was already present in the v2.16.1 release that TuxCare onboarded. The fix changed validation order in FilesystemLoader::findTemplate() to validate the shortname AFTER namespace parsing (lines 209-211), ensuring path traversal sequences are detected. This was an upstream fix by Fabien Potencier, not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-10-29T11:16:40.182397+00:00", "status_notes": "Vulnerability CVE-2024-45411 does not affect version v2.16.1-p2+tuxcare of twig/twig. twig/twig 2.16.1 is the upstream release that fixes CVE-2024-45411 (GHSA-6j75-5wfj-gh66: affected >2.0.0,<=2.16.0; patched 2.16.1). The upstream fix (commit 2102dd1359) is part of the 2.16.1 code. In the TuxCare build the sandbox check was later moved into Template::ensureSecurityChecked(), which runs on every sandboxed render, including templates rendered via include(). The CVE-2024-45411 regression tests (testSandboxedInclude, testSandboxedIncludeWithPreloadedTemplate) pass on this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45411" }, "impact_statement": "twig/twig 2.16.1 is the upstream release that fixes CVE-2024-45411 (GHSA-6j75-5wfj-gh66: affected >2.0.0,<=2.16.0; patched 2.16.1). The upstream fix (commit 2102dd1359) is part of the 2.16.1 code. In the TuxCare build the sandbox check was later moved into Template::ensureSecurityChecked(), which runs on every sandboxed render, including templates rendered via include(). The CVE-2024-45411 regression tests (testSandboxedInclude, testSandboxedIncludeWithPreloadedTemplate) pass on this version." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51754 is fixed in version v2.16.1-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-51754" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51755 is fixed in version v2.16.1-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-51755" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24425 is fixed in version v2.16.1-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-24425" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46628 is fixed in version v2.16.1-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46628" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46633 is fixed in version v2.16.1-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46633" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-11-04T11:49:00.031657+00:00", "status_notes": "Vulnerability CVE-2026-46634 affects version v2.16.1-p2+tuxcare of twig/twig, and is fixed in v2.16.1-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-46634" }, "action_statement": "Vulnerability CVE-2026-46634 affects version v2.16.1-p2+tuxcare of twig/twig, and is fixed in v2.16.1-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46635 is fixed in version v2.16.1-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46635" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46638 is fixed in version v2.16.1-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46638" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:19:23.616509+00:00", "status_notes": "Vulnerability CVE-2026-46640 does not affect version v2.16.1-p2+tuxcare of twig/twig. Twig 2.16.1-p2+tuxcare is not affected by CVE-2026-46640. The vulnerability requires the `obj.(expr)` dynamic-attribute syntax with parenthesized expressions, which was introduced in Twig 3.15.0 and does not exist in Twig 2.x. The target version only supports `obj.name` (static identifiers), `obj[expr]` (bracket notation), and the `attribute()` function, all of which use safe mechanisms. Additionally, the macro call path in 2.x uses `->repr()` to escape method names when generating PHP code, preventing injection even if the syntax were supported.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-46640" }, "impact_statement": "Twig 2.16.1-p2+tuxcare is not affected by CVE-2026-46640. The vulnerability requires the `obj.(expr)` dynamic-attribute syntax with parenthesized expressions, which was introduced in Twig 3.15.0 and does not exist in Twig 2.x. The target version only supports `obj.name` (static identifiers), `obj[expr]` (bracket notation), and the `attribute()` function, all of which use safe mechanisms. Additionally, the macro call path in 2.x uses `->repr()` to escape method names when generating PHP code, preventing injection even if the syntax were supported." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-11-04T11:49:00.031657+00:00", "status_notes": "Vulnerability CVE-2026-47730 affects version v2.16.1-p2+tuxcare of twig/twig, and is fixed in v2.16.1-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-47730" }, "action_statement": "Vulnerability CVE-2026-47730 affects version v2.16.1-p2+tuxcare of twig/twig, and is fixed in v2.16.1-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47732 is fixed in version v2.16.1-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-47732" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48805 does not affect version v2.16.1-p2+tuxcare of twig/twig. not_affected \u2014 CVE-2026-48805 describes a sandbox bypass in Twig v3.26.0 where deprecated wrapper functions in src/Resources/core.php fail to forward sandbox state to refactored CoreExtension class methods. Target v2.16.1 uses a completely different architecture where the vulnerable delegation pattern does not exist. The functions twig_array_some() and twig_array_every() don't exist in v2.16.1, and twig_check...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48805" }, "impact_statement": "not_affected \u2014 CVE-2026-48805 describes a sandbox bypass in Twig v3.26.0 where deprecated wrapper functions in src/Resources/core.php fail to forward sandbox state to refactored CoreExtension class methods. Target v2.16.1 uses a completely different architecture where the vulnerable delegation pattern does not exist. The functions twig_array_some() and twig_array_every() don't exist in v2.16.1, and twig_check..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48806 is fixed in version v2.16.1-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48806" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48807 is fixed in version v2.16.1-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48807" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48808 is fixed in version v2.16.1-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49981 is fixed in version v2.16.1-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-49981" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 6.20.45-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 6.20.45-p2+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:45:39.779746+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 6.20.45-p2+tuxcare of laravel/framework. CVE-2018-15133 is NOT present in Laravel 6.20.45-p6+tuxcare. The vulnerability (RCE via unserialize on X-XSRF-TOKEN) was fixed in upstream Laravel 5.6.30/5.5.41 (August 2018) by disabling cookie serialization. The fix (protected static $serialize = false; using static::serialized() in decrypt calls) was already present when Laravel 6.20.45 was released and onboarded by TuxCare. The vulnerable code pattern does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 is NOT present in Laravel 6.20.45-p6+tuxcare. The vulnerability (RCE via unserialize on X-XSRF-TOKEN) was fixed in upstream Laravel 5.6.30/5.5.41 (August 2018) by disabling cookie serialization. The fix (protected static $serialize = false; using static::serialized() in decrypt calls) was already present when Laravel 6.20.45 was released and onboarded by TuxCare. The vulnerable code pattern does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 6.20.45-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 6.20.45-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 6.20.45-p2+tuxcare of laravel/framework. The target Laravel Framework 6.20.45 is NOT vulnerable to CVE-2020-19316. The vulnerable code pattern (unescaped parameters in Windows mklink exec call) is not present. The fix using escapeshellarg() was already included in the upstream Laravel v6.20.45 release that TuxCare onboarded. The vulnerability affected Laravel before 5.8.17 (patched May 2019), and version 6.20.45 already contains the upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target Laravel Framework 6.20.45 is NOT vulnerable to CVE-2020-19316. The vulnerable code pattern (unescaped parameters in Windows mklink exec call) is not present. The fix using escapeshellarg() was already included in the upstream Laravel v6.20.45 release that TuxCare onboarded. The vulnerability affected Laravel before 5.8.17 (patched May 2019), and version 6.20.45 already contains the upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:42:21.835037+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 6.20.45-p2+tuxcare of laravel/framework. The target Laravel framework version 6.20.45-p6+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability (mass assignment bypass via non-existent column names) was fixed in upstream Laravel v6.18.35 (commit 897d107775 by Taylor Otwell). The target version 6.20.45 already contains this fix, which validates that attribute keys exist as actual database columns via the isGuardableColumn() method. The fix was shipped in the upstream release and onboarded to TuxCare via snapshot commit abbc62d18a. The vulnerable pattern (allowing mass assignment to arbitrary non-column attributes) is not present in the target code.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel framework version 6.20.45-p6+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability (mass assignment bypass via non-existent column names) was fixed in upstream Laravel v6.18.35 (commit 897d107775 by Taylor Otwell). The target version 6.20.45 already contains this fix, which validates that attribute keys exist as actual database columns via the isGuardableColumn() method. The fix was shipped in the upstream release and onboarded to TuxCare via snapshot commit abbc62d18a. The vulnerable pattern (allowing mass assignment to arbitrary non-column attributes) is not present in the target code." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 6.20.45-p2+tuxcare of laravel/framework. CVE-2021-21263 affects Laravel versions <6.20.12. The target is version 6.20.45, which includes the upstream fix that prevents query binding exploitation. The vulnerability allowed array values to be passed to query builder methods where scalar values were expected, causing incorrect binding counts and corrupted query results. The target contains comprehensive protections using a `flattenValue()` helper method across all affected methods (where, having, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, whereBetween). The fix was present in the upstream v6.20.45 release and was imported via TuxCare's snapshot commit abbc62d18a, with no subsequent modifications to the query builder.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "CVE-2021-21263 affects Laravel versions <6.20.12. The target is version 6.20.45, which includes the upstream fix that prevents query binding exploitation. The vulnerability allowed array values to be passed to query builder methods where scalar values were expected, causing incorrect binding counts and corrupted query results. The target contains comprehensive protections using a `flattenValue()` helper method across all affected methods (where, having, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, whereBetween). The fix was present in the upstream v6.20.45 release and was imported via TuxCare's snapshot commit abbc62d18a, with no subsequent modifications to the query builder." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 6.20.45-p2+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:30:41.069534+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 6.20.45-p2+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 6.20.45-p2+tuxcare of laravel/framework. The target repository (Laravel framework 6.20.45-p6+tuxcare) is not affected by CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled, allowing attackers to control environment detection through $_SERVER['argv']. The fix adds a runningInConsole() check before using argv values. This fix was already present in the upstream Laravel v6.20.45 release (authored by Taylor Otwell, taylor@laravel.com, Nov 2024) before TuxCare created their snapshot. The TuxCare branch started from a snapshot of v6.20.45 (commit abbc62d18a) which already contained the fixed code. No TuxCare backport was necessary as the vulnerable code pattern never existed in this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target repository (Laravel framework 6.20.45-p6+tuxcare) is not affected by CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled, allowing attackers to control environment detection through $_SERVER['argv']. The fix adds a runningInConsole() check before using argv values. This fix was already present in the upstream Laravel v6.20.45 release (authored by Taylor Otwell, taylor@laravel.com, Nov 2024) before TuxCare created their snapshot. The TuxCare branch started from a snapshot of v6.20.45 (commit abbc62d18a) which already contained the fixed code. No TuxCare backport was necessary as the vulnerable code pattern never existed in this branch." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 6.20.45-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:36:58.499788+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 6.20.45-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 6.20.45-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-11-04T11:46:15.891205+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 6.20.45-p2+tuxcare of laravel/framework, and is fixed in 6.20.45-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 6.20.45-p2+tuxcare of laravel/framework, and is fixed in 6.20.45-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:50:01.681995+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 6.20.45-p2+tuxcare of laravel/framework. not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 6.20.45-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:05:58.501817+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 6.20.45-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 6.20.45-p2+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 6.20.45-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 6.20.45-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:19:00.105438+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 6.20.45-p2+tuxcare of laravel/framework. Laravel Framework 6.20.45 is not affected by GHSA-qm5c-m76r-2hfr (encryption oracle RCE via cookie session driver). The vulnerability was fixed by upstream Laravel in version 6.18.31 on July 27, 2020, by replacing predictable SHA1 hash prefixes with keyed HMAC values in cookie encryption. Version 6.20.45 was released after this fix and already includes the CookieValuePrefix class with hash_hmac() implementation. The target contains the secure code pattern, not the vulnerable one.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel Framework 6.20.45 is not affected by GHSA-qm5c-m76r-2hfr (encryption oracle RCE via cookie session driver). The vulnerability was fixed by upstream Laravel in version 6.18.31 on July 27, 2020, by replacing predictable SHA1 hash prefixes with keyed HMAC values in cookie encryption. Version 6.20.45 was released after this fix and already includes the CookieValuePrefix class with hash_hmac() implementation. The target contains the secure code pattern, not the vulnerable one." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 6.20.45-p2+tuxcare of laravel/framework. not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:42:21.835037+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 6.20.45-p2+tuxcare of laravel/framework. The target repository (Laravel 6.20.45) is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involving unexpected query bindings from array values has already been fixed in the upstream Laravel release v6.20.11 (Jan 13, 2021) and v6.20.14 (Jan 21, 2021), which were released well before v6.20.45. All query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the `flattenValue()` helper method to extract scalar values from array inputs, preventing the SQL binding mismatch vulnerability. The fix was authored by Taylor Otwell for the upstream Laravel framework and was included in the v6.20.45 release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "The target repository (Laravel 6.20.45) is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involving unexpected query bindings from array values has already been fixed in the upstream Laravel release v6.20.11 (Jan 13, 2021) and v6.20.14 (Jan 21, 2021), which were released well before v6.20.45. All query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the `flattenValue()` helper method to extract scalar values from array inputs, preventing the SQL binding mismatch vulnerability. The fix was authored by Taylor Otwell for the upstream Laravel framework and was included in the v6.20.45 release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.2-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.2 (released December 2020) inherited the fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time compa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.2 (released December 2020) inherited the fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time compa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.2-p5+tuxcare of laravel/framework. CVE-2018-15133 describes a PHP deserialization vulnerability in Laravel's cookie decryption, allowing remote code execution via crafted X-XSRF-TOKEN values when the attacker knows the application key. The target version 8.12.2 already contains the upstream fix that disables automatic unserialization of decrypted cookie data. The fix sets static $serialize = false by default and passes this flag through the entire encryption/decryption chain (EncryptCookies::serialized() \u2192 VerifyCsrfToken::decrypt() \u2192 Encrypter::decrypt()), preventing unserialize() from being called on attacker-controlled data. The vulnerability was patched by Laravel in August 2018; version 8.12.2 (released 2020) included the fix when onboarded via snapshot commit 58ccc3bfb7 by contact@bikramlama.com.np, prior to any TuxCare involvement.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 describes a PHP deserialization vulnerability in Laravel's cookie decryption, allowing remote code execution via crafted X-XSRF-TOKEN values when the attacker knows the application key. The target version 8.12.2 already contains the upstream fix that disables automatic unserialization of decrypted cookie data. The fix sets static $serialize = false by default and passes this flag through the entire encryption/decryption chain (EncryptCookies::serialized() \u2192 VerifyCsrfToken::decrypt() \u2192 Encrypter::decrypt()), preventing unserialize() from being called on attacker-controlled data. The vulnerability was patched by Laravel in August 2018; version 8.12.2 (released 2020) included the fix when onboarded via snapshot commit 58ccc3bfb7 by contact@bikramlama.com.np, prior to any TuxCare involvement." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 8.12.2-p5+tuxcare of laravel/framework. Laravel Framework 8.12.2-p5+tuxcare contains the PendingCommand deserialization gadget (__destruct method at line 340-347) that CVE-2019-9081 describes. However, this version is not exploitable in default configuration because: (1) File-based sessions store data server-side in storage/framework/sessions/ which attackers cannot directly modify; (2) Cookie-based sessions use JSON encoding (CookieSessionHandler lines 71, 85), not PHP serialization; (3) Cache data is server-side; (4) No code path exists for attacker-controlled serialized data to reach unserialize() calls in Session\\Store (line 98) or Cache stores (FileStore line 223) without a separate vulnerability. The CVE states the vulnerability exists \"if the content is controllable\" - in default Laravel 8.12.2, serialized content is NOT attacker-controllable. While the gadget chain exists and could be exploited in combination with file upload vulnerabilities, shared hosting scenarios, or custom code that unserializes user input, these require non-default configurations or separate vulnerabilities beyond CVE-2019-9081's scope.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "Laravel Framework 8.12.2-p5+tuxcare contains the PendingCommand deserialization gadget (__destruct method at line 340-347) that CVE-2019-9081 describes. However, this version is not exploitable in default configuration because: (1) File-based sessions store data server-side in storage/framework/sessions/ which attackers cannot directly modify; (2) Cookie-based sessions use JSON encoding (CookieSessionHandler lines 71, 85), not PHP serialization; (3) Cache data is server-side; (4) No code path exists for attacker-controlled serialized data to reach unserialize() calls in Session\\Store (line 98) or Cache stores (FileStore line 223) without a separate vulnerability. The CVE states the vulnerability exists \"if the content is controllable\" - in default Laravel 8.12.2, serialized content is NOT attacker-controllable. While the gadget chain exists and could be exploited in combination with file upload vulnerabilities, shared hosting scenarios, or custom code that unserializes user input, these require non-default configurations or separate vulnerabilities beyond CVE-2019-9081's scope." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.2-p5+tuxcare of laravel/framework. The target laravel/framework version 8.12.2 is not affected by CVE-2020-19316. The vulnerability (OS command injection in the Filesystem::link() method) was fixed upstream by Taylor Otwell in May 2019 (commit 44c3feb6) for Laravel 5.8.17. The fix adds escapeshellarg() to both the $link and $target parameters before passing them to the exec() call. Since the target version 8.12.2 (released in 2020) is significantly newer than 5.8.17, the fix was already present in the upstream release that TuxCare onboarded via snapshot commit 58ccc3bfb7. The vulnerable code pattern does not exist in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target laravel/framework version 8.12.2 is not affected by CVE-2020-19316. The vulnerability (OS command injection in the Filesystem::link() method) was fixed upstream by Taylor Otwell in May 2019 (commit 44c3feb6) for Laravel 5.8.17. The fix adds escapeshellarg() to both the $link and $target parameters before passing them to the exec() call. Since the target version 8.12.2 (released in 2020) is significantly newer than 5.8.17, the fix was already present in the upstream release that TuxCare onboarded via snapshot commit 58ccc3bfb7. The vulnerable code pattern does not exist in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:41:18.186955+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.2-p5+tuxcare of laravel/framework. CVE-2020-24941 is NOT present in Laravel 8.12.2-p5+tuxcare. The vulnerability affects Laravel before 6.18.35 and 7.x before 7.24.0. The fix was committed to Laravel 6.x on August 7, 2020 (commit 897d107775), before Laravel 8.0.0 was released (September 8, 2020). Laravel 8.12.2 shipped with the fix already included. The target repository's snapshot commit (58ccc3bfb7) by contact@bikramlama.com.np brought in Laravel 8.12.2 with the complete fix: the isGuardableColumn() method validates that attribute keys correspond to actual database columns, preventing mass assignment bypass via non-existent column names.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 is NOT present in Laravel 8.12.2-p5+tuxcare. The vulnerability affects Laravel before 6.18.35 and 7.x before 7.24.0. The fix was committed to Laravel 6.x on August 7, 2020 (commit 897d107775), before Laravel 8.0.0 was released (September 8, 2020). Laravel 8.12.2 shipped with the fix already included. The target repository's snapshot commit (58ccc3bfb7) by contact@bikramlama.com.np brought in Laravel 8.12.2 with the complete fix: the isGuardableColumn() method validates that attribute keys correspond to actual database columns, preventing mass assignment bypass via non-existent column names." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:43:00.118804+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.2-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:43:00.118804+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.2-p5+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:43:00.118804+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.2-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:43:00.118804+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.2-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:43:00.118804+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.2-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:43:00.118804+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.2-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer which uses Tippy.js tooltips with allowHTML: true. Laravel 8.12.2 uses a completely different exception rendering system (Whoops/filp/whoops) that does not include Tippy.js or any JavaScript tooltip functionality. The vulnerable component was introduced in Laravel 11.x+, sever...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer which uses Tippy.js tooltips with allowHTML: true. Laravel 8.12.2 uses a completely different exception rendering system (Whoops/filp/whoops) that does not include Tippy.js or any JavaScript tooltip functionality. The vulnerable component was introduced in Laravel 11.x+, sever..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.2-p5+tuxcare of laravel/framework. not_affected \u2014 Target version 8.12.2 predates the introduction of Laravel's JSON:API resource feature by approximately 5 years. The vulnerable code (ResolvesJsonApiElements trait with loadMissing() call) does not exist in this version. JSON:API resources were first introduced in Laravel v12.45.0 (December 2025) via commit 2f309363, while the target is from the 8.x series released around 2020. Exhaustive searc...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Target version 8.12.2 predates the introduction of Laravel's JSON:API resource feature by approximately 5 years. The vulnerable code (ResolvesJsonApiElements trait with loadMissing() call) does not exist in this version. JSON:API resources were first introduced in Laravel v12.45.0 (December 2025) via commit 2f309363, while the target is from the 8.x series released around 2020. Exhaustive searc..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:42:00.096965+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.2-p5+tuxcare of laravel/framework, and is fixed in 8.12.2-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.2-p5+tuxcare of laravel/framework, and is fixed in 8.12.2-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:43:00.118804+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.2-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:43:00.118804+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.2-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-28T20:53:45.635911+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.2-p5+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 8.12.2 is not affected by GHSA-6jvx-8ch9-j2jr (Laravel 5.6.30 cookie deserialization vulnerability). The fix disabling automatic cookie serialization was already present in the upstream Laravel 8.12.2 release, which predates TuxCare's onboarding of this repository. The vulnerable pattern (unsafe cookie deserialization enabling PHP object injection) is absent: EncryptCookies middl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target Laravel 8.12.2 is not affected by GHSA-6jvx-8ch9-j2jr (Laravel 5.6.30 cookie deserialization vulnerability). The fix disabling automatic cookie serialization was already present in the upstream Laravel 8.12.2 release, which predates TuxCare's onboarding of this repository. The vulnerable pattern (unsafe cookie deserialization enabling PHP object injection) is absent: EncryptCookies middl..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.2-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false when IV length is manipulated) was already fixed in the upstream Laravel 8.12.2 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 contains the required IV length validation that matches the vendor ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false when IV length is manipulated) was already fixed in the upstream Laravel 8.12.2 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 contains the required IV length validation that matches the vendor ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:43:00.118804+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.2-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.2 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in Laravel 12.x's LocalFilesystemAdapter class which provides signed URL functionality for local filesystem storage. This feature does not exist in Laravel 8.12.2, which uses a different architecture where local filesystem adapters cannot generate temporary signed URLs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.2 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in Laravel 12.x's LocalFilesystemAdapter class which provides signed URL functionality for local filesystem storage. This feature does not exist in Laravel 8.12.2, which uses a different architecture where local filesystem adapters cannot generate temporary signed URLs." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:43:00.118804+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.2-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:14:55.406911+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.2-p5+tuxcare of laravel/framework. Laravel framework 8.12.2 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability involved using plain SHA1 hashes for cookie value prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The fix (using HMAC with the encryption key instead of plain SHA1) was released in Laravel 6.18.31 on July 27, 2020. Laravel 8.0.0 was released on September 8, 2020, after the security fix, so all Laravel 8.x versions including 8.12.2 shipped with the fix from their original upstream release. The target contains CookieValuePrefix class using hash_hmac() at line 16, confirming the fixed pattern is present. The vulnerable pattern (plain sha1) is absent from the codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel framework 8.12.2 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability involved using plain SHA1 hashes for cookie value prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The fix (using HMAC with the encryption key instead of plain SHA1) was released in Laravel 6.18.31 on July 27, 2020. Laravel 8.0.0 was released on September 8, 2020, after the security fix, so all Laravel 8.x versions including 8.12.2 shipped with the fix from their original upstream release. The target contains CookieValuePrefix class using hash_hmac() at line 16, confirming the fixed pattern is present. The vulnerable pattern (plain sha1) is absent from the codebase." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:43:00.118804+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.2-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:43:00.118804+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.2-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 7.30.7-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 7.30.7-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 7.30.7-p6+tuxcare is not affected by CVE-2017-14775. Both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() comparison for remember_me tokens, preventing timing attacks. This fix was already present in the upstream Laravel 7.30.7 release (originally fixed in Laravel 5.5.10 by commit 576cba749f), which TuxCare imported via snapshot commit 5082773b92.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel 7.30.7-p6+tuxcare is not affected by CVE-2017-14775. Both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() comparison for remember_me tokens, preventing timing attacks. This fix was already present in the upstream Laravel 7.30.7 release (originally fixed in Laravel 5.5.10 by commit 576cba749f), which TuxCare imported via snapshot commit 5082773b92." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 7.30.7-p2+tuxcare of laravel/framework. CVE-2018-15133 is NOT present in laravel/framework v7.30.7. The vulnerability affected versions through 5.5.40 and 5.6.x through 5.6.29. The target version (7.30.7, released in 2020) includes upstream fixes from August 2018 that disable PHP serialization for all encrypted cookies, preventing unsafe unserialize() calls on attacker-controlled cookie data. The fix was shipped in the upstream Laravel release, not applied by TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 is NOT present in laravel/framework v7.30.7. The vulnerability affected versions through 5.5.40 and 5.6.x through 5.6.29. The target version (7.30.7, released in 2020) includes upstream fixes from August 2018 that disable PHP serialization for all encrypted cookies, preventing unsafe unserialize() calls on attacker-controlled cookie data. The fix was shipped in the upstream Laravel release, not applied by TuxCare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 7.30.7-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 7.30.7-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 7.30.7-p2+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before version 5.8.17. The target version 7.30.7-p6+tuxcare already contains the upstream fix. The vulnerability was an OS command injection in the `link()` function in Filesystem.php, where user-controlled `$link` and `$target` parameters were passed to `exec(\"mklink ...\")` without proper escaping. The fix, applied by Laravel upstream in May 2019 (commit 44c3feb6), wraps both parameters with `escapeshellarg()` to prevent shell metacharacter injection. This fix was already present in Laravel 7.30.7 when TuxCare onboarded it in the snapshot commit 5082773b92.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before version 5.8.17. The target version 7.30.7-p6+tuxcare already contains the upstream fix. The vulnerability was an OS command injection in the `link()` function in Filesystem.php, where user-controlled `$link` and `$target` parameters were passed to `exec(\"mklink ...\")` without proper escaping. The fix, applied by Laravel upstream in May 2019 (commit 44c3feb6), wraps both parameters with `escapeshellarg()` to prevent shell metacharacter injection. This fix was already present in Laravel 7.30.7 when TuxCare onboarded it in the snapshot commit 5082773b92." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:42:21.835037+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 7.30.7-p2+tuxcare of laravel/framework. The target repository (laravel/framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2020-24941. The vulnerability affected Laravel versions before 6.18.35 and 7.x before 7.24.0. The target version 7.30.7 is greater than 7.24.0, and the fix was already present in the upstream v7.30.7 release that was onboarded into the TuxCare branch via snapshot commit 5082773b92. The fix adds validation to ensure mass-assigned attributes are actual database columns, preventing attackers from bypassing the $guarded property protection using fake column names with JSON-like syntax. The vulnerable code pattern (missing isGuardableColumn validation) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target repository (laravel/framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2020-24941. The vulnerability affected Laravel versions before 6.18.35 and 7.x before 7.24.0. The target version 7.30.7 is greater than 7.24.0, and the fix was already present in the upstream v7.30.7 release that was onboarded into the TuxCare branch via snapshot commit 5082773b92. The fix adds validation to ensure mass-assigned attributes are actual database columns, preventing attackers from bypassing the $guarded property protection using fake column names with JSON-like syntax. The vulnerable code pattern (missing isGuardableColumn validation) is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 7.30.7-p2+tuxcare of laravel/framework. CVE-2021-21263 affects Laravel versions <6.20.12, <7.30.3, and <8.22.1. The target is Laravel v7.30.7-p6+tuxcare, which is >7.30.3. The upstream Laravel v7.30.7 release already included the fix via the flattenValue() method and array_slice() limiting, which was snapshotted into the TuxCare branch. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) now properly limit array inputs to prevent query binding exploitation. The vulnerable pattern is not present in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "CVE-2021-21263 affects Laravel versions <6.20.12, <7.30.3, and <8.22.1. The target is Laravel v7.30.7-p6+tuxcare, which is >7.30.3. The upstream Laravel v7.30.7 release already included the fix via the flattenValue() method and array_slice() limiting, which was snapshotted into the TuxCare branch. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) now properly limit array inputs to prevent query binding exploitation. The vulnerable pattern is not present in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 7.30.7-p2+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 7.30.7-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2021-43808 (Blade XSS via predictable parent placeholder). The upstream fix was already present in v7.30.7 when TuxCare onboarded it. The fix implements random per-request salt for parent placeholders, making them unguessable and preventing XSS exploitation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2021-43808 (Blade XSS via predictable parent placeholder). The upstream fix was already present in v7.30.7 when TuxCare onboarded it. The fix implements random per-request salt for parent placeholders, making them unguessable and preventing XSS exploitation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 7.30.7-p2+tuxcare of laravel/framework. The target repository (Laravel framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled. The fix\u2014checking runningInConsole() before using $_SERVER['argv']\u2014was already present in the upstream Laravel v7.30.7 release that TuxCare imported via snapshot on 2026-05-05. The upstream fix was authored by Taylor Otwell on 2024-11-12. The target code at Application.php:560-562 correctly guards $_SERVER['argv'] access, preventing web requests from manipulating the framework's environment detection.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target repository (Laravel framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled. The fix\u2014checking runningInConsole() before using $_SERVER['argv']\u2014was already present in the upstream Laravel v7.30.7 release that TuxCare imported via snapshot on 2026-05-05. The upstream fix was authored by Taylor Otwell on 2024-11-12. The target code at Application.php:560-562 correctly guards $_SERVER['argv'] access, preventing web requests from manipulating the framework's environment detection." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 7.30.7-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:36:58.499788+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 7.30.7-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is NOT affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's exception renderer system which uses Tippy.js tooltips with `allowHTML: true` on user-controlled data. Laravel 7.30.7 predates this feature entirely and uses the Whoops library for debug mode exception handling - a completely different architecture with no Tippy.js tooltips, no `data-tippy-content` att...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is NOT affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's exception renderer system which uses Tippy.js tooltips with `allowHTML: true` on user-controlled data. Laravel 7.30.7 predates this feature entirely and uses the Whoops library for debug mode exception handling - a completely different architecture with no Tippy.js tooltips, no `data-tippy-content` att..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 7.30.7-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource system, which was introduced in version 12.x, five major versions after the target. The vulnerable pattern requires: (1) JsonApi resources processing user-supplied `include` query parameters, (2) passing unsanitized nested relationship names to `loadMissing()`, and (3) potential invocation ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource system, which was introduced in version 12.x, five major versions after the target. The vulnerable pattern requires: (1) JsonApi resources processing user-supplied `include` query parameters, (2) passing unsanitized nested relationship names to `loadMissing()`, and (3) potential invocation ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-11-04T11:50:18.837974+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 7.30.7-p2+tuxcare of laravel/framework, and is fixed in 7.30.7-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 7.30.7-p2+tuxcare of laravel/framework, and is fixed in 7.30.7-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:52:18.183384+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 7.30.7-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework v7.30.7-p6+tuxcare is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is absent because the upstream Laravel v7.30.5 release already included the fix, which adds integer casting to limit() and offset() methods in Builder.php. This version (7.30.7) inherits that upstream fix via the snapshot commit that imported the v7.30.7...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Laravel Framework v7.30.7-p6+tuxcare is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is absent because the upstream Laravel v7.30.5 release already included the fix, which adds integer casting to limit() and offset() methods in Builder.php. This version (7.30.7) inherits that upstream fix via the snapshot commit that imported the v7.30.7..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 7.30.7-p2+tuxcare of laravel/framework, and is fixed in 7.30.7-p3+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 7.30.7-p2+tuxcare of laravel/framework, and is fixed in 7.30.7-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:03:57.153420+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 7.30.7-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 7.30.7-p6+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling PHP object serialization in cookies. Laravel 7.30.7 (released September 2020) already contains this fix. The target was onboarded from the upstream Laravel 7.30.7 release, which shipped wit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 7.30.7-p6+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling PHP object serialization in cookies. Laravel 7.30.7 (released September 2020) already contains this fix. The target was onboarded from the upstream Laravel 7.30.7 release, which shipped wit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 7.30.7-p2+tuxcare of laravel/framework. not_affected \u2014 Target Laravel v7.30.7 already contains the upstream IV length validation fix. The vulnerability (GHSA-7852-w36x-6mf6) allows decryption to return false instead of throwing an exception when processing payloads with manipulated IV length. The fix validates that decoded IV length matches expected cipher IV length (Encrypter.php:214). This was authored by Taylor Otwell on March 30, 2018, and ship...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 Target Laravel v7.30.7 already contains the upstream IV length validation fix. The vulnerability (GHSA-7852-w36x-6mf6) allows decryption to return false instead of throwing an exception when processing payloads with manipulated IV length. The fix validates that decoded IV length matches expected cipher IV length (Encrypter.php:214). This was authored by Taylor Otwell on March 30, 2018, and ship..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 7.30.7-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7-p1+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in the LocalFilesystemAdapter class which provides temporary signed URL generation for local filesystems. This class and the associated local file serving feature were introduced in Laravel 9.x and do not exist in Laravel 7.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7-p1+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in the LocalFilesystemAdapter class which provides temporary signed URL generation for local filesystems. This class and the associated local file serving feature were introduced in Laravel 9.x and do not exist in Laravel 7.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:20:09.538096+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 7.30.7-p2+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 7.30.7 is NOT AFFECTED. All security fixes for GHSA-jwvj-pwww-3mj5 (preventing unexpected query bindings from array-valued parameters) were already present in the upstream Laravel 7.30.7 release before TuxCare created the snapshot. The target contains the `flattenValue()` method and uses it in all affected query builder methods (where, having, whereDate, whereTime, whereDay, wher...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 Target Laravel 7.30.7 is NOT AFFECTED. All security fixes for GHSA-jwvj-pwww-3mj5 (preventing unexpected query bindings from array-valued parameters) were already present in the upstream Laravel 7.30.7 release before TuxCare created the snapshot. The target contains the `flattenValue()` method and uses it in all affected query builder methods (where, having, whereDate, whereTime, whereDay, wher..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:19:00.105438+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 7.30.7-p2+tuxcare of laravel/framework. Laravel framework 7.30.7 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (RCE via cookie session driver + encryption oracle). The vulnerability was fixed in upstream Laravel 7.22.2 (July 27, 2020) by replacing the publicly-computable SHA1 hash cookie prefix with an HMAC requiring the secret encryption key. Laravel 7.30.7 (released October 22, 2020) already contains this fix. The TuxCare snapshot merely imported the already-patched upstream version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel framework 7.30.7 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (RCE via cookie session driver + encryption oracle). The vulnerability was fixed in upstream Laravel 7.22.2 (July 27, 2020) by replacing the publicly-computable SHA1 hash cookie prefix with an HMAC requiring the secret encryption key. Laravel 7.30.7 (released October 22, 2020) already contains this fix. The TuxCare snapshot merely imported the already-patched upstream version." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 7.30.7-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 7.30.7-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:42:21.835037+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 7.30.7-p2+tuxcare of laravel/framework. Laravel framework 7.30.7-p6+tuxcare is NOT affected by GHSA-x7p5-p2c9-phvg (unexpected query binding vulnerability). The fix was already present in the upstream Laravel v7.30.7 release, which was onboarded by TuxCare. All vulnerable query builder methods (where, having, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, havingBetween) correctly use flattenValue() to extract scalar values from arrays and limit bindings appropriately.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "Laravel framework 7.30.7-p6+tuxcare is NOT affected by GHSA-x7p5-p2c9-phvg (unexpected query binding vulnerability). The fix was already present in the upstream Laravel v7.30.7 release, which was onboarded by TuxCare. All vulnerable query builder methods (where, having, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, havingBetween) correctly use flattenValue() to extract scalar values from arrays and limit bindings appropriately." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 7.30.7-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 7.30.7-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 7.30.7-p6+tuxcare is not affected by CVE-2017-14775. Both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() comparison for remember_me tokens, preventing timing attacks. This fix was already present in the upstream Laravel 7.30.7 release (originally fixed in Laravel 5.5.10 by commit 576cba749f), which TuxCare imported via snapshot commit 5082773b92.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel 7.30.7-p6+tuxcare is not affected by CVE-2017-14775. Both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() comparison for remember_me tokens, preventing timing attacks. This fix was already present in the upstream Laravel 7.30.7 release (originally fixed in Laravel 5.5.10 by commit 576cba749f), which TuxCare imported via snapshot commit 5082773b92." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 7.30.7-p3+tuxcare of laravel/framework. CVE-2018-15133 is NOT present in laravel/framework v7.30.7. The vulnerability affected versions through 5.5.40 and 5.6.x through 5.6.29. The target version (7.30.7, released in 2020) includes upstream fixes from August 2018 that disable PHP serialization for all encrypted cookies, preventing unsafe unserialize() calls on attacker-controlled cookie data. The fix was shipped in the upstream Laravel release, not applied by TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 is NOT present in laravel/framework v7.30.7. The vulnerability affected versions through 5.5.40 and 5.6.x through 5.6.29. The target version (7.30.7, released in 2020) includes upstream fixes from August 2018 that disable PHP serialization for all encrypted cookies, preventing unsafe unserialize() calls on attacker-controlled cookie data. The fix was shipped in the upstream Laravel release, not applied by TuxCare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 7.30.7-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 7.30.7-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 7.30.7-p3+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before version 5.8.17. The target version 7.30.7-p6+tuxcare already contains the upstream fix. The vulnerability was an OS command injection in the `link()` function in Filesystem.php, where user-controlled `$link` and `$target` parameters were passed to `exec(\"mklink ...\")` without proper escaping. The fix, applied by Laravel upstream in May 2019 (commit 44c3feb6), wraps both parameters with `escapeshellarg()` to prevent shell metacharacter injection. This fix was already present in Laravel 7.30.7 when TuxCare onboarded it in the snapshot commit 5082773b92.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before version 5.8.17. The target version 7.30.7-p6+tuxcare already contains the upstream fix. The vulnerability was an OS command injection in the `link()` function in Filesystem.php, where user-controlled `$link` and `$target` parameters were passed to `exec(\"mklink ...\")` without proper escaping. The fix, applied by Laravel upstream in May 2019 (commit 44c3feb6), wraps both parameters with `escapeshellarg()` to prevent shell metacharacter injection. This fix was already present in Laravel 7.30.7 when TuxCare onboarded it in the snapshot commit 5082773b92." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:42:21.835037+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 7.30.7-p3+tuxcare of laravel/framework. The target repository (laravel/framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2020-24941. The vulnerability affected Laravel versions before 6.18.35 and 7.x before 7.24.0. The target version 7.30.7 is greater than 7.24.0, and the fix was already present in the upstream v7.30.7 release that was onboarded into the TuxCare branch via snapshot commit 5082773b92. The fix adds validation to ensure mass-assigned attributes are actual database columns, preventing attackers from bypassing the $guarded property protection using fake column names with JSON-like syntax. The vulnerable code pattern (missing isGuardableColumn validation) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target repository (laravel/framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2020-24941. The vulnerability affected Laravel versions before 6.18.35 and 7.x before 7.24.0. The target version 7.30.7 is greater than 7.24.0, and the fix was already present in the upstream v7.30.7 release that was onboarded into the TuxCare branch via snapshot commit 5082773b92. The fix adds validation to ensure mass-assigned attributes are actual database columns, preventing attackers from bypassing the $guarded property protection using fake column names with JSON-like syntax. The vulnerable code pattern (missing isGuardableColumn validation) is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 7.30.7-p3+tuxcare of laravel/framework. CVE-2021-21263 affects Laravel versions <6.20.12, <7.30.3, and <8.22.1. The target is Laravel v7.30.7-p6+tuxcare, which is >7.30.3. The upstream Laravel v7.30.7 release already included the fix via the flattenValue() method and array_slice() limiting, which was snapshotted into the TuxCare branch. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) now properly limit array inputs to prevent query binding exploitation. The vulnerable pattern is not present in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "CVE-2021-21263 affects Laravel versions <6.20.12, <7.30.3, and <8.22.1. The target is Laravel v7.30.7-p6+tuxcare, which is >7.30.3. The upstream Laravel v7.30.7 release already included the fix via the flattenValue() method and array_slice() limiting, which was snapshotted into the TuxCare branch. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) now properly limit array inputs to prevent query binding exploitation. The vulnerable pattern is not present in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 7.30.7-p3+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 7.30.7-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2021-43808 (Blade XSS via predictable parent placeholder). The upstream fix was already present in v7.30.7 when TuxCare onboarded it. The fix implements random per-request salt for parent placeholders, making them unguessable and preventing XSS exploitation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2021-43808 (Blade XSS via predictable parent placeholder). The upstream fix was already present in v7.30.7 when TuxCare onboarded it. The fix implements random per-request salt for parent placeholders, making them unguessable and preventing XSS exploitation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 7.30.7-p3+tuxcare of laravel/framework. The target repository (Laravel framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled. The fix\u2014checking runningInConsole() before using $_SERVER['argv']\u2014was already present in the upstream Laravel v7.30.7 release that TuxCare imported via snapshot on 2026-05-05. The upstream fix was authored by Taylor Otwell on 2024-11-12. The target code at Application.php:560-562 correctly guards $_SERVER['argv'] access, preventing web requests from manipulating the framework's environment detection.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target repository (Laravel framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled. The fix\u2014checking runningInConsole() before using $_SERVER['argv']\u2014was already present in the upstream Laravel v7.30.7 release that TuxCare imported via snapshot on 2026-05-05. The upstream fix was authored by Taylor Otwell on 2024-11-12. The target code at Application.php:560-562 correctly guards $_SERVER['argv'] access, preventing web requests from manipulating the framework's environment detection." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 7.30.7-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-09-29T20:36:58.499788+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 7.30.7-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is NOT affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's exception renderer system which uses Tippy.js tooltips with `allowHTML: true` on user-controlled data. Laravel 7.30.7 predates this feature entirely and uses the Whoops library for debug mode exception handling - a completely different architecture with no Tippy.js tooltips, no `data-tippy-content` att...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is NOT affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's exception renderer system which uses Tippy.js tooltips with `allowHTML: true` on user-controlled data. Laravel 7.30.7 predates this feature entirely and uses the Whoops library for debug mode exception handling - a completely different architecture with no Tippy.js tooltips, no `data-tippy-content` att..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 7.30.7-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource system, which was introduced in version 12.x, five major versions after the target. The vulnerable pattern requires: (1) JsonApi resources processing user-supplied `include` query parameters, (2) passing unsanitized nested relationship names to `loadMissing()`, and (3) potential invocation ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource system, which was introduced in version 12.x, five major versions after the target. The vulnerable pattern requires: (1) JsonApi resources processing user-supplied `include` query parameters, (2) passing unsanitized nested relationship names to `loadMissing()`, and (3) potential invocation ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:50:18.837974+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 7.30.7-p3+tuxcare of laravel/framework, and is fixed in 7.30.7-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 7.30.7-p3+tuxcare of laravel/framework, and is fixed in 7.30.7-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:52:18.183384+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 7.30.7-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework v7.30.7-p6+tuxcare is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is absent because the upstream Laravel v7.30.5 release already included the fix, which adds integer casting to limit() and offset() methods in Builder.php. This version (7.30.7) inherits that upstream fix via the snapshot commit that imported the v7.30.7...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Laravel Framework v7.30.7-p6+tuxcare is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is absent because the upstream Laravel v7.30.5 release already included the fix, which adds integer casting to limit() and offset() methods in Builder.php. This version (7.30.7) inherits that upstream fix via the snapshot commit that imported the v7.30.7..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 7.30.7-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:03:57.153420+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 7.30.7-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 7.30.7-p6+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling PHP object serialization in cookies. Laravel 7.30.7 (released September 2020) already contains this fix. The target was onboarded from the upstream Laravel 7.30.7 release, which shipped wit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 7.30.7-p6+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling PHP object serialization in cookies. Laravel 7.30.7 (released September 2020) already contains this fix. The target was onboarded from the upstream Laravel 7.30.7 release, which shipped wit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 7.30.7-p3+tuxcare of laravel/framework. not_affected \u2014 Target Laravel v7.30.7 already contains the upstream IV length validation fix. The vulnerability (GHSA-7852-w36x-6mf6) allows decryption to return false instead of throwing an exception when processing payloads with manipulated IV length. The fix validates that decoded IV length matches expected cipher IV length (Encrypter.php:214). This was authored by Taylor Otwell on March 30, 2018, and ship...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 Target Laravel v7.30.7 already contains the upstream IV length validation fix. The vulnerability (GHSA-7852-w36x-6mf6) allows decryption to return false instead of throwing an exception when processing payloads with manipulated IV length. The fix validates that decoded IV length matches expected cipher IV length (Encrypter.php:214). This was authored by Taylor Otwell on March 30, 2018, and ship..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 7.30.7-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7-p1+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in the LocalFilesystemAdapter class which provides temporary signed URL generation for local filesystems. This class and the associated local file serving feature were introduced in Laravel 9.x and do not exist in Laravel 7.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7-p1+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in the LocalFilesystemAdapter class which provides temporary signed URL generation for local filesystems. This class and the associated local file serving feature were introduced in Laravel 9.x and do not exist in Laravel 7.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:20:09.538096+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 7.30.7-p3+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 7.30.7 is NOT AFFECTED. All security fixes for GHSA-jwvj-pwww-3mj5 (preventing unexpected query bindings from array-valued parameters) were already present in the upstream Laravel 7.30.7 release before TuxCare created the snapshot. The target contains the `flattenValue()` method and uses it in all affected query builder methods (where, having, whereDate, whereTime, whereDay, wher...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 Target Laravel 7.30.7 is NOT AFFECTED. All security fixes for GHSA-jwvj-pwww-3mj5 (preventing unexpected query bindings from array-valued parameters) were already present in the upstream Laravel 7.30.7 release before TuxCare created the snapshot. The target contains the `flattenValue()` method and uses it in all affected query builder methods (where, having, whereDate, whereTime, whereDay, wher..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:19:00.105438+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 7.30.7-p3+tuxcare of laravel/framework. Laravel framework 7.30.7 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (RCE via cookie session driver + encryption oracle). The vulnerability was fixed in upstream Laravel 7.22.2 (July 27, 2020) by replacing the publicly-computable SHA1 hash cookie prefix with an HMAC requiring the secret encryption key. Laravel 7.30.7 (released October 22, 2020) already contains this fix. The TuxCare snapshot merely imported the already-patched upstream version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel framework 7.30.7 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (RCE via cookie session driver + encryption oracle). The vulnerability was fixed in upstream Laravel 7.22.2 (July 27, 2020) by replacing the publicly-computable SHA1 hash cookie prefix with an HMAC requiring the secret encryption key. Laravel 7.30.7 (released October 22, 2020) already contains this fix. The TuxCare snapshot merely imported the already-patched upstream version." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 7.30.7-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 7.30.7-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:42:21.835037+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 7.30.7-p3+tuxcare of laravel/framework. Laravel framework 7.30.7-p6+tuxcare is NOT affected by GHSA-x7p5-p2c9-phvg (unexpected query binding vulnerability). The fix was already present in the upstream Laravel v7.30.7 release, which was onboarded by TuxCare. All vulnerable query builder methods (where, having, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, havingBetween) correctly use flattenValue() to extract scalar values from arrays and limit bindings appropriately.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "Laravel framework 7.30.7-p6+tuxcare is NOT affected by GHSA-x7p5-p2c9-phvg (unexpected query binding vulnerability). The fix was already present in the upstream Laravel v7.30.7 release, which was onboarded by TuxCare. All vulnerable query builder methods (where, having, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, havingBetween) correctly use flattenValue() to extract scalar values from arrays and limit bindings appropriately." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 7.30.7-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 7.30.7-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 7.30.7-p6+tuxcare is not affected by CVE-2017-14775. Both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() comparison for remember_me tokens, preventing timing attacks. This fix was already present in the upstream Laravel 7.30.7 release (originally fixed in Laravel 5.5.10 by commit 576cba749f), which TuxCare imported via snapshot commit 5082773b92.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel 7.30.7-p6+tuxcare is not affected by CVE-2017-14775. Both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() comparison for remember_me tokens, preventing timing attacks. This fix was already present in the upstream Laravel 7.30.7 release (originally fixed in Laravel 5.5.10 by commit 576cba749f), which TuxCare imported via snapshot commit 5082773b92." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 7.30.7-p5+tuxcare of laravel/framework. CVE-2018-15133 is NOT present in laravel/framework v7.30.7. The vulnerability affected versions through 5.5.40 and 5.6.x through 5.6.29. The target version (7.30.7, released in 2020) includes upstream fixes from August 2018 that disable PHP serialization for all encrypted cookies, preventing unsafe unserialize() calls on attacker-controlled cookie data. The fix was shipped in the upstream Laravel release, not applied by TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 is NOT present in laravel/framework v7.30.7. The vulnerability affected versions through 5.5.40 and 5.6.x through 5.6.29. The target version (7.30.7, released in 2020) includes upstream fixes from August 2018 that disable PHP serialization for all encrypted cookies, preventing unsafe unserialize() calls on attacker-controlled cookie data. The fix was shipped in the upstream Laravel release, not applied by TuxCare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 7.30.7-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 7.30.7-p5+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 7.30.7-p5+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before version 5.8.17. The target version 7.30.7-p6+tuxcare already contains the upstream fix. The vulnerability was an OS command injection in the `link()` function in Filesystem.php, where user-controlled `$link` and `$target` parameters were passed to `exec(\"mklink ...\")` without proper escaping. The fix, applied by Laravel upstream in May 2019 (commit 44c3feb6), wraps both parameters with `escapeshellarg()` to prevent shell metacharacter injection. This fix was already present in Laravel 7.30.7 when TuxCare onboarded it in the snapshot commit 5082773b92.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before version 5.8.17. The target version 7.30.7-p6+tuxcare already contains the upstream fix. The vulnerability was an OS command injection in the `link()` function in Filesystem.php, where user-controlled `$link` and `$target` parameters were passed to `exec(\"mklink ...\")` without proper escaping. The fix, applied by Laravel upstream in May 2019 (commit 44c3feb6), wraps both parameters with `escapeshellarg()` to prevent shell metacharacter injection. This fix was already present in Laravel 7.30.7 when TuxCare onboarded it in the snapshot commit 5082773b92." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:42:21.835037+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 7.30.7-p5+tuxcare of laravel/framework. The target repository (laravel/framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2020-24941. The vulnerability affected Laravel versions before 6.18.35 and 7.x before 7.24.0. The target version 7.30.7 is greater than 7.24.0, and the fix was already present in the upstream v7.30.7 release that was onboarded into the TuxCare branch via snapshot commit 5082773b92. The fix adds validation to ensure mass-assigned attributes are actual database columns, preventing attackers from bypassing the $guarded property protection using fake column names with JSON-like syntax. The vulnerable code pattern (missing isGuardableColumn validation) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target repository (laravel/framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2020-24941. The vulnerability affected Laravel versions before 6.18.35 and 7.x before 7.24.0. The target version 7.30.7 is greater than 7.24.0, and the fix was already present in the upstream v7.30.7 release that was onboarded into the TuxCare branch via snapshot commit 5082773b92. The fix adds validation to ensure mass-assigned attributes are actual database columns, preventing attackers from bypassing the $guarded property protection using fake column names with JSON-like syntax. The vulnerable code pattern (missing isGuardableColumn validation) is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 7.30.7-p5+tuxcare of laravel/framework. CVE-2021-21263 affects Laravel versions <6.20.12, <7.30.3, and <8.22.1. The target is Laravel v7.30.7-p6+tuxcare, which is >7.30.3. The upstream Laravel v7.30.7 release already included the fix via the flattenValue() method and array_slice() limiting, which was snapshotted into the TuxCare branch. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) now properly limit array inputs to prevent query binding exploitation. The vulnerable pattern is not present in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "CVE-2021-21263 affects Laravel versions <6.20.12, <7.30.3, and <8.22.1. The target is Laravel v7.30.7-p6+tuxcare, which is >7.30.3. The upstream Laravel v7.30.7 release already included the fix via the flattenValue() method and array_slice() limiting, which was snapshotted into the TuxCare branch. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) now properly limit array inputs to prevent query binding exploitation. The vulnerable pattern is not present in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 7.30.7-p5+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 7.30.7-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2021-43808 (Blade XSS via predictable parent placeholder). The upstream fix was already present in v7.30.7 when TuxCare onboarded it. The fix implements random per-request salt for parent placeholders, making them unguessable and preventing XSS exploitation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2021-43808 (Blade XSS via predictable parent placeholder). The upstream fix was already present in v7.30.7 when TuxCare onboarded it. The fix implements random per-request salt for parent placeholders, making them unguessable and preventing XSS exploitation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 7.30.7-p5+tuxcare of laravel/framework. The target repository (Laravel framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled. The fix\u2014checking runningInConsole() before using $_SERVER['argv']\u2014was already present in the upstream Laravel v7.30.7 release that TuxCare imported via snapshot on 2026-05-05. The upstream fix was authored by Taylor Otwell on 2024-11-12. The target code at Application.php:560-562 correctly guards $_SERVER['argv'] access, preventing web requests from manipulating the framework's environment detection.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target repository (Laravel framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled. The fix\u2014checking runningInConsole() before using $_SERVER['argv']\u2014was already present in the upstream Laravel v7.30.7 release that TuxCare imported via snapshot on 2026-05-05. The upstream fix was authored by Taylor Otwell on 2024-11-12. The target code at Application.php:560-562 correctly guards $_SERVER['argv'] access, preventing web requests from manipulating the framework's environment detection." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 7.30.7-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-09-29T20:36:58.499788+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 7.30.7-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is NOT affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's exception renderer system which uses Tippy.js tooltips with `allowHTML: true` on user-controlled data. Laravel 7.30.7 predates this feature entirely and uses the Whoops library for debug mode exception handling - a completely different architecture with no Tippy.js tooltips, no `data-tippy-content` att...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is NOT affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's exception renderer system which uses Tippy.js tooltips with `allowHTML: true` on user-controlled data. Laravel 7.30.7 predates this feature entirely and uses the Whoops library for debug mode exception handling - a completely different architecture with no Tippy.js tooltips, no `data-tippy-content` att..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 7.30.7-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource system, which was introduced in version 12.x, five major versions after the target. The vulnerable pattern requires: (1) JsonApi resources processing user-supplied `include` query parameters, (2) passing unsanitized nested relationship names to `loadMissing()`, and (3) potential invocation ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource system, which was introduced in version 12.x, five major versions after the target. The vulnerable pattern requires: (1) JsonApi resources processing user-supplied `include` query parameters, (2) passing unsanitized nested relationship names to `loadMissing()`, and (3) potential invocation ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:50:18.837974+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 7.30.7-p5+tuxcare of laravel/framework, and is fixed in 7.30.7-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 7.30.7-p5+tuxcare of laravel/framework, and is fixed in 7.30.7-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-28T20:52:18.183384+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 7.30.7-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework v7.30.7-p6+tuxcare is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is absent because the upstream Laravel v7.30.5 release already included the fix, which adds integer casting to limit() and offset() methods in Builder.php. This version (7.30.7) inherits that upstream fix via the snapshot commit that imported the v7.30.7...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Laravel Framework v7.30.7-p6+tuxcare is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is absent because the upstream Laravel v7.30.5 release already included the fix, which adds integer casting to limit() and offset() methods in Builder.php. This version (7.30.7) inherits that upstream fix via the snapshot commit that imported the v7.30.7..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 7.30.7-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-28T21:03:57.153420+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 7.30.7-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 7.30.7-p6+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling PHP object serialization in cookies. Laravel 7.30.7 (released September 2020) already contains this fix. The target was onboarded from the upstream Laravel 7.30.7 release, which shipped wit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 7.30.7-p6+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling PHP object serialization in cookies. Laravel 7.30.7 (released September 2020) already contains this fix. The target was onboarded from the upstream Laravel 7.30.7 release, which shipped wit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 7.30.7-p5+tuxcare of laravel/framework. not_affected \u2014 Target Laravel v7.30.7 already contains the upstream IV length validation fix. The vulnerability (GHSA-7852-w36x-6mf6) allows decryption to return false instead of throwing an exception when processing payloads with manipulated IV length. The fix validates that decoded IV length matches expected cipher IV length (Encrypter.php:214). This was authored by Taylor Otwell on March 30, 2018, and ship...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 Target Laravel v7.30.7 already contains the upstream IV length validation fix. The vulnerability (GHSA-7852-w36x-6mf6) allows decryption to return false instead of throwing an exception when processing payloads with manipulated IV length. The fix validates that decoded IV length matches expected cipher IV length (Encrypter.php:214). This was authored by Taylor Otwell on March 30, 2018, and ship..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 7.30.7-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7-p1+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in the LocalFilesystemAdapter class which provides temporary signed URL generation for local filesystems. This class and the associated local file serving feature were introduced in Laravel 9.x and do not exist in Laravel 7.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7-p1+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in the LocalFilesystemAdapter class which provides temporary signed URL generation for local filesystems. This class and the associated local file serving feature were introduced in Laravel 9.x and do not exist in Laravel 7.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-28T21:20:09.538096+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 7.30.7-p5+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 7.30.7 is NOT AFFECTED. All security fixes for GHSA-jwvj-pwww-3mj5 (preventing unexpected query bindings from array-valued parameters) were already present in the upstream Laravel 7.30.7 release before TuxCare created the snapshot. The target contains the `flattenValue()` method and uses it in all affected query builder methods (where, having, whereDate, whereTime, whereDay, wher...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 Target Laravel 7.30.7 is NOT AFFECTED. All security fixes for GHSA-jwvj-pwww-3mj5 (preventing unexpected query bindings from array-valued parameters) were already present in the upstream Laravel 7.30.7 release before TuxCare created the snapshot. The target contains the `flattenValue()` method and uses it in all affected query builder methods (where, having, whereDate, whereTime, whereDay, wher..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:19:00.105438+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 7.30.7-p5+tuxcare of laravel/framework. Laravel framework 7.30.7 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (RCE via cookie session driver + encryption oracle). The vulnerability was fixed in upstream Laravel 7.22.2 (July 27, 2020) by replacing the publicly-computable SHA1 hash cookie prefix with an HMAC requiring the secret encryption key. Laravel 7.30.7 (released October 22, 2020) already contains this fix. The TuxCare snapshot merely imported the already-patched upstream version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel framework 7.30.7 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (RCE via cookie session driver + encryption oracle). The vulnerability was fixed in upstream Laravel 7.22.2 (July 27, 2020) by replacing the publicly-computable SHA1 hash cookie prefix with an HMAC requiring the secret encryption key. Laravel 7.30.7 (released October 22, 2020) already contains this fix. The TuxCare snapshot merely imported the already-patched upstream version." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 7.30.7-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 7.30.7-p5+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:42:21.835037+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 7.30.7-p5+tuxcare of laravel/framework. Laravel framework 7.30.7-p6+tuxcare is NOT affected by GHSA-x7p5-p2c9-phvg (unexpected query binding vulnerability). The fix was already present in the upstream Laravel v7.30.7 release, which was onboarded by TuxCare. All vulnerable query builder methods (where, having, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, havingBetween) correctly use flattenValue() to extract scalar values from arrays and limit bindings appropriately.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "Laravel framework 7.30.7-p6+tuxcare is NOT affected by GHSA-x7p5-p2c9-phvg (unexpected query binding vulnerability). The fix was already present in the upstream Laravel v7.30.7 release, which was onboarded by TuxCare. All vulnerable query builder methods (where, having, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, havingBetween) correctly use flattenValue() to extract scalar values from arrays and limit bindings appropriately." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.7.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 due to non-constant-time token comparison in remember_me authentication. Version 5.7.29 was released after the fix (5.5.10) and contains the upstream security patch that replaced database-level string comparison with hash_equals() constant-time comparison in both DatabaseUserProvider and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 due to non-constant-time token comparison in remember_me authentication. Version 5.7.29 was released after the fix (5.5.10) and contains the upstream security patch that replaced database-level string comparison with hash_equals() constant-time comparison in both DatabaseUserProvider and ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.7.29-p2+tuxcare of laravel/framework. CVE-2018-15133 (RCE via unserialize on X-XSRF-TOKEN) is NOT present in Laravel 5.7.29-p4+tuxcare. The vulnerability required automatic deserialization of decrypted cookie data. The upstream fix (commit c0eb9073eb by Taylor Otwell, Aug 2018) disabled serialization by setting `static $serialize = false` and passing it to all encrypt/decrypt operations. Laravel 5.7.29 was released AFTER the fix and already includes it. The TuxCare onboarding (ba2c65e51a) imported the fixed upstream release. All decrypt operations now pass `static::serialized()` which returns `false`, preventing unserialize() from being called on user-controlled data. The vulnerable pattern is absent because the upstream fix shipped in the release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 (RCE via unserialize on X-XSRF-TOKEN) is NOT present in Laravel 5.7.29-p4+tuxcare. The vulnerability required automatic deserialization of decrypted cookie data. The upstream fix (commit c0eb9073eb by Taylor Otwell, Aug 2018) disabled serialization by setting `static $serialize = false` and passing it to all encrypt/decrypt operations. Laravel 5.7.29 was released AFTER the fix and already includes it. The TuxCare onboarding (ba2c65e51a) imported the fixed upstream release. All decrypt operations now pass `static::serialized()` which returns `false`, preventing unserialize() from being called on user-controlled data. The vulnerable pattern is absent because the upstream fix shipped in the release." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-10-19T13:13:00.129934+00:00", "status_notes": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.7.29-p2+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19).", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.7.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.7.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.7.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.7.29-p2+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.7.29-p2+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.7.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.7.29-p2+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.7.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.7.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.7.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework version 5.7.29 is not affected by CVE-2026-102279. This version uses the Whoops library for debug exception rendering, not Laravel's custom exception renderer with Tippy.js tooltips. The vulnerable code path (Tippy.js initialization with `allowHTML: true` for `data-tippy-content` elements) does not exist in version 5.7.29. The custom Laravel exception renderer was introduced i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel Framework version 5.7.29 is not affected by CVE-2026-102279. This version uses the Whoops library for debug exception rendering, not Laravel's custom exception renderer with Tippy.js tooltips. The vulnerable code path (Tippy.js initialization with `allowHTML: true` for `data-tippy-content` elements) does not exist in version 5.7.29. The custom Laravel exception renderer was introduced i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.7.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources feature, which was introduced in Laravel 12.x (December 2025). Laravel 5.7.29 predates this feature by approximately 6 years and 5+ major versions. The target version contains only the older Json resources (not JsonApi) which do not process relationship inclusion parameters from URLs, making th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources feature, which was introduced in Laravel 12.x (December 2025). Laravel 5.7.29 predates this feature by approximately 6 years and 5+ major versions. The target version contains only the older Json resources (not JsonApi) which do not process relationship inclusion parameters from URLs, making th..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-11-04T11:45:00.074275+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.7.29-p2+tuxcare of laravel/framework, and is fixed in 5.7.29-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.7.29-p2+tuxcare of laravel/framework, and is fixed in 5.7.29-p5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.7.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.7.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 uses SwiftMailer, not Symfony Mailer. The GHSA-5vg9-5847-vvmq vulnerability specifically requires Symfony Mailer's handling of CRLF sequences. SwiftMailer employs EmailValidator which rejects CRLF in email addresses, breaking the attack chain.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 uses SwiftMailer, not Symfony Mailer. The GHSA-5vg9-5847-vvmq vulnerability specifically requires Symfony Mailer's handling of CRLF sequences. SwiftMailer employs EmailValidator which rejects CRLF in email addresses, breaking the attack chain." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:52:18.183384+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.7.29-p2+tuxcare of laravel/framework. not_affected \u2014 Target repository Laravel 5.7.29-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The fix for this vulnerability was already present in the upstream Laravel 5.7.29 release (September 2018), which shipped after the vulnerability was fixed in Laravel 5.6.30 (August 2018). The target's cookie encryption middleware disables serialization for all cookies via ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target repository Laravel 5.7.29-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The fix for this vulnerability was already present in the upstream Laravel 5.7.29 release (September 2018), which shipped after the vulnerability was fixed in Laravel 5.6.30 (August 2018). The target's cookie encryption middleware disables serialization for all cookies via ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.7.29-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 5.7.29 code is not affected by GHSA-7852-w36x-6mf6. The IV length validation fix (checking that base64-decoded IV length matches openssl_cipher_iv_length) is already present in the Encrypter.php validPayload() method at line 210. This fix was included in the upstream Laravel 5.7.29 release (authored by Taylor Otwell in March 2018, before Laravel 5.7 was released in September ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel 5.7.29 code is not affected by GHSA-7852-w36x-6mf6. The IV length validation fix (checking that base64-decoded IV length matches openssl_cipher_iv_length) is already present in the Encrypter.php validPayload() method at line 210. This fix was included in the upstream Laravel 5.7.29 release (authored by Taylor Otwell in March 2018, before Laravel 5.7 was released in September ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.7.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 does not support temporary signed URLs for local filesystem storage. The vulnerable feature (LocalFilesystemAdapter with temporaryUrl/temporaryUploadUrl methods) does not exist in this version. The FilesystemAdapter::temporaryUrl() method explicitly throws RuntimeException when used with LocalAdapter.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 does not support temporary signed URLs for local filesystem storage. The vulnerable feature (LocalFilesystemAdapter with temporaryUrl/temporaryUploadUrl methods) does not exist in this version. The FilesystemAdapter::temporaryUrl() method explicitly throws RuntimeException when used with LocalAdapter." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.7.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.7.29-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.7.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.7.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.7.29-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.7.29-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2022-23614 does not affect version v1.44.8-p1+tuxcare of twig/twig. CVE-2022-23614 affects Twig's `sort` filter when an `arrow` parameter is passed in sandbox mode, allowing arbitrary PHP function execution. However, Twig v1.44.8 does not have the arrow parameter feature in the sort filter. The vulnerable code pattern (accepting an arrow callable parameter) does not exist in this version. The arrow parameter was introduced in v2.12.0 (August 2019), while the target is based on the 1.x branch which never received this feature. The sort filter signature in v1.44.8 is `function twig_sort_filter($array)` with only one parameter, making the vulnerability not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-23614" }, "impact_statement": "CVE-2022-23614 affects Twig's `sort` filter when an `arrow` parameter is passed in sandbox mode, allowing arbitrary PHP function execution. However, Twig v1.44.8 does not have the arrow parameter feature in the sort filter. The vulnerable code pattern (accepting an arrow callable parameter) does not exist in this version. The arrow parameter was introduced in v2.12.0 (August 2019), while the target is based on the 1.x branch which never received this feature. The sort filter signature in v1.44.8 is `function twig_sort_filter($array)` with only one parameter, making the vulnerability not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2022-39261 does not affect version v1.44.8-p1+tuxcare of twig/twig. The target repository (twig/twig v1.44.8-p2+tuxcare) is not affected by CVE-2022-39261. The vulnerability was a path traversal issue in Twig's FilesystemLoader that allowed reading files outside configured template directories when using namespace syntax like '@namespace/../file'. The fix was applied in upstream Twig v1.44.7 (2022-09-28) by Fabien Potencier, and the target is based on v1.44.8 (2024-09-09), which already included this fix. The vulnerable code pattern (validating template name before parsing namespace) is not present; the target code correctly validates the shortname after parsing the namespace prefix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-39261" }, "impact_statement": "The target repository (twig/twig v1.44.8-p2+tuxcare) is not affected by CVE-2022-39261. The vulnerability was a path traversal issue in Twig's FilesystemLoader that allowed reading files outside configured template directories when using namespace syntax like '@namespace/../file'. The fix was applied in upstream Twig v1.44.7 (2022-09-28) by Fabien Potencier, and the target is based on v1.44.8 (2024-09-09), which already included this fix. The vulnerable code pattern (validating template name before parsing namespace) is not present; the target code correctly validates the shortname after parsing the namespace prefix." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2024-45411 affects version v1.44.8-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-45411" }, "action_statement": "Vulnerability CVE-2024-45411 affects version v1.44.8-p1+tuxcare of twig/twig." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51754 is fixed in version v1.44.8-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-51754" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51755 affects version v1.44.8-p1+tuxcare of twig/twig, and is fixed in v1.44.8-p2+tuxcare.", "vulnerability": { "name": "CVE-2024-51755" }, "action_statement": "Vulnerability CVE-2024-51755 affects version v1.44.8-p1+tuxcare of twig/twig, and is fixed in v1.44.8-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2026-24425 does not affect version v1.44.8-p1+tuxcare of twig/twig. CVE-2026-24425 affects Twig when using SourcePolicyInterface to enable per-template sandboxing. The target (Twig v1.44.8) does not have SourcePolicyInterface - this feature was introduced in later versions (2.x/3.x). The vulnerability chain cannot form because the required SourcePolicyInterface mechanism is absent from this version. The existing sandboxing mechanisms (global and {% sandbox %} tag) work correctly with the current implementation.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-24425" }, "impact_statement": "CVE-2026-24425 affects Twig when using SourcePolicyInterface to enable per-template sandboxing. The target (Twig v1.44.8) does not have SourcePolicyInterface - this feature was introduced in later versions (2.x/3.x). The vulnerability chain cannot form because the required SourcePolicyInterface mechanism is absent from this version. The existing sandboxing mechanisms (global and {% sandbox %} tag) work correctly with the current implementation." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46628 is fixed in version v1.44.8-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46628" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46633 is fixed in version v1.44.8-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46633" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:19:23.616509+00:00", "status_notes": "Vulnerability CVE-2026-46634 does not affect version v1.44.8-p1+tuxcare of twig/twig. CVE-2026-46634 is NOT applicable to Twig v1.44.8-p2+tuxcare. The vulnerability specifically requires SourcePolicyInterface (introduced in Twig 3.x) for selective name-based sandboxing. Twig 1.44.8 uses state-based sandboxing where all templates share the same SandboxExtension instance from the Environment. Templates created via template_from_string() inherit the sandbox state through this shared instance, preventing the bypass described in the CVE. The attack chain (synthesized template name bypassing name-based policy \u2192 checkSecurity() no-op) does not exist in this architecture.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-46634" }, "impact_statement": "CVE-2026-46634 is NOT applicable to Twig v1.44.8-p2+tuxcare. The vulnerability specifically requires SourcePolicyInterface (introduced in Twig 3.x) for selective name-based sandboxing. Twig 1.44.8 uses state-based sandboxing where all templates share the same SandboxExtension instance from the Environment. Templates created via template_from_string() inherit the sandbox state through this shared instance, preventing the bypass described in the CVE. The attack chain (synthesized template name bypassing name-based policy \u2192 checkSecurity() no-op) does not exist in this architecture." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46635 does not affect version v1.44.8-p1+tuxcare of twig/twig. not_affected \u2014 The `column` filter that is the subject of CVE-2026-46635 does not exist in Twig 1.44.8. This version is part of the Twig 1.x series (CHANGELOG notes v1.44.6 as \"Last version for the 1.x series\"), while the column filter was introduced in Twig 2.x. Without this filter, the vulnerable code path (template calls column filter \u2192 delegates to array_column() \u2192 reads object properties bypassing sandbo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-46635" }, "impact_statement": "not_affected \u2014 The `column` filter that is the subject of CVE-2026-46635 does not exist in Twig 1.44.8. This version is part of the Twig 1.x series (CHANGELOG notes v1.44.6 as \"Last version for the 1.x series\"), while the column filter was introduced in Twig 2.x. Without this filter, the vulnerable code path (template calls column filter \u2192 delegates to array_column() \u2192 reads object properties bypassing sandbo..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46638 is fixed in version v1.44.8-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46638" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:19:23.616509+00:00", "status_notes": "Vulnerability CVE-2026-46640 does not affect version v1.44.8-p1+tuxcare of twig/twig. Twig 1.44.8 is not affected by CVE-2026-46640. The vulnerability requires the `obj.(expr)` dynamic-attribute syntax for macro references, which was introduced in Twig 3.15.0 and does not exist in Twig 1.x. The target explicitly rejects dynamic macro names (ExpressionParser.php:506) and only supports static attribute access after the dot operator. The vulnerable code path involving MacroReferenceExpression and DotExpressionParser does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-46640" }, "impact_statement": "Twig 1.44.8 is not affected by CVE-2026-46640. The vulnerability requires the `obj.(expr)` dynamic-attribute syntax for macro references, which was introduced in Twig 3.15.0 and does not exist in Twig 1.x. The target explicitly rejects dynamic macro names (ExpressionParser.php:506) and only supports static attribute access after the dot operator. The vulnerable code path involving MacroReferenceExpression and DotExpressionParser does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-11-04T11:38:52.435560+00:00", "status_notes": "Vulnerability CVE-2026-47730 affects version v1.44.8-p1+tuxcare of twig/twig, and is fixed in v1.44.8-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-47730" }, "action_statement": "Vulnerability CVE-2026-47730 affects version v1.44.8-p1+tuxcare of twig/twig, and is fixed in v1.44.8-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47732 is fixed in version v1.44.8-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-47732" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48805 does not affect version v1.44.8-p1+tuxcare of twig/twig. not_affected \u2014 Target Twig 1.44.8 is NOT AFFECTED by CVE-2026-48805. This vulnerability is specific to Twig 3.26.0+ architectural changes that introduced per-source sandbox state with boolean parameters. The three vulnerable deprecated wrapper functions mentioned in the CVE (twig_array_some(), twig_array_every(), twig_check_arrow_in_sandbox()) do not exist in Twig 1.44.x. The equivalent functionality in Twig ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48805" }, "impact_statement": "not_affected \u2014 Target Twig 1.44.8 is NOT AFFECTED by CVE-2026-48805. This vulnerability is specific to Twig 3.26.0+ architectural changes that introduced per-source sandbox state with boolean parameters. The three vulnerable deprecated wrapper functions mentioned in the CVE (twig_array_some(), twig_array_every(), twig_check_arrow_in_sandbox()) do not exist in Twig 1.44.x. The equivalent functionality in Twig ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48806 is fixed in version v1.44.8-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48806" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48807 is fixed in version v1.44.8-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48807" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48808 does not affect version v1.44.8-p1+tuxcare of twig/twig. not_affected \u2014 Twig v1.44.8 is not affected by CVE-2026-48808. The vulnerability concerns a sandbox bypass in the `column` filter when sandboxing is enabled via `SourcePolicyInterface`. However, v1.44.8 lacks both the column filter feature (introduced in later Twig versions 2.x/3.x) and the SourcePolicyInterface mechanism. Exhaustive searches across the codebase confirmed no column filter registration in Core...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48808" }, "impact_statement": "not_affected \u2014 Twig v1.44.8 is not affected by CVE-2026-48808. The vulnerability concerns a sandbox bypass in the `column` filter when sandboxing is enabled via `SourcePolicyInterface`. However, v1.44.8 lacks both the column filter feature (introduced in later Twig versions 2.x/3.x) and the SourcePolicyInterface mechanism. Exhaustive searches across the codebase confirmed no column filter registration in Core..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49981 is fixed in version v1.44.8-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-49981" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare" } } ], "timestamp": "2026-11-04T11:39:19.215805+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.0-p8+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 8.12.0 is NOT AFFECTED by CVE-2017-14775. The vulnerability (timing attack on remember_me token verification via database string comparison) is not present. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison. The fix was shipped in upstream Laravel 5.5.10 (September 2017) and is present in Laravel 8.12.0, which TuxCare onboarde...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Target Laravel 8.12.0 is NOT AFFECTED by CVE-2017-14775. The vulnerability (timing attack on remember_me token verification via database string comparison) is not present. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison. The fix was shipped in upstream Laravel 5.5.10 (September 2017) and is present in Laravel 8.12.0, which TuxCare onboarde..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare" } } ], "timestamp": "2026-11-04T11:39:19.215805+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.0-p8+tuxcare of laravel/framework. Laravel Framework v8.12.0 is not affected by CVE-2018-15133. The vulnerability involved unserialize being called on untrusted X-XSRF-TOKEN cookie values, enabling remote code execution. The upstream fix (disabling serialization for cookie encryption/decryption) was already present in Laravel v8.12.0 when TuxCare onboarded this version. The fix was originally applied by Taylor Otwell in August 2018 (commits c0eb9073, 7c90d413, 97467e3c, 240d9046), well before the v8.x release line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "Laravel Framework v8.12.0 is not affected by CVE-2018-15133. The vulnerability involved unserialize being called on untrusted X-XSRF-TOKEN cookie values, enabling remote code execution. The upstream fix (disabling serialization for cookie encryption/decryption) was already present in Laravel v8.12.0 when TuxCare onboarded this version. The fix was originally applied by Taylor Otwell in August 2018 (commits c0eb9073, 7c90d413, 97467e3c, 240d9046), well before the v8.x release line." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare" } } ], "timestamp": "2026-11-04T11:39:19.215805+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.0-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.0-p8+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare" } } ], "timestamp": "2026-11-04T11:39:19.215805+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.0-p8+tuxcare of laravel/framework. CVE-2020-19316 command injection vulnerability is NOT present in Laravel Framework 8.12.0-p7+tuxcare. The vulnerable pattern (unescaped shell parameters in exec() call) does not exist. The fix (escapeshellarg() wrapping) was already present in upstream Laravel v8.12.0 when TuxCare onboarded it. File src/Illuminate/Filesystem/Filesystem.php line 320 correctly applies escapeshellarg() to both $link and $target parameters before passing them to exec(). Original upstream fix by Taylor Otwell (May 2019, commit 44c3feb604) shipped in Laravel 8.12.0 release (~Nov 2020), 18 months before TuxCare onboarding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 command injection vulnerability is NOT present in Laravel Framework 8.12.0-p7+tuxcare. The vulnerable pattern (unescaped shell parameters in exec() call) does not exist. The fix (escapeshellarg() wrapping) was already present in upstream Laravel v8.12.0 when TuxCare onboarded it. File src/Illuminate/Filesystem/Filesystem.php line 320 correctly applies escapeshellarg() to both $link and $target parameters before passing them to exec(). Original upstream fix by Taylor Otwell (May 2019, commit 44c3feb604) shipped in Laravel 8.12.0 release (~Nov 2020), 18 months before TuxCare onboarding." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare" } } ], "timestamp": "2026-11-04T11:39:19.215805+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.0-p8+tuxcare of laravel/framework. The target Laravel 8.12.0-p7+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability fix was already present in the upstream Laravel 8.12.0 release. The affected code (GuardsAttributes.php) contains the complete patched version with isGuardableColumn() validation that blocks mass assignment to non-existent columns. The TuxCare snapshot commit (9014f5a2) simply onboarded the already-fixed upstream release; no backport was needed. CVE affected versions before 6.18.35 and 7.x before 7.24.0; Laravel 8.12.0 is post-fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel 8.12.0-p7+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability fix was already present in the upstream Laravel 8.12.0 release. The affected code (GuardsAttributes.php) contains the complete patched version with isGuardableColumn() validation that blocks mass assignment to non-existent columns. The TuxCare snapshot commit (9014f5a2) simply onboarded the already-fixed upstream release; no backport was needed. CVE affected versions before 6.18.35 and 7.x before 7.24.0; Laravel 8.12.0 is post-fix." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare" } } ], "timestamp": "2026-11-04T11:39:19.215805+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.0-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare" } } ], "timestamp": "2026-11-04T11:39:19.215805+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.0-p8+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare" } } ], "timestamp": "2026-11-04T11:39:19.215805+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.0-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare" } } ], "timestamp": "2026-11-04T11:39:19.215805+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.0-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare" } } ], "timestamp": "2026-11-04T11:39:19.215805+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.0-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare" } } ], "timestamp": "2026-11-04T11:39:19.215805+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.0-p8+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare" } } ], "timestamp": "2026-11-04T11:39:19.215805+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.0-p8+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resource feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, Dec 2025), approximately 5 years after version 8.12.0 (Dec 2020). The target version lacks the entire JSON:API resource system, including the vulnerabl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resource feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, Dec 2025), approximately 5 years after version 8.12.0 (Dec 2020). The target version lacks the entire JSON:API resource system, including the vulnerabl..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare" } } ], "timestamp": "2026-11-04T11:40:03.913990+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 8.12.0-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare" } } ], "timestamp": "2026-11-04T11:39:19.215805+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.0-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare" } } ], "timestamp": "2026-11-04T11:39:19.215805+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.0-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare" } } ], "timestamp": "2026-11-04T11:39:19.215805+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.0-p8+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization via cookies). The upstream Laravel 8.12.0 release already contained the fix with `protected static $serialize = false`, which disables cookie serialization globally. This defense was present in the snapshot commit 9014f5a213 that imported upstream Laravel 8.12.0 into the TuxCare repository, preventing the exploita...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization via cookies). The upstream Laravel 8.12.0 release already contained the fix with `protected static $serialize = false`, which disables cookie serialization globally. This defense was present in the snapshot commit 9014f5a213 that imported upstream Laravel 8.12.0 into the TuxCare repository, preventing the exploita..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare" } } ], "timestamp": "2026-11-04T11:39:19.215805+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.0-p8+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework v8.12.0 is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false instead of throwing exception when IV length is invalid) is not present because the IV length validation fix was already included in the upstream Laravel v8.12.0 release. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the defensive che...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel Framework v8.12.0 is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false instead of throwing exception when IV length is invalid) is not present because the IV length validation fix was already included in the upstream Laravel v8.12.0 release. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the defensive che..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare" } } ], "timestamp": "2026-11-04T11:39:19.215805+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.0-p8+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare" } } ], "timestamp": "2026-11-04T11:39:19.215805+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.0-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare" } } ], "timestamp": "2026-11-04T11:39:19.215805+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.0-p8+tuxcare of laravel/framework. The target Laravel framework 8.12.0-p7+tuxcare is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (encryption oracle vulnerability). The vulnerable pattern (keyless SHA1 cookie prefix) is not present because the fix was already included in the upstream Laravel 8.12.0 release. The target uses HMAC-based cookie prefixes that incorporate the encryption key, preventing attackers from crafting valid prefixes via encryption oracles.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework 8.12.0-p7+tuxcare is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (encryption oracle vulnerability). The vulnerable pattern (keyless SHA1 cookie prefix) is not present because the fix was already included in the upstream Laravel 8.12.0 release. The target uses HMAC-based cookie prefixes that incorporate the encryption key, preventing attackers from crafting valid prefixes via encryption oracles." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare" } } ], "timestamp": "2026-11-04T11:39:19.215805+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.0-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p8+tuxcare" } } ], "timestamp": "2026-11-04T11:39:19.215805+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.0-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.0-p6+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 8.12.0 is NOT AFFECTED by CVE-2017-14775. The vulnerability (timing attack on remember_me token verification via database string comparison) is not present. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison. The fix was shipped in upstream Laravel 5.5.10 (September 2017) and is present in Laravel 8.12.0, which TuxCare onboarde...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Target Laravel 8.12.0 is NOT AFFECTED by CVE-2017-14775. The vulnerability (timing attack on remember_me token verification via database string comparison) is not present. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison. The fix was shipped in upstream Laravel 5.5.10 (September 2017) and is present in Laravel 8.12.0, which TuxCare onboarde..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.0-p6+tuxcare of laravel/framework. Laravel Framework v8.12.0 is not affected by CVE-2018-15133. The vulnerability involved unserialize being called on untrusted X-XSRF-TOKEN cookie values, enabling remote code execution. The upstream fix (disabling serialization for cookie encryption/decryption) was already present in Laravel v8.12.0 when TuxCare onboarded this version. The fix was originally applied by Taylor Otwell in August 2018 (commits c0eb9073, 7c90d413, 97467e3c, 240d9046), well before the v8.x release line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "Laravel Framework v8.12.0 is not affected by CVE-2018-15133. The vulnerability involved unserialize being called on untrusted X-XSRF-TOKEN cookie values, enabling remote code execution. The upstream fix (disabling serialization for cookie encryption/decryption) was already present in Laravel v8.12.0 when TuxCare onboarded this version. The fix was originally applied by Taylor Otwell in August 2018 (commits c0eb9073, 7c90d413, 97467e3c, 240d9046), well before the v8.x release line." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.0-p6+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.0-p6+tuxcare of laravel/framework. CVE-2020-19316 command injection vulnerability is NOT present in Laravel Framework 8.12.0-p7+tuxcare. The vulnerable pattern (unescaped shell parameters in exec() call) does not exist. The fix (escapeshellarg() wrapping) was already present in upstream Laravel v8.12.0 when TuxCare onboarded it. File src/Illuminate/Filesystem/Filesystem.php line 320 correctly applies escapeshellarg() to both $link and $target parameters before passing them to exec(). Original upstream fix by Taylor Otwell (May 2019, commit 44c3feb604) shipped in Laravel 8.12.0 release (~Nov 2020), 18 months before TuxCare onboarding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 command injection vulnerability is NOT present in Laravel Framework 8.12.0-p7+tuxcare. The vulnerable pattern (unescaped shell parameters in exec() call) does not exist. The fix (escapeshellarg() wrapping) was already present in upstream Laravel v8.12.0 when TuxCare onboarded it. File src/Illuminate/Filesystem/Filesystem.php line 320 correctly applies escapeshellarg() to both $link and $target parameters before passing them to exec(). Original upstream fix by Taylor Otwell (May 2019, commit 44c3feb604) shipped in Laravel 8.12.0 release (~Nov 2020), 18 months before TuxCare onboarding." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:40:50.094173+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.0-p6+tuxcare of laravel/framework. The target Laravel 8.12.0-p7+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability fix was already present in the upstream Laravel 8.12.0 release. The affected code (GuardsAttributes.php) contains the complete patched version with isGuardableColumn() validation that blocks mass assignment to non-existent columns. The TuxCare snapshot commit (9014f5a2) simply onboarded the already-fixed upstream release; no backport was needed. CVE affected versions before 6.18.35 and 7.x before 7.24.0; Laravel 8.12.0 is post-fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel 8.12.0-p7+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability fix was already present in the upstream Laravel 8.12.0 release. The affected code (GuardsAttributes.php) contains the complete patched version with isGuardableColumn() validation that blocks mass assignment to non-existent columns. The TuxCare snapshot commit (9014f5a2) simply onboarded the already-fixed upstream release; no backport was needed. CVE affected versions before 6.18.35 and 7.x before 7.24.0; Laravel 8.12.0 is post-fix." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.0-p6+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.0-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.0-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resource feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, Dec 2025), approximately 5 years after version 8.12.0 (Dec 2020). The target version lacks the entire JSON:API resource system, including the vulnerabl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resource feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, Dec 2025), approximately 5 years after version 8.12.0 (Dec 2020). The target version lacks the entire JSON:API resource system, including the vulnerabl..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:40:03.913990+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.0-p6+tuxcare of laravel/framework, and is fixed in 8.12.0-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.0-p6+tuxcare of laravel/framework, and is fixed in 8.12.0-p8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T20:52:55.704640+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.0-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization via cookies). The upstream Laravel 8.12.0 release already contained the fix with `protected static $serialize = false`, which disables cookie serialization globally. This defense was present in the snapshot commit 9014f5a213 that imported upstream Laravel 8.12.0 into the TuxCare repository, preventing the exploita...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization via cookies). The upstream Laravel 8.12.0 release already contained the fix with `protected static $serialize = false`, which disables cookie serialization globally. This defense was present in the snapshot commit 9014f5a213 that imported upstream Laravel 8.12.0 into the TuxCare repository, preventing the exploita..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.0-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework v8.12.0 is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false instead of throwing exception when IV length is invalid) is not present because the IV length validation fix was already included in the upstream Laravel v8.12.0 release. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the defensive che...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel Framework v8.12.0 is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false instead of throwing exception when IV length is invalid) is not present because the IV length validation fix was already included in the upstream Laravel v8.12.0 release. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the defensive che..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.0-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:13:26.008802+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.0-p6+tuxcare of laravel/framework. The target Laravel framework 8.12.0-p7+tuxcare is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (encryption oracle vulnerability). The vulnerable pattern (keyless SHA1 cookie prefix) is not present because the fix was already included in the upstream Laravel 8.12.0 release. The target uses HMAC-based cookie prefixes that incorporate the encryption key, preventing attackers from crafting valid prefixes via encryption oracles.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework 8.12.0-p7+tuxcare is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (encryption oracle vulnerability). The vulnerable pattern (keyless SHA1 cookie prefix) is not present because the fix was already included in the upstream Laravel 8.12.0 release. The target uses HMAC-based cookie prefixes that incorporate the encryption key, preventing attackers from crafting valid prefixes via encryption oracles." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.0-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.1-p1+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 does not affect Laravel 8.12.1-p5+tuxcare. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017), and the fix was already present in the upstream Laravel 8.12.1 release (December 2020) that TuxCare onboarded. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison, preventing...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 does not affect Laravel 8.12.1-p5+tuxcare. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017), and the fix was already present in the upstream Laravel 8.12.1 release (December 2020) that TuxCare onboarded. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison, preventing..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.1-p1+tuxcare of laravel/framework. The target Laravel v8.12.1 is NOT affected by CVE-2018-15133. The vulnerability (uncontrolled deserialization of encrypted cookie data) has been mitigated by the upstream Laravel framework prior to v8.12.1. The target code passes `false` to `decrypt()` for all cookie operations, preventing automatic unserialization and blocking PHP object injection attacks. This fix was authored by Taylor Otwell in August 2018 and was included in the upstream v8.12.1 release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "The target Laravel v8.12.1 is NOT affected by CVE-2018-15133. The vulnerability (uncontrolled deserialization of encrypted cookie data) has been mitigated by the upstream Laravel framework prior to v8.12.1. The target code passes `false` to `decrypt()` for all cookie operations, preventing automatic unserialization and blocking PHP object injection attacks. This fix was authored by Taylor Otwell in August 2018 and was included in the upstream v8.12.1 release that TuxCare onboarded." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.1-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.1-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.1-p1+tuxcare of laravel/framework. The target Laravel Framework 8.12.1 is NOT AFFECTED by CVE-2020-19316. The vulnerable code pattern (unescaped shell parameters in the link() method's mklink exec call) is not present. The target has the proper fix with escapeshellarg() sanitization on both $link and $target parameters (line 320 of Filesystem.php). This fix was authored by upstream Laravel maintainer Taylor Otwell in May 2019 (commit 44c3feb604944599ad1c782a9942981c3991fa31) and was already present in the upstream Laravel 8.12.1 release when TuxCare onboarded it via snapshot commit 4993dfe2ac. CVE affected versions \"before 5.8.17\"; target is 8.12.1, which naturally includes the fix from the 5.8.17 era.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target Laravel Framework 8.12.1 is NOT AFFECTED by CVE-2020-19316. The vulnerable code pattern (unescaped shell parameters in the link() method's mklink exec call) is not present. The target has the proper fix with escapeshellarg() sanitization on both $link and $target parameters (line 320 of Filesystem.php). This fix was authored by upstream Laravel maintainer Taylor Otwell in May 2019 (commit 44c3feb604944599ad1c782a9942981c3991fa31) and was already present in the upstream Laravel 8.12.1 release when TuxCare onboarded it via snapshot commit 4993dfe2ac. CVE affected versions \"before 5.8.17\"; target is 8.12.1, which naturally includes the fix from the 5.8.17 era." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:41:10.796701+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.1-p1+tuxcare of laravel/framework. Laravel 8.12.1 was released after CVE-2020-24941 was fixed upstream. The vulnerability affected Laravel <6.18.35 and 7.x <7.24.0. The fix (commit 897d107) was applied on August 7, 2020, before Laravel 8.0's September 2020 release. Version 8.12.1 shipped with the fix already present: the isGuardableColumn() method validates attribute keys against actual database columns, preventing the JSON column nesting bypass. The vulnerable pattern (stripping '->' before guard checks) is not present. This is an upstream fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "Laravel 8.12.1 was released after CVE-2020-24941 was fixed upstream. The vulnerability affected Laravel <6.18.35 and 7.x <7.24.0. The fix (commit 897d107) was applied on August 7, 2020, before Laravel 8.0's September 2020 release. Version 8.12.1 shipped with the fix already present: the isGuardableColumn() method validates attribute keys against actual database columns, preventing the JSON column nesting bypass. The vulnerable pattern (stripping '->' before guard checks) is not present. This is an upstream fix, not a TuxCare backport." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.1-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.1-p1+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.1-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.1-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.1-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.1-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer that uses Tippy.js tooltips with allowHTML enabled. Laravel 8.x uses a completely different exception rendering system (Whoops library from filp/whoops) and does not contain the vulnerable code. The Tippy.js-based exception renderer infrastructure does not exist in this versio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer that uses Tippy.js tooltips with allowHTML enabled. Laravel 8.x uses a completely different exception rendering system (Whoops library from filp/whoops) and does not contain the vulnerable code. The Tippy.js-based exception renderer infrastructure does not exist in this versio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.1-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 11/12. Version 8.12.1 predates this feature entirely - it only has basic JsonResource with no include parameter processing or relationship compilation logic. The entire vulnerable code path is absent f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 11/12. Version 8.12.1 predates this feature entirely - it only has basic JsonResource with no include parameter processing or relationship compilation logic. The entire vulnerable code path is absent f..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-11-04T11:38:00.180821+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.1-p1+tuxcare of laravel/framework, and is fixed in 8.12.1-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.1-p1+tuxcare of laravel/framework, and is fixed in 8.12.1-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.1-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.12.1-p1+tuxcare of laravel/framework, and is fixed in 8.12.1-p2+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.12.1-p1+tuxcare of laravel/framework, and is fixed in 8.12.1-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:53:45.635911+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.1-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via unsafe cookie deserialization). The vulnerability affected Laravel 5.6.x prior to 5.6.30 and was fixed in August 2018 by disabling cookie serialization. Laravel 8.12.1 (released December 2020) already contains the fix in its upstream release: `protected static $serialize = false` in EncryptCookies.php globally disab...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via unsafe cookie deserialization). The vulnerability affected Laravel 5.6.x prior to 5.6.30 and was fixed in August 2018 by disabling cookie serialization. Laravel 8.12.1 (released December 2020) already contains the fix in its upstream release: `protected static $serialize = false` in EncryptCookies.php globally disab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.1-p1+tuxcare of laravel/framework. not_affected \u2014 The Laravel Encrypter IV length validation vulnerability (GHSA-7852-w36x-6mf6) is NOT present in this target. The fix was included in upstream Laravel 8.12.1 (released December 2020) and imported via snapshot commit 4993dfe2ac. The validPayload method at lines 211-215 of src/Illuminate/Encryption/Encrypter.php contains the exact IV length validation (line 214: strlen(base64_decode($payload['iv'...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The Laravel Encrypter IV length validation vulnerability (GHSA-7852-w36x-6mf6) is NOT present in this target. The fix was included in upstream Laravel 8.12.1 (released December 2020) and imported via snapshot commit 4993dfe2ac. The validPayload method at lines 211-215 of src/Illuminate/Encryption/Encrypter.php contains the exact IV length validation (line 214: strlen(base64_decode($payload['iv'..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.1-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns ambiguous URL parsing in local filesystem temporary signed URLs, but Laravel 8.x does not have the local filesystem signed URL feature. The temporaryUrl() method throws RuntimeException for local storage adapters. This feature was introduced in Laravel 11+/12.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns ambiguous URL parsing in local filesystem temporary signed URLs, but Laravel 8.x does not have the local filesystem signed URL feature. The temporaryUrl() method throws RuntimeException for local storage adapters. This feature was introduced in Laravel 11+/12.x." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.1-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:14:30.754022+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.1-p1+tuxcare of laravel/framework. Target version 8.12.1-p5+tuxcare is NOT AFFECTED. The encryption oracle vulnerability (GHSA-qm5c-m76r-2hfr) was fixed in upstream Laravel framework on July 27, 2020, when Taylor Otwell replaced the unkeyed sha1() cookie prefix with a keyed HMAC via the CookieValuePrefix class. Laravel 8.12.1 was released November 5, 2020, four months AFTER the fix, so the vulnerable pattern is not present in the onboarded upstream release. The target uses CookieValuePrefix::create() with hash_hmac('sha1', $cookieName.'v2', $key), making cookie prefixes unforgeable without the encryption key.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Target version 8.12.1-p5+tuxcare is NOT AFFECTED. The encryption oracle vulnerability (GHSA-qm5c-m76r-2hfr) was fixed in upstream Laravel framework on July 27, 2020, when Taylor Otwell replaced the unkeyed sha1() cookie prefix with a keyed HMAC via the CookieValuePrefix class. Laravel 8.12.1 was released November 5, 2020, four months AFTER the fix, so the vulnerable pattern is not present in the onboarded upstream release. The target uses CookieValuePrefix::create() with hash_hmac('sha1', $cookieName.'v2', $key), making cookie prefixes unforgeable without the encryption key." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.1-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.1-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.0-p7+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 8.12.0 is NOT AFFECTED by CVE-2017-14775. The vulnerability (timing attack on remember_me token verification via database string comparison) is not present. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison. The fix was shipped in upstream Laravel 5.5.10 (September 2017) and is present in Laravel 8.12.0, which TuxCare onboarde...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Target Laravel 8.12.0 is NOT AFFECTED by CVE-2017-14775. The vulnerability (timing attack on remember_me token verification via database string comparison) is not present. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison. The fix was shipped in upstream Laravel 5.5.10 (September 2017) and is present in Laravel 8.12.0, which TuxCare onboarde..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.0-p7+tuxcare of laravel/framework. Laravel Framework v8.12.0 is not affected by CVE-2018-15133. The vulnerability involved unserialize being called on untrusted X-XSRF-TOKEN cookie values, enabling remote code execution. The upstream fix (disabling serialization for cookie encryption/decryption) was already present in Laravel v8.12.0 when TuxCare onboarded this version. The fix was originally applied by Taylor Otwell in August 2018 (commits c0eb9073, 7c90d413, 97467e3c, 240d9046), well before the v8.x release line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "Laravel Framework v8.12.0 is not affected by CVE-2018-15133. The vulnerability involved unserialize being called on untrusted X-XSRF-TOKEN cookie values, enabling remote code execution. The upstream fix (disabling serialization for cookie encryption/decryption) was already present in Laravel v8.12.0 when TuxCare onboarded this version. The fix was originally applied by Taylor Otwell in August 2018 (commits c0eb9073, 7c90d413, 97467e3c, 240d9046), well before the v8.x release line." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.0-p7+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.0-p7+tuxcare of laravel/framework. CVE-2020-19316 command injection vulnerability is NOT present in Laravel Framework 8.12.0-p7+tuxcare. The vulnerable pattern (unescaped shell parameters in exec() call) does not exist. The fix (escapeshellarg() wrapping) was already present in upstream Laravel v8.12.0 when TuxCare onboarded it. File src/Illuminate/Filesystem/Filesystem.php line 320 correctly applies escapeshellarg() to both $link and $target parameters before passing them to exec(). Original upstream fix by Taylor Otwell (May 2019, commit 44c3feb604) shipped in Laravel 8.12.0 release (~Nov 2020), 18 months before TuxCare onboarding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 command injection vulnerability is NOT present in Laravel Framework 8.12.0-p7+tuxcare. The vulnerable pattern (unescaped shell parameters in exec() call) does not exist. The fix (escapeshellarg() wrapping) was already present in upstream Laravel v8.12.0 when TuxCare onboarded it. File src/Illuminate/Filesystem/Filesystem.php line 320 correctly applies escapeshellarg() to both $link and $target parameters before passing them to exec(). Original upstream fix by Taylor Otwell (May 2019, commit 44c3feb604) shipped in Laravel 8.12.0 release (~Nov 2020), 18 months before TuxCare onboarding." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-31T20:40:50.094173+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.0-p7+tuxcare of laravel/framework. The target Laravel 8.12.0-p7+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability fix was already present in the upstream Laravel 8.12.0 release. The affected code (GuardsAttributes.php) contains the complete patched version with isGuardableColumn() validation that blocks mass assignment to non-existent columns. The TuxCare snapshot commit (9014f5a2) simply onboarded the already-fixed upstream release; no backport was needed. CVE affected versions before 6.18.35 and 7.x before 7.24.0; Laravel 8.12.0 is post-fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel 8.12.0-p7+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability fix was already present in the upstream Laravel 8.12.0 release. The affected code (GuardsAttributes.php) contains the complete patched version with isGuardableColumn() validation that blocks mass assignment to non-existent columns. The TuxCare snapshot commit (9014f5a2) simply onboarded the already-fixed upstream release; no backport was needed. CVE affected versions before 6.18.35 and 7.x before 7.24.0; Laravel 8.12.0 is post-fix." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-14T14:44:00.071764+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-14T14:44:00.071764+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.0-p7+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-14T14:44:00.071764+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-14T14:44:00.071764+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-14T14:44:00.071764+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-14T14:44:00.071764+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.0-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.0-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resource feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, Dec 2025), approximately 5 years after version 8.12.0 (Dec 2020). The target version lacks the entire JSON:API resource system, including the vulnerabl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resource feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, Dec 2025), approximately 5 years after version 8.12.0 (Dec 2020). The target version lacks the entire JSON:API resource system, including the vulnerabl..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:40:03.913990+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.0-p7+tuxcare of laravel/framework, and is fixed in 8.12.0-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.0-p7+tuxcare of laravel/framework, and is fixed in 8.12.0-p8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-14T14:44:00.071764+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-14T14:44:00.071764+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-28T20:52:55.704640+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.0-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization via cookies). The upstream Laravel 8.12.0 release already contained the fix with `protected static $serialize = false`, which disables cookie serialization globally. This defense was present in the snapshot commit 9014f5a213 that imported upstream Laravel 8.12.0 into the TuxCare repository, preventing the exploita...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization via cookies). The upstream Laravel 8.12.0 release already contained the fix with `protected static $serialize = false`, which disables cookie serialization globally. This defense was present in the snapshot commit 9014f5a213 that imported upstream Laravel 8.12.0 into the TuxCare repository, preventing the exploita..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.0-p7+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework v8.12.0 is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false instead of throwing exception when IV length is invalid) is not present because the IV length validation fix was already included in the upstream Laravel v8.12.0 release. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the defensive che...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel Framework v8.12.0 is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false instead of throwing exception when IV length is invalid) is not present because the IV length validation fix was already included in the upstream Laravel v8.12.0 release. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the defensive che..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-14T14:44:00.071764+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.0-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-14T14:44:00.071764+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-31T20:13:26.008802+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.0-p7+tuxcare of laravel/framework. The target Laravel framework 8.12.0-p7+tuxcare is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (encryption oracle vulnerability). The vulnerable pattern (keyless SHA1 cookie prefix) is not present because the fix was already included in the upstream Laravel 8.12.0 release. The target uses HMAC-based cookie prefixes that incorporate the encryption key, preventing attackers from crafting valid prefixes via encryption oracles.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework 8.12.0-p7+tuxcare is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (encryption oracle vulnerability). The vulnerable pattern (keyless SHA1 cookie prefix) is not present because the fix was already included in the upstream Laravel 8.12.0 release. The target uses HMAC-based cookie prefixes that incorporate the encryption key, preventing attackers from crafting valid prefixes via encryption oracles." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-14T14:44:00.071764+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p7+tuxcare" } } ], "timestamp": "2026-10-14T14:44:00.071764+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.0-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.7.29-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 due to non-constant-time token comparison in remember_me authentication. Version 5.7.29 was released after the fix (5.5.10) and contains the upstream security patch that replaced database-level string comparison with hash_equals() constant-time comparison in both DatabaseUserProvider and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 due to non-constant-time token comparison in remember_me authentication. Version 5.7.29 was released after the fix (5.5.10) and contains the upstream security patch that replaced database-level string comparison with hash_equals() constant-time comparison in both DatabaseUserProvider and ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.7.29-p1+tuxcare of laravel/framework. CVE-2018-15133 (RCE via unserialize on X-XSRF-TOKEN) is NOT present in Laravel 5.7.29-p4+tuxcare. The vulnerability required automatic deserialization of decrypted cookie data. The upstream fix (commit c0eb9073eb by Taylor Otwell, Aug 2018) disabled serialization by setting `static $serialize = false` and passing it to all encrypt/decrypt operations. Laravel 5.7.29 was released AFTER the fix and already includes it. The TuxCare onboarding (ba2c65e51a) imported the fixed upstream release. All decrypt operations now pass `static::serialized()` which returns `false`, preventing unserialize() from being called on user-controlled data. The vulnerable pattern is absent because the upstream fix shipped in the release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 (RCE via unserialize on X-XSRF-TOKEN) is NOT present in Laravel 5.7.29-p4+tuxcare. The vulnerability required automatic deserialization of decrypted cookie data. The upstream fix (commit c0eb9073eb by Taylor Otwell, Aug 2018) disabled serialization by setting `static $serialize = false` and passing it to all encrypt/decrypt operations. Laravel 5.7.29 was released AFTER the fix and already includes it. The TuxCare onboarding (ba2c65e51a) imported the fixed upstream release. All decrypt operations now pass `static::serialized()` which returns `false`, preventing unserialize() from being called on user-controlled data. The vulnerable pattern is absent because the upstream fix shipped in the release." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-10-19T13:13:00.129934+00:00", "status_notes": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.7.29-p1+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19).", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.7.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.7.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.7.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.7.29-p1+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.7.29-p1+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.7.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.7.29-p1+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.7.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.7.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.7.29-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework version 5.7.29 is not affected by CVE-2026-102279. This version uses the Whoops library for debug exception rendering, not Laravel's custom exception renderer with Tippy.js tooltips. The vulnerable code path (Tippy.js initialization with `allowHTML: true` for `data-tippy-content` elements) does not exist in version 5.7.29. The custom Laravel exception renderer was introduced i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel Framework version 5.7.29 is not affected by CVE-2026-102279. This version uses the Whoops library for debug exception rendering, not Laravel's custom exception renderer with Tippy.js tooltips. The vulnerable code path (Tippy.js initialization with `allowHTML: true` for `data-tippy-content` elements) does not exist in version 5.7.29. The custom Laravel exception renderer was introduced i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.7.29-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources feature, which was introduced in Laravel 12.x (December 2025). Laravel 5.7.29 predates this feature by approximately 6 years and 5+ major versions. The target version contains only the older Json resources (not JsonApi) which do not process relationship inclusion parameters from URLs, making th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources feature, which was introduced in Laravel 12.x (December 2025). Laravel 5.7.29 predates this feature by approximately 6 years and 5+ major versions. The target version contains only the older Json resources (not JsonApi) which do not process relationship inclusion parameters from URLs, making th..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-11-04T11:45:00.074275+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.7.29-p1+tuxcare of laravel/framework, and is fixed in 5.7.29-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.7.29-p1+tuxcare of laravel/framework, and is fixed in 5.7.29-p5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.7.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.7.29-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 uses SwiftMailer, not Symfony Mailer. The GHSA-5vg9-5847-vvmq vulnerability specifically requires Symfony Mailer's handling of CRLF sequences. SwiftMailer employs EmailValidator which rejects CRLF in email addresses, breaking the attack chain.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 uses SwiftMailer, not Symfony Mailer. The GHSA-5vg9-5847-vvmq vulnerability specifically requires Symfony Mailer's handling of CRLF sequences. SwiftMailer employs EmailValidator which rejects CRLF in email addresses, breaking the attack chain." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:52:18.183384+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.7.29-p1+tuxcare of laravel/framework. not_affected \u2014 Target repository Laravel 5.7.29-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The fix for this vulnerability was already present in the upstream Laravel 5.7.29 release (September 2018), which shipped after the vulnerability was fixed in Laravel 5.6.30 (August 2018). The target's cookie encryption middleware disables serialization for all cookies via ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target repository Laravel 5.7.29-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The fix for this vulnerability was already present in the upstream Laravel 5.7.29 release (September 2018), which shipped after the vulnerability was fixed in Laravel 5.6.30 (August 2018). The target's cookie encryption middleware disables serialization for all cookies via ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.7.29-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 5.7.29 code is not affected by GHSA-7852-w36x-6mf6. The IV length validation fix (checking that base64-decoded IV length matches openssl_cipher_iv_length) is already present in the Encrypter.php validPayload() method at line 210. This fix was included in the upstream Laravel 5.7.29 release (authored by Taylor Otwell in March 2018, before Laravel 5.7 was released in September ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel 5.7.29 code is not affected by GHSA-7852-w36x-6mf6. The IV length validation fix (checking that base64-decoded IV length matches openssl_cipher_iv_length) is already present in the Encrypter.php validPayload() method at line 210. This fix was included in the upstream Laravel 5.7.29 release (authored by Taylor Otwell in March 2018, before Laravel 5.7 was released in September ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.7.29-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 does not support temporary signed URLs for local filesystem storage. The vulnerable feature (LocalFilesystemAdapter with temporaryUrl/temporaryUploadUrl methods) does not exist in this version. The FilesystemAdapter::temporaryUrl() method explicitly throws RuntimeException when used with LocalAdapter.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 does not support temporary signed URLs for local filesystem storage. The vulnerable feature (LocalFilesystemAdapter with temporaryUrl/temporaryUploadUrl methods) does not exist in this version. The FilesystemAdapter::temporaryUrl() method explicitly throws RuntimeException when used with LocalAdapter." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.7.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.7.29-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.7.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.7.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.7.29-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.7.29-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.7.29-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 due to non-constant-time token comparison in remember_me authentication. Version 5.7.29 was released after the fix (5.5.10) and contains the upstream security patch that replaced database-level string comparison with hash_equals() constant-time comparison in both DatabaseUserProvider and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 due to non-constant-time token comparison in remember_me authentication. Version 5.7.29 was released after the fix (5.5.10) and contains the upstream security patch that replaced database-level string comparison with hash_equals() constant-time comparison in both DatabaseUserProvider and ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.7.29-p4+tuxcare of laravel/framework. CVE-2018-15133 (RCE via unserialize on X-XSRF-TOKEN) is NOT present in Laravel 5.7.29-p4+tuxcare. The vulnerability required automatic deserialization of decrypted cookie data. The upstream fix (commit c0eb9073eb by Taylor Otwell, Aug 2018) disabled serialization by setting `static $serialize = false` and passing it to all encrypt/decrypt operations. Laravel 5.7.29 was released AFTER the fix and already includes it. The TuxCare onboarding (ba2c65e51a) imported the fixed upstream release. All decrypt operations now pass `static::serialized()` which returns `false`, preventing unserialize() from being called on user-controlled data. The vulnerable pattern is absent because the upstream fix shipped in the release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 (RCE via unserialize on X-XSRF-TOKEN) is NOT present in Laravel 5.7.29-p4+tuxcare. The vulnerability required automatic deserialization of decrypted cookie data. The upstream fix (commit c0eb9073eb by Taylor Otwell, Aug 2018) disabled serialization by setting `static $serialize = false` and passing it to all encrypt/decrypt operations. Laravel 5.7.29 was released AFTER the fix and already includes it. The TuxCare onboarding (ba2c65e51a) imported the fixed upstream release. All decrypt operations now pass `static::serialized()` which returns `false`, preventing unserialize() from being called on user-controlled data. The vulnerable pattern is absent because the upstream fix shipped in the release." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-19T13:13:00.129934+00:00", "status_notes": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.7.29-p4+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19).", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:02:07.146715+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.7.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:02:07.146715+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.7.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:02:07.146715+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.7.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.7.29-p4+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:02:07.146715+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.7.29-p4+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:02:07.146715+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.7.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:02:07.146715+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.7.29-p4+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:02:07.146715+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.7.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:02:07.146715+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.7.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:02:07.146715+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.7.29-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework version 5.7.29 is not affected by CVE-2026-102279. This version uses the Whoops library for debug exception rendering, not Laravel's custom exception renderer with Tippy.js tooltips. The vulnerable code path (Tippy.js initialization with `allowHTML: true` for `data-tippy-content` elements) does not exist in version 5.7.29. The custom Laravel exception renderer was introduced i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel Framework version 5.7.29 is not affected by CVE-2026-102279. This version uses the Whoops library for debug exception rendering, not Laravel's custom exception renderer with Tippy.js tooltips. The vulnerable code path (Tippy.js initialization with `allowHTML: true` for `data-tippy-content` elements) does not exist in version 5.7.29. The custom Laravel exception renderer was introduced i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.7.29-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources feature, which was introduced in Laravel 12.x (December 2025). Laravel 5.7.29 predates this feature by approximately 6 years and 5+ major versions. The target version contains only the older Json resources (not JsonApi) which do not process relationship inclusion parameters from URLs, making th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources feature, which was introduced in Laravel 12.x (December 2025). Laravel 5.7.29 predates this feature by approximately 6 years and 5+ major versions. The target version contains only the older Json resources (not JsonApi) which do not process relationship inclusion parameters from URLs, making th..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-11-04T11:45:00.074275+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.7.29-p4+tuxcare of laravel/framework, and is fixed in 5.7.29-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.7.29-p4+tuxcare of laravel/framework, and is fixed in 5.7.29-p5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:02:07.146715+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.7.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:02:07.146715+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.7.29-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 uses SwiftMailer, not Symfony Mailer. The GHSA-5vg9-5847-vvmq vulnerability specifically requires Symfony Mailer's handling of CRLF sequences. SwiftMailer employs EmailValidator which rejects CRLF in email addresses, breaking the attack chain.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 uses SwiftMailer, not Symfony Mailer. The GHSA-5vg9-5847-vvmq vulnerability specifically requires Symfony Mailer's handling of CRLF sequences. SwiftMailer employs EmailValidator which rejects CRLF in email addresses, breaking the attack chain." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:52:18.183384+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.7.29-p4+tuxcare of laravel/framework. not_affected \u2014 Target repository Laravel 5.7.29-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The fix for this vulnerability was already present in the upstream Laravel 5.7.29 release (September 2018), which shipped after the vulnerability was fixed in Laravel 5.6.30 (August 2018). The target's cookie encryption middleware disables serialization for all cookies via ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target repository Laravel 5.7.29-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The fix for this vulnerability was already present in the upstream Laravel 5.7.29 release (September 2018), which shipped after the vulnerability was fixed in Laravel 5.6.30 (August 2018). The target's cookie encryption middleware disables serialization for all cookies via ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.7.29-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 5.7.29 code is not affected by GHSA-7852-w36x-6mf6. The IV length validation fix (checking that base64-decoded IV length matches openssl_cipher_iv_length) is already present in the Encrypter.php validPayload() method at line 210. This fix was included in the upstream Laravel 5.7.29 release (authored by Taylor Otwell in March 2018, before Laravel 5.7 was released in September ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel 5.7.29 code is not affected by GHSA-7852-w36x-6mf6. The IV length validation fix (checking that base64-decoded IV length matches openssl_cipher_iv_length) is already present in the Encrypter.php validPayload() method at line 210. This fix was included in the upstream Laravel 5.7.29 release (authored by Taylor Otwell in March 2018, before Laravel 5.7 was released in September ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:02:07.146715+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.7.29-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 does not support temporary signed URLs for local filesystem storage. The vulnerable feature (LocalFilesystemAdapter with temporaryUrl/temporaryUploadUrl methods) does not exist in this version. The FilesystemAdapter::temporaryUrl() method explicitly throws RuntimeException when used with LocalAdapter.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 does not support temporary signed URLs for local filesystem storage. The vulnerable feature (LocalFilesystemAdapter with temporaryUrl/temporaryUploadUrl methods) does not exist in this version. The FilesystemAdapter::temporaryUrl() method explicitly throws RuntimeException when used with LocalAdapter." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.7.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.7.29-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:02:07.146715+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.7.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.7.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.7.29-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } } ], "timestamp": "2026-10-12T07:02:07.146715+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.7.29-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:45:31.279874+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 6.20.45-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:45:31.279874+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 6.20.45-p7+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:45:31.279874+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 6.20.45-p7+tuxcare of laravel/framework. CVE-2018-15133 is NOT present in Laravel 6.20.45-p6+tuxcare. The vulnerability (RCE via unserialize on X-XSRF-TOKEN) was fixed in upstream Laravel 5.6.30/5.5.41 (August 2018) by disabling cookie serialization. The fix (protected static $serialize = false; using static::serialized() in decrypt calls) was already present when Laravel 6.20.45 was released and onboarded by TuxCare. The vulnerable code pattern does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 is NOT present in Laravel 6.20.45-p6+tuxcare. The vulnerability (RCE via unserialize on X-XSRF-TOKEN) was fixed in upstream Laravel 5.6.30/5.5.41 (August 2018) by disabling cookie serialization. The fix (protected static $serialize = false; using static::serialized() in decrypt calls) was already present when Laravel 6.20.45 was released and onboarded by TuxCare. The vulnerable code pattern does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:45:31.279874+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 6.20.45-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 6.20.45-p7+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:45:31.279874+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 6.20.45-p7+tuxcare of laravel/framework. The target Laravel Framework 6.20.45 is NOT vulnerable to CVE-2020-19316. The vulnerable code pattern (unescaped parameters in Windows mklink exec call) is not present. The fix using escapeshellarg() was already included in the upstream Laravel v6.20.45 release that TuxCare onboarded. The vulnerability affected Laravel before 5.8.17 (patched May 2019), and version 6.20.45 already contains the upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target Laravel Framework 6.20.45 is NOT vulnerable to CVE-2020-19316. The vulnerable code pattern (unescaped parameters in Windows mklink exec call) is not present. The fix using escapeshellarg() was already included in the upstream Laravel v6.20.45 release that TuxCare onboarded. The vulnerability affected Laravel before 5.8.17 (patched May 2019), and version 6.20.45 already contains the upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:45:31.279874+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 6.20.45-p7+tuxcare of laravel/framework. The target Laravel framework version 6.20.45-p6+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability (mass assignment bypass via non-existent column names) was fixed in upstream Laravel v6.18.35 (commit 897d107775 by Taylor Otwell). The target version 6.20.45 already contains this fix, which validates that attribute keys exist as actual database columns via the isGuardableColumn() method. The fix was shipped in the upstream release and onboarded to TuxCare via snapshot commit abbc62d18a. The vulnerable pattern (allowing mass assignment to arbitrary non-column attributes) is not present in the target code.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel framework version 6.20.45-p6+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability (mass assignment bypass via non-existent column names) was fixed in upstream Laravel v6.18.35 (commit 897d107775 by Taylor Otwell). The target version 6.20.45 already contains this fix, which validates that attribute keys exist as actual database columns via the isGuardableColumn() method. The fix was shipped in the upstream release and onboarded to TuxCare via snapshot commit abbc62d18a. The vulnerable pattern (allowing mass assignment to arbitrary non-column attributes) is not present in the target code." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:45:31.279874+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 6.20.45-p7+tuxcare of laravel/framework. CVE-2021-21263 affects Laravel versions <6.20.12. The target is version 6.20.45, which includes the upstream fix that prevents query binding exploitation. The vulnerability allowed array values to be passed to query builder methods where scalar values were expected, causing incorrect binding counts and corrupted query results. The target contains comprehensive protections using a `flattenValue()` helper method across all affected methods (where, having, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, whereBetween). The fix was present in the upstream v6.20.45 release and was imported via TuxCare's snapshot commit abbc62d18a, with no subsequent modifications to the query builder.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "CVE-2021-21263 affects Laravel versions <6.20.12. The target is version 6.20.45, which includes the upstream fix that prevents query binding exploitation. The vulnerability allowed array values to be passed to query builder methods where scalar values were expected, causing incorrect binding counts and corrupted query results. The target contains comprehensive protections using a `flattenValue()` helper method across all affected methods (where, having, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, whereBetween). The fix was present in the upstream v6.20.45 release and was imported via TuxCare's snapshot commit abbc62d18a, with no subsequent modifications to the query builder." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:45:31.279874+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 6.20.45-p7+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:45:31.279874+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 6.20.45-p7+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:45:31.279874+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 6.20.45-p7+tuxcare of laravel/framework. The target repository (Laravel framework 6.20.45-p6+tuxcare) is not affected by CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled, allowing attackers to control environment detection through $_SERVER['argv']. The fix adds a runningInConsole() check before using argv values. This fix was already present in the upstream Laravel v6.20.45 release (authored by Taylor Otwell, taylor@laravel.com, Nov 2024) before TuxCare created their snapshot. The TuxCare branch started from a snapshot of v6.20.45 (commit abbc62d18a) which already contained the fixed code. No TuxCare backport was necessary as the vulnerable code pattern never existed in this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target repository (Laravel framework 6.20.45-p6+tuxcare) is not affected by CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled, allowing attackers to control environment detection through $_SERVER['argv']. The fix adds a runningInConsole() check before using argv values. This fix was already present in the upstream Laravel v6.20.45 release (authored by Taylor Otwell, taylor@laravel.com, Nov 2024) before TuxCare created their snapshot. The TuxCare branch started from a snapshot of v6.20.45 (commit abbc62d18a) which already contained the fixed code. No TuxCare backport was necessary as the vulnerable code pattern never existed in this branch." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:45:31.279874+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 6.20.45-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:45:31.279874+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 6.20.45-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:45:31.279874+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 6.20.45-p7+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:46:15.891205+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 6.20.45-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:45:31.279874+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 6.20.45-p7+tuxcare of laravel/framework. not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:45:31.279874+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 6.20.45-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:45:31.279874+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 6.20.45-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:45:31.279874+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 6.20.45-p7+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:45:31.279874+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 6.20.45-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:45:31.279874+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 6.20.45-p7+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:45:31.279874+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 6.20.45-p7+tuxcare of laravel/framework. Laravel Framework 6.20.45 is not affected by GHSA-qm5c-m76r-2hfr (encryption oracle RCE via cookie session driver). The vulnerability was fixed by upstream Laravel in version 6.18.31 on July 27, 2020, by replacing predictable SHA1 hash prefixes with keyed HMAC values in cookie encryption. Version 6.20.45 was released after this fix and already includes the CookieValuePrefix class with hash_hmac() implementation. The target contains the secure code pattern, not the vulnerable one.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel Framework 6.20.45 is not affected by GHSA-qm5c-m76r-2hfr (encryption oracle RCE via cookie session driver). The vulnerability was fixed by upstream Laravel in version 6.18.31 on July 27, 2020, by replacing predictable SHA1 hash prefixes with keyed HMAC values in cookie encryption. Version 6.20.45 was released after this fix and already includes the CookieValuePrefix class with hash_hmac() implementation. The target contains the secure code pattern, not the vulnerable one." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:45:31.279874+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 6.20.45-p7+tuxcare of laravel/framework. not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:45:31.279874+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 6.20.45-p7+tuxcare of laravel/framework. The target repository (Laravel 6.20.45) is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involving unexpected query bindings from array values has already been fixed in the upstream Laravel release v6.20.11 (Jan 13, 2021) and v6.20.14 (Jan 21, 2021), which were released well before v6.20.45. All query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the `flattenValue()` helper method to extract scalar values from array inputs, preventing the SQL binding mismatch vulnerability. The fix was authored by Taylor Otwell for the upstream Laravel framework and was included in the v6.20.45 release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "The target repository (Laravel 6.20.45) is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involving unexpected query bindings from array values has already been fixed in the upstream Laravel release v6.20.11 (Jan 13, 2021) and v6.20.14 (Jan 21, 2021), which were released well before v6.20.45. All query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the `flattenValue()` helper method to extract scalar values from array inputs, preventing the SQL binding mismatch vulnerability. The fix was authored by Taylor Otwell for the upstream Laravel framework and was included in the v6.20.45 release that TuxCare onboarded." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 6.20.45-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:45:39.779746+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 6.20.45-p4+tuxcare of laravel/framework. CVE-2018-15133 is NOT present in Laravel 6.20.45-p6+tuxcare. The vulnerability (RCE via unserialize on X-XSRF-TOKEN) was fixed in upstream Laravel 5.6.30/5.5.41 (August 2018) by disabling cookie serialization. The fix (protected static $serialize = false; using static::serialized() in decrypt calls) was already present when Laravel 6.20.45 was released and onboarded by TuxCare. The vulnerable code pattern does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 is NOT present in Laravel 6.20.45-p6+tuxcare. The vulnerability (RCE via unserialize on X-XSRF-TOKEN) was fixed in upstream Laravel 5.6.30/5.5.41 (August 2018) by disabling cookie serialization. The fix (protected static $serialize = false; using static::serialized() in decrypt calls) was already present when Laravel 6.20.45 was released and onboarded by TuxCare. The vulnerable code pattern does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 6.20.45-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 6.20.45-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 6.20.45-p4+tuxcare of laravel/framework. The target Laravel Framework 6.20.45 is NOT vulnerable to CVE-2020-19316. The vulnerable code pattern (unescaped parameters in Windows mklink exec call) is not present. The fix using escapeshellarg() was already included in the upstream Laravel v6.20.45 release that TuxCare onboarded. The vulnerability affected Laravel before 5.8.17 (patched May 2019), and version 6.20.45 already contains the upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target Laravel Framework 6.20.45 is NOT vulnerable to CVE-2020-19316. The vulnerable code pattern (unescaped parameters in Windows mklink exec call) is not present. The fix using escapeshellarg() was already included in the upstream Laravel v6.20.45 release that TuxCare onboarded. The vulnerability affected Laravel before 5.8.17 (patched May 2019), and version 6.20.45 already contains the upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:42:21.835037+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 6.20.45-p4+tuxcare of laravel/framework. The target Laravel framework version 6.20.45-p6+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability (mass assignment bypass via non-existent column names) was fixed in upstream Laravel v6.18.35 (commit 897d107775 by Taylor Otwell). The target version 6.20.45 already contains this fix, which validates that attribute keys exist as actual database columns via the isGuardableColumn() method. The fix was shipped in the upstream release and onboarded to TuxCare via snapshot commit abbc62d18a. The vulnerable pattern (allowing mass assignment to arbitrary non-column attributes) is not present in the target code.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel framework version 6.20.45-p6+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability (mass assignment bypass via non-existent column names) was fixed in upstream Laravel v6.18.35 (commit 897d107775 by Taylor Otwell). The target version 6.20.45 already contains this fix, which validates that attribute keys exist as actual database columns via the isGuardableColumn() method. The fix was shipped in the upstream release and onboarded to TuxCare via snapshot commit abbc62d18a. The vulnerable pattern (allowing mass assignment to arbitrary non-column attributes) is not present in the target code." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 6.20.45-p4+tuxcare of laravel/framework. CVE-2021-21263 affects Laravel versions <6.20.12. The target is version 6.20.45, which includes the upstream fix that prevents query binding exploitation. The vulnerability allowed array values to be passed to query builder methods where scalar values were expected, causing incorrect binding counts and corrupted query results. The target contains comprehensive protections using a `flattenValue()` helper method across all affected methods (where, having, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, whereBetween). The fix was present in the upstream v6.20.45 release and was imported via TuxCare's snapshot commit abbc62d18a, with no subsequent modifications to the query builder.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "CVE-2021-21263 affects Laravel versions <6.20.12. The target is version 6.20.45, which includes the upstream fix that prevents query binding exploitation. The vulnerability allowed array values to be passed to query builder methods where scalar values were expected, causing incorrect binding counts and corrupted query results. The target contains comprehensive protections using a `flattenValue()` helper method across all affected methods (where, having, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, whereBetween). The fix was present in the upstream v6.20.45 release and was imported via TuxCare's snapshot commit abbc62d18a, with no subsequent modifications to the query builder." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 6.20.45-p4+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:30:41.069534+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 6.20.45-p4+tuxcare of laravel/framework. The target repository (Laravel framework 6.20.45-p6+tuxcare) is not affected by CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled, allowing attackers to control environment detection through $_SERVER['argv']. The fix adds a runningInConsole() check before using argv values. This fix was already present in the upstream Laravel v6.20.45 release (authored by Taylor Otwell, taylor@laravel.com, Nov 2024) before TuxCare created their snapshot. The TuxCare branch started from a snapshot of v6.20.45 (commit abbc62d18a) which already contained the fixed code. No TuxCare backport was necessary as the vulnerable code pattern never existed in this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target repository (Laravel framework 6.20.45-p6+tuxcare) is not affected by CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled, allowing attackers to control environment detection through $_SERVER['argv']. The fix adds a runningInConsole() check before using argv values. This fix was already present in the upstream Laravel v6.20.45 release (authored by Taylor Otwell, taylor@laravel.com, Nov 2024) before TuxCare created their snapshot. The TuxCare branch started from a snapshot of v6.20.45 (commit abbc62d18a) which already contained the fixed code. No TuxCare backport was necessary as the vulnerable code pattern never existed in this branch." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-09-29T20:36:58.499788+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-11-04T11:46:15.891205+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 6.20.45-p4+tuxcare of laravel/framework, and is fixed in 6.20.45-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 6.20.45-p4+tuxcare of laravel/framework, and is fixed in 6.20.45-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:50:01.681995+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 6.20.45-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:05:58.501817+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:19:00.105438+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 6.20.45-p4+tuxcare of laravel/framework. Laravel Framework 6.20.45 is not affected by GHSA-qm5c-m76r-2hfr (encryption oracle RCE via cookie session driver). The vulnerability was fixed by upstream Laravel in version 6.18.31 on July 27, 2020, by replacing predictable SHA1 hash prefixes with keyed HMAC values in cookie encryption. Version 6.20.45 was released after this fix and already includes the CookieValuePrefix class with hash_hmac() implementation. The target contains the secure code pattern, not the vulnerable one.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel Framework 6.20.45 is not affected by GHSA-qm5c-m76r-2hfr (encryption oracle RCE via cookie session driver). The vulnerability was fixed by upstream Laravel in version 6.18.31 on July 27, 2020, by replacing predictable SHA1 hash prefixes with keyed HMAC values in cookie encryption. Version 6.20.45 was released after this fix and already includes the CookieValuePrefix class with hash_hmac() implementation. The target contains the secure code pattern, not the vulnerable one." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:42:21.835037+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 6.20.45-p4+tuxcare of laravel/framework. The target repository (Laravel 6.20.45) is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involving unexpected query bindings from array values has already been fixed in the upstream Laravel release v6.20.11 (Jan 13, 2021) and v6.20.14 (Jan 21, 2021), which were released well before v6.20.45. All query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the `flattenValue()` helper method to extract scalar values from array inputs, preventing the SQL binding mismatch vulnerability. The fix was authored by Taylor Otwell for the upstream Laravel framework and was included in the v6.20.45 release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "The target repository (Laravel 6.20.45) is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involving unexpected query bindings from array values has already been fixed in the upstream Laravel release v6.20.11 (Jan 13, 2021) and v6.20.14 (Jan 21, 2021), which were released well before v6.20.45. All query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the `flattenValue()` helper method to extract scalar values from array inputs, preventing the SQL binding mismatch vulnerability. The fix was authored by Taylor Otwell for the upstream Laravel framework and was included in the v6.20.45 release that TuxCare onboarded." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 7.30.7-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 7.30.7-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 7.30.7-p6+tuxcare is not affected by CVE-2017-14775. Both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() comparison for remember_me tokens, preventing timing attacks. This fix was already present in the upstream Laravel 7.30.7 release (originally fixed in Laravel 5.5.10 by commit 576cba749f), which TuxCare imported via snapshot commit 5082773b92.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel 7.30.7-p6+tuxcare is not affected by CVE-2017-14775. Both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() comparison for remember_me tokens, preventing timing attacks. This fix was already present in the upstream Laravel 7.30.7 release (originally fixed in Laravel 5.5.10 by commit 576cba749f), which TuxCare imported via snapshot commit 5082773b92." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 7.30.7-p1+tuxcare of laravel/framework. CVE-2018-15133 is NOT present in laravel/framework v7.30.7. The vulnerability affected versions through 5.5.40 and 5.6.x through 5.6.29. The target version (7.30.7, released in 2020) includes upstream fixes from August 2018 that disable PHP serialization for all encrypted cookies, preventing unsafe unserialize() calls on attacker-controlled cookie data. The fix was shipped in the upstream Laravel release, not applied by TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 is NOT present in laravel/framework v7.30.7. The vulnerability affected versions through 5.5.40 and 5.6.x through 5.6.29. The target version (7.30.7, released in 2020) includes upstream fixes from August 2018 that disable PHP serialization for all encrypted cookies, preventing unsafe unserialize() calls on attacker-controlled cookie data. The fix was shipped in the upstream Laravel release, not applied by TuxCare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 7.30.7-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 7.30.7-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 7.30.7-p1+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before version 5.8.17. The target version 7.30.7-p6+tuxcare already contains the upstream fix. The vulnerability was an OS command injection in the `link()` function in Filesystem.php, where user-controlled `$link` and `$target` parameters were passed to `exec(\"mklink ...\")` without proper escaping. The fix, applied by Laravel upstream in May 2019 (commit 44c3feb6), wraps both parameters with `escapeshellarg()` to prevent shell metacharacter injection. This fix was already present in Laravel 7.30.7 when TuxCare onboarded it in the snapshot commit 5082773b92.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before version 5.8.17. The target version 7.30.7-p6+tuxcare already contains the upstream fix. The vulnerability was an OS command injection in the `link()` function in Filesystem.php, where user-controlled `$link` and `$target` parameters were passed to `exec(\"mklink ...\")` without proper escaping. The fix, applied by Laravel upstream in May 2019 (commit 44c3feb6), wraps both parameters with `escapeshellarg()` to prevent shell metacharacter injection. This fix was already present in Laravel 7.30.7 when TuxCare onboarded it in the snapshot commit 5082773b92." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:42:21.835037+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 7.30.7-p1+tuxcare of laravel/framework. The target repository (laravel/framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2020-24941. The vulnerability affected Laravel versions before 6.18.35 and 7.x before 7.24.0. The target version 7.30.7 is greater than 7.24.0, and the fix was already present in the upstream v7.30.7 release that was onboarded into the TuxCare branch via snapshot commit 5082773b92. The fix adds validation to ensure mass-assigned attributes are actual database columns, preventing attackers from bypassing the $guarded property protection using fake column names with JSON-like syntax. The vulnerable code pattern (missing isGuardableColumn validation) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target repository (laravel/framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2020-24941. The vulnerability affected Laravel versions before 6.18.35 and 7.x before 7.24.0. The target version 7.30.7 is greater than 7.24.0, and the fix was already present in the upstream v7.30.7 release that was onboarded into the TuxCare branch via snapshot commit 5082773b92. The fix adds validation to ensure mass-assigned attributes are actual database columns, preventing attackers from bypassing the $guarded property protection using fake column names with JSON-like syntax. The vulnerable code pattern (missing isGuardableColumn validation) is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 7.30.7-p1+tuxcare of laravel/framework. CVE-2021-21263 affects Laravel versions <6.20.12, <7.30.3, and <8.22.1. The target is Laravel v7.30.7-p6+tuxcare, which is >7.30.3. The upstream Laravel v7.30.7 release already included the fix via the flattenValue() method and array_slice() limiting, which was snapshotted into the TuxCare branch. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) now properly limit array inputs to prevent query binding exploitation. The vulnerable pattern is not present in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "CVE-2021-21263 affects Laravel versions <6.20.12, <7.30.3, and <8.22.1. The target is Laravel v7.30.7-p6+tuxcare, which is >7.30.3. The upstream Laravel v7.30.7 release already included the fix via the flattenValue() method and array_slice() limiting, which was snapshotted into the TuxCare branch. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) now properly limit array inputs to prevent query binding exploitation. The vulnerable pattern is not present in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 7.30.7-p1+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 7.30.7-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2021-43808 (Blade XSS via predictable parent placeholder). The upstream fix was already present in v7.30.7 when TuxCare onboarded it. The fix implements random per-request salt for parent placeholders, making them unguessable and preventing XSS exploitation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2021-43808 (Blade XSS via predictable parent placeholder). The upstream fix was already present in v7.30.7 when TuxCare onboarded it. The fix implements random per-request salt for parent placeholders, making them unguessable and preventing XSS exploitation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 7.30.7-p1+tuxcare of laravel/framework. The target repository (Laravel framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled. The fix\u2014checking runningInConsole() before using $_SERVER['argv']\u2014was already present in the upstream Laravel v7.30.7 release that TuxCare imported via snapshot on 2026-05-05. The upstream fix was authored by Taylor Otwell on 2024-11-12. The target code at Application.php:560-562 correctly guards $_SERVER['argv'] access, preventing web requests from manipulating the framework's environment detection.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target repository (Laravel framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled. The fix\u2014checking runningInConsole() before using $_SERVER['argv']\u2014was already present in the upstream Laravel v7.30.7 release that TuxCare imported via snapshot on 2026-05-05. The upstream fix was authored by Taylor Otwell on 2024-11-12. The target code at Application.php:560-562 correctly guards $_SERVER['argv'] access, preventing web requests from manipulating the framework's environment detection." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 affects version 7.30.7-p1+tuxcare of laravel/framework, and is fixed in 7.30.7-p2+tuxcare.", "vulnerability": { "name": "CVE-2025-27515" }, "action_statement": "Vulnerability CVE-2025-27515 affects version 7.30.7-p1+tuxcare of laravel/framework, and is fixed in 7.30.7-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:36:58.499788+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 7.30.7-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is NOT affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's exception renderer system which uses Tippy.js tooltips with `allowHTML: true` on user-controlled data. Laravel 7.30.7 predates this feature entirely and uses the Whoops library for debug mode exception handling - a completely different architecture with no Tippy.js tooltips, no `data-tippy-content` att...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is NOT affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's exception renderer system which uses Tippy.js tooltips with `allowHTML: true` on user-controlled data. Laravel 7.30.7 predates this feature entirely and uses the Whoops library for debug mode exception handling - a completely different architecture with no Tippy.js tooltips, no `data-tippy-content` att..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 7.30.7-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource system, which was introduced in version 12.x, five major versions after the target. The vulnerable pattern requires: (1) JsonApi resources processing user-supplied `include` query parameters, (2) passing unsanitized nested relationship names to `loadMissing()`, and (3) potential invocation ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource system, which was introduced in version 12.x, five major versions after the target. The vulnerable pattern requires: (1) JsonApi resources processing user-supplied `include` query parameters, (2) passing unsanitized nested relationship names to `loadMissing()`, and (3) potential invocation ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-11-04T11:50:18.837974+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 7.30.7-p1+tuxcare of laravel/framework, and is fixed in 7.30.7-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 7.30.7-p1+tuxcare of laravel/framework, and is fixed in 7.30.7-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:52:18.183384+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 7.30.7-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework v7.30.7-p6+tuxcare is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is absent because the upstream Laravel v7.30.5 release already included the fix, which adds integer casting to limit() and offset() methods in Builder.php. This version (7.30.7) inherits that upstream fix via the snapshot commit that imported the v7.30.7...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Laravel Framework v7.30.7-p6+tuxcare is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is absent because the upstream Laravel v7.30.5 release already included the fix, which adds integer casting to limit() and offset() methods in Builder.php. This version (7.30.7) inherits that upstream fix via the snapshot commit that imported the v7.30.7..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 7.30.7-p1+tuxcare of laravel/framework, and is fixed in 7.30.7-p3+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 7.30.7-p1+tuxcare of laravel/framework, and is fixed in 7.30.7-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:03:57.153420+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 7.30.7-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 7.30.7-p6+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling PHP object serialization in cookies. Laravel 7.30.7 (released September 2020) already contains this fix. The target was onboarded from the upstream Laravel 7.30.7 release, which shipped wit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 7.30.7-p6+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling PHP object serialization in cookies. Laravel 7.30.7 (released September 2020) already contains this fix. The target was onboarded from the upstream Laravel 7.30.7 release, which shipped wit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 7.30.7-p1+tuxcare of laravel/framework. not_affected \u2014 Target Laravel v7.30.7 already contains the upstream IV length validation fix. The vulnerability (GHSA-7852-w36x-6mf6) allows decryption to return false instead of throwing an exception when processing payloads with manipulated IV length. The fix validates that decoded IV length matches expected cipher IV length (Encrypter.php:214). This was authored by Taylor Otwell on March 30, 2018, and ship...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 Target Laravel v7.30.7 already contains the upstream IV length validation fix. The vulnerability (GHSA-7852-w36x-6mf6) allows decryption to return false instead of throwing an exception when processing payloads with manipulated IV length. The fix validates that decoded IV length matches expected cipher IV length (Encrypter.php:214). This was authored by Taylor Otwell on March 30, 2018, and ship..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 7.30.7-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7-p1+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in the LocalFilesystemAdapter class which provides temporary signed URL generation for local filesystems. This class and the associated local file serving feature were introduced in Laravel 9.x and do not exist in Laravel 7.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7-p1+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in the LocalFilesystemAdapter class which provides temporary signed URL generation for local filesystems. This class and the associated local file serving feature were introduced in Laravel 9.x and do not exist in Laravel 7.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:20:09.538096+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 7.30.7-p1+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 7.30.7 is NOT AFFECTED. All security fixes for GHSA-jwvj-pwww-3mj5 (preventing unexpected query bindings from array-valued parameters) were already present in the upstream Laravel 7.30.7 release before TuxCare created the snapshot. The target contains the `flattenValue()` method and uses it in all affected query builder methods (where, having, whereDate, whereTime, whereDay, wher...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 Target Laravel 7.30.7 is NOT AFFECTED. All security fixes for GHSA-jwvj-pwww-3mj5 (preventing unexpected query bindings from array-valued parameters) were already present in the upstream Laravel 7.30.7 release before TuxCare created the snapshot. The target contains the `flattenValue()` method and uses it in all affected query builder methods (where, having, whereDate, whereTime, whereDay, wher..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:19:00.105438+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 7.30.7-p1+tuxcare of laravel/framework. Laravel framework 7.30.7 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (RCE via cookie session driver + encryption oracle). The vulnerability was fixed in upstream Laravel 7.22.2 (July 27, 2020) by replacing the publicly-computable SHA1 hash cookie prefix with an HMAC requiring the secret encryption key. Laravel 7.30.7 (released October 22, 2020) already contains this fix. The TuxCare snapshot merely imported the already-patched upstream version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel framework 7.30.7 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (RCE via cookie session driver + encryption oracle). The vulnerability was fixed in upstream Laravel 7.22.2 (July 27, 2020) by replacing the publicly-computable SHA1 hash cookie prefix with an HMAC requiring the secret encryption key. Laravel 7.30.7 (released October 22, 2020) already contains this fix. The TuxCare snapshot merely imported the already-patched upstream version." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 7.30.7-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 7.30.7-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:42:21.835037+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 7.30.7-p1+tuxcare of laravel/framework. Laravel framework 7.30.7-p6+tuxcare is NOT affected by GHSA-x7p5-p2c9-phvg (unexpected query binding vulnerability). The fix was already present in the upstream Laravel v7.30.7 release, which was onboarded by TuxCare. All vulnerable query builder methods (where, having, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, havingBetween) correctly use flattenValue() to extract scalar values from arrays and limit bindings appropriately.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "Laravel framework 7.30.7-p6+tuxcare is NOT affected by GHSA-x7p5-p2c9-phvg (unexpected query binding vulnerability). The fix was already present in the upstream Laravel v7.30.7 release, which was onboarded by TuxCare. All vulnerable query builder methods (where, having, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, havingBetween) correctly use flattenValue() to extract scalar values from arrays and limit bindings appropriately." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:38:09.071863+00:00", "status_notes": "Vulnerability CVE-2022-23614 does not affect version v1.44.8-p3+tuxcare of twig/twig. CVE-2022-23614 affects Twig's `sort` filter when an `arrow` parameter is passed in sandbox mode, allowing arbitrary PHP function execution. However, Twig v1.44.8 does not have the arrow parameter feature in the sort filter. The vulnerable code pattern (accepting an arrow callable parameter) does not exist in this version. The arrow parameter was introduced in v2.12.0 (August 2019), while the target is based on the 1.x branch which never received this feature. The sort filter signature in v1.44.8 is `function twig_sort_filter($array)` with only one parameter, making the vulnerability not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-23614" }, "impact_statement": "CVE-2022-23614 affects Twig's `sort` filter when an `arrow` parameter is passed in sandbox mode, allowing arbitrary PHP function execution. However, Twig v1.44.8 does not have the arrow parameter feature in the sort filter. The vulnerable code pattern (accepting an arrow callable parameter) does not exist in this version. The arrow parameter was introduced in v2.12.0 (August 2019), while the target is based on the 1.x branch which never received this feature. The sort filter signature in v1.44.8 is `function twig_sort_filter($array)` with only one parameter, making the vulnerability not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:38:09.071863+00:00", "status_notes": "Vulnerability CVE-2022-39261 does not affect version v1.44.8-p3+tuxcare of twig/twig. The target repository (twig/twig v1.44.8-p2+tuxcare) is not affected by CVE-2022-39261. The vulnerability was a path traversal issue in Twig's FilesystemLoader that allowed reading files outside configured template directories when using namespace syntax like '@namespace/../file'. The fix was applied in upstream Twig v1.44.7 (2022-09-28) by Fabien Potencier, and the target is based on v1.44.8 (2024-09-09), which already included this fix. The vulnerable code pattern (validating template name before parsing namespace) is not present; the target code correctly validates the shortname after parsing the namespace prefix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-39261" }, "impact_statement": "The target repository (twig/twig v1.44.8-p2+tuxcare) is not affected by CVE-2022-39261. The vulnerability was a path traversal issue in Twig's FilesystemLoader that allowed reading files outside configured template directories when using namespace syntax like '@namespace/../file'. The fix was applied in upstream Twig v1.44.7 (2022-09-28) by Fabien Potencier, and the target is based on v1.44.8 (2024-09-09), which already included this fix. The vulnerable code pattern (validating template name before parsing namespace) is not present; the target code correctly validates the shortname after parsing the namespace prefix." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:38:09.071863+00:00", "status_notes": "Vulnerability CVE-2024-45411 affects version v1.44.8-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-45411" }, "action_statement": "Vulnerability CVE-2024-45411 affects version v1.44.8-p3+tuxcare of twig/twig." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:38:09.071863+00:00", "status_notes": "Vulnerability CVE-2024-51754 is fixed in version v1.44.8-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-51754" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:38:09.071863+00:00", "status_notes": "Vulnerability CVE-2024-51755 is fixed in version v1.44.8-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-51755" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:38:09.071863+00:00", "status_notes": "Vulnerability CVE-2026-24425 does not affect version v1.44.8-p3+tuxcare of twig/twig. CVE-2026-24425 affects Twig when using SourcePolicyInterface to enable per-template sandboxing. The target (Twig v1.44.8) does not have SourcePolicyInterface - this feature was introduced in later versions (2.x/3.x). The vulnerability chain cannot form because the required SourcePolicyInterface mechanism is absent from this version. The existing sandboxing mechanisms (global and {% sandbox %} tag) work correctly with the current implementation.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-24425" }, "impact_statement": "CVE-2026-24425 affects Twig when using SourcePolicyInterface to enable per-template sandboxing. The target (Twig v1.44.8) does not have SourcePolicyInterface - this feature was introduced in later versions (2.x/3.x). The vulnerability chain cannot form because the required SourcePolicyInterface mechanism is absent from this version. The existing sandboxing mechanisms (global and {% sandbox %} tag) work correctly with the current implementation." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:38:09.071863+00:00", "status_notes": "Vulnerability CVE-2026-46628 is fixed in version v1.44.8-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46628" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:38:09.071863+00:00", "status_notes": "Vulnerability CVE-2026-46633 is fixed in version v1.44.8-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46633" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:38:09.071863+00:00", "status_notes": "Vulnerability CVE-2026-46634 does not affect version v1.44.8-p3+tuxcare of twig/twig. CVE-2026-46634 is NOT applicable to Twig v1.44.8-p2+tuxcare. The vulnerability specifically requires SourcePolicyInterface (introduced in Twig 3.x) for selective name-based sandboxing. Twig 1.44.8 uses state-based sandboxing where all templates share the same SandboxExtension instance from the Environment. Templates created via template_from_string() inherit the sandbox state through this shared instance, preventing the bypass described in the CVE. The attack chain (synthesized template name bypassing name-based policy \u2192 checkSecurity() no-op) does not exist in this architecture.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-46634" }, "impact_statement": "CVE-2026-46634 is NOT applicable to Twig v1.44.8-p2+tuxcare. The vulnerability specifically requires SourcePolicyInterface (introduced in Twig 3.x) for selective name-based sandboxing. Twig 1.44.8 uses state-based sandboxing where all templates share the same SandboxExtension instance from the Environment. Templates created via template_from_string() inherit the sandbox state through this shared instance, preventing the bypass described in the CVE. The attack chain (synthesized template name bypassing name-based policy \u2192 checkSecurity() no-op) does not exist in this architecture." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:38:09.071863+00:00", "status_notes": "Vulnerability CVE-2026-46635 does not affect version v1.44.8-p3+tuxcare of twig/twig. not_affected \u2014 The `column` filter that is the subject of CVE-2026-46635 does not exist in Twig 1.44.8. This version is part of the Twig 1.x series (CHANGELOG notes v1.44.6 as \"Last version for the 1.x series\"), while the column filter was introduced in Twig 2.x. Without this filter, the vulnerable code path (template calls column filter \u2192 delegates to array_column() \u2192 reads object properties bypassing sandbo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-46635" }, "impact_statement": "not_affected \u2014 The `column` filter that is the subject of CVE-2026-46635 does not exist in Twig 1.44.8. This version is part of the Twig 1.x series (CHANGELOG notes v1.44.6 as \"Last version for the 1.x series\"), while the column filter was introduced in Twig 2.x. Without this filter, the vulnerable code path (template calls column filter \u2192 delegates to array_column() \u2192 reads object properties bypassing sandbo..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:38:09.071863+00:00", "status_notes": "Vulnerability CVE-2026-46638 is fixed in version v1.44.8-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46638" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:38:09.071863+00:00", "status_notes": "Vulnerability CVE-2026-46640 does not affect version v1.44.8-p3+tuxcare of twig/twig. Twig 1.44.8 is not affected by CVE-2026-46640. The vulnerability requires the `obj.(expr)` dynamic-attribute syntax for macro references, which was introduced in Twig 3.15.0 and does not exist in Twig 1.x. The target explicitly rejects dynamic macro names (ExpressionParser.php:506) and only supports static attribute access after the dot operator. The vulnerable code path involving MacroReferenceExpression and DotExpressionParser does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-46640" }, "impact_statement": "Twig 1.44.8 is not affected by CVE-2026-46640. The vulnerability requires the `obj.(expr)` dynamic-attribute syntax for macro references, which was introduced in Twig 3.15.0 and does not exist in Twig 1.x. The target explicitly rejects dynamic macro names (ExpressionParser.php:506) and only supports static attribute access after the dot operator. The vulnerable code path involving MacroReferenceExpression and DotExpressionParser does not exist in this version." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:38:52.435560+00:00", "status_notes": "Vulnerability CVE-2026-47730 is fixed in version v1.44.8-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-47730" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:38:09.071863+00:00", "status_notes": "Vulnerability CVE-2026-47732 is fixed in version v1.44.8-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-47732" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:38:09.071863+00:00", "status_notes": "Vulnerability CVE-2026-48805 does not affect version v1.44.8-p3+tuxcare of twig/twig. not_affected \u2014 Target Twig 1.44.8 is NOT AFFECTED by CVE-2026-48805. This vulnerability is specific to Twig 3.26.0+ architectural changes that introduced per-source sandbox state with boolean parameters. The three vulnerable deprecated wrapper functions mentioned in the CVE (twig_array_some(), twig_array_every(), twig_check_arrow_in_sandbox()) do not exist in Twig 1.44.x. The equivalent functionality in Twig ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48805" }, "impact_statement": "not_affected \u2014 Target Twig 1.44.8 is NOT AFFECTED by CVE-2026-48805. This vulnerability is specific to Twig 3.26.0+ architectural changes that introduced per-source sandbox state with boolean parameters. The three vulnerable deprecated wrapper functions mentioned in the CVE (twig_array_some(), twig_array_every(), twig_check_arrow_in_sandbox()) do not exist in Twig 1.44.x. The equivalent functionality in Twig ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:38:09.071863+00:00", "status_notes": "Vulnerability CVE-2026-48806 is fixed in version v1.44.8-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48806" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:38:09.071863+00:00", "status_notes": "Vulnerability CVE-2026-48807 is fixed in version v1.44.8-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48807" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:38:09.071863+00:00", "status_notes": "Vulnerability CVE-2026-48808 does not affect version v1.44.8-p3+tuxcare of twig/twig. not_affected \u2014 Twig v1.44.8 is not affected by CVE-2026-48808. The vulnerability concerns a sandbox bypass in the `column` filter when sandboxing is enabled via `SourcePolicyInterface`. However, v1.44.8 lacks both the column filter feature (introduced in later Twig versions 2.x/3.x) and the SourcePolicyInterface mechanism. Exhaustive searches across the codebase confirmed no column filter registration in Core...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48808" }, "impact_statement": "not_affected \u2014 Twig v1.44.8 is not affected by CVE-2026-48808. The vulnerability concerns a sandbox bypass in the `column` filter when sandboxing is enabled via `SourcePolicyInterface`. However, v1.44.8 lacks both the column filter feature (introduced in later Twig versions 2.x/3.x) and the SourcePolicyInterface mechanism. Exhaustive searches across the codebase confirmed no column filter registration in Core..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:38:09.071863+00:00", "status_notes": "Vulnerability CVE-2026-49981 is fixed in version v1.44.8-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-49981" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-7809 does not affect version v2.16.1-p1+tuxcare of twig/twig. already_fixed \u2014 CVE-2015-7809 affects Twig before version 1.20.0. The target repository is Twig version 2.16.1, which contains the fix introduced in 1.20.0. The vulnerability allowed remote code execution via the _self variable in templates when Sandbox mode was enabled. The fix adds a type validation check in the displayBlock function that ensures template blocks must be instances of \\Twig\\Template, preventin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-7809" }, "impact_statement": "already_fixed \u2014 CVE-2015-7809 affects Twig before version 1.20.0. The target repository is Twig version 2.16.1, which contains the fix introduced in 1.20.0. The vulnerability allowed remote code execution via the _self variable in templates when Sandbox mode was enabled. The fix adds a type validation check in the displayBlock function that ensures template blocks must be instances of \\Twig\\Template, preventin..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2019-9942 does not affect version v2.16.1-p1+tuxcare of twig/twig. already_fixed \u2014 CVE-2019-9942 has been fixed in Twig 2.16.1. The target contains the complete mitigation introduced in Twig 2.7.0 that prevents __toString() method calls from bypassing sandbox security policy restrictions.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-9942" }, "impact_statement": "already_fixed \u2014 CVE-2019-9942 has been fixed in Twig 2.16.1. The target contains the complete mitigation introduced in Twig 2.7.0 that prevents __toString() method calls from bypassing sandbox security policy restrictions." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2022-23614 does not affect version v2.16.1-p1+tuxcare of twig/twig. The target repository (Twig v2.16.1-p2+tuxcare) is NOT AFFECTED by CVE-2022-23614. The vulnerability (sandbox bypass via non-Closure callables in the sort filter) was fixed in upstream Twig v2.14.11 (released 2022-02-04). Since the target version v2.16.1 is newer than v2.14.11, the fix was already present in the upstream release that TuxCare onboarded. The defense code (twig_check_arrow_in_sandbox validation) is present in CoreExtension.php at line 954 and blocks the attack by throwing a RuntimeError when a non-Closure callable is passed to the sort filter in sandbox mode.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-23614" }, "impact_statement": "The target repository (Twig v2.16.1-p2+tuxcare) is NOT AFFECTED by CVE-2022-23614. The vulnerability (sandbox bypass via non-Closure callables in the sort filter) was fixed in upstream Twig v2.14.11 (released 2022-02-04). Since the target version v2.16.1 is newer than v2.14.11, the fix was already present in the upstream release that TuxCare onboarded. The defense code (twig_check_arrow_in_sandbox validation) is present in CoreExtension.php at line 954 and blocks the attack by throwing a RuntimeError when a non-Closure callable is passed to the sort filter in sandbox mode." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2022-39261 does not affect version v2.16.1-p1+tuxcare of twig/twig. CVE-2022-39261 describes a path traversal vulnerability in Twig's FilesystemLoader where namespaced template names like `@foo/../file.txt` could bypass validation to read arbitrary files outside configured template directories. The target repository (twig/twig v2.16.1-p2+tuxcare) is NOT AFFECTED because the upstream fix was already present in the v2.16.1 release that TuxCare onboarded. The fix changed validation order in FilesystemLoader::findTemplate() to validate the shortname AFTER namespace parsing (lines 209-211), ensuring path traversal sequences are detected. This was an upstream fix by Fabien Potencier, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-39261" }, "impact_statement": "CVE-2022-39261 describes a path traversal vulnerability in Twig's FilesystemLoader where namespaced template names like `@foo/../file.txt` could bypass validation to read arbitrary files outside configured template directories. The target repository (twig/twig v2.16.1-p2+tuxcare) is NOT AFFECTED because the upstream fix was already present in the v2.16.1 release that TuxCare onboarded. The fix changed validation order in FilesystemLoader::findTemplate() to validate the shortname AFTER namespace parsing (lines 209-211), ensuring path traversal sequences are detected. This was an upstream fix by Fabien Potencier, not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-10-29T11:16:40.182397+00:00", "status_notes": "Vulnerability CVE-2024-45411 does not affect version v2.16.1-p1+tuxcare of twig/twig. twig/twig 2.16.1 is the upstream release that fixes CVE-2024-45411 (GHSA-6j75-5wfj-gh66: affected >2.0.0,<=2.16.0; patched 2.16.1). The upstream fix (commit 2102dd1359) is part of the 2.16.1 code. In the TuxCare build the sandbox check was later moved into Template::ensureSecurityChecked(), which runs on every sandboxed render, including templates rendered via include(). The CVE-2024-45411 regression tests (testSandboxedInclude, testSandboxedIncludeWithPreloadedTemplate) pass on this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45411" }, "impact_statement": "twig/twig 2.16.1 is the upstream release that fixes CVE-2024-45411 (GHSA-6j75-5wfj-gh66: affected >2.0.0,<=2.16.0; patched 2.16.1). The upstream fix (commit 2102dd1359) is part of the 2.16.1 code. In the TuxCare build the sandbox check was later moved into Template::ensureSecurityChecked(), which runs on every sandboxed render, including templates rendered via include(). The CVE-2024-45411 regression tests (testSandboxedInclude, testSandboxedIncludeWithPreloadedTemplate) pass on this version." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51754 is fixed in version v2.16.1-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-51754" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51755 is fixed in version v2.16.1-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-51755" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24425 is fixed in version v2.16.1-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-24425" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46628 is fixed in version v2.16.1-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46628" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46633 is fixed in version v2.16.1-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46633" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-11-04T11:49:00.031657+00:00", "status_notes": "Vulnerability CVE-2026-46634 affects version v2.16.1-p1+tuxcare of twig/twig, and is fixed in v2.16.1-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-46634" }, "action_statement": "Vulnerability CVE-2026-46634 affects version v2.16.1-p1+tuxcare of twig/twig, and is fixed in v2.16.1-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46635 is fixed in version v2.16.1-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46635" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46638 is fixed in version v2.16.1-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46638" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:19:23.616509+00:00", "status_notes": "Vulnerability CVE-2026-46640 does not affect version v2.16.1-p1+tuxcare of twig/twig. Twig 2.16.1-p2+tuxcare is not affected by CVE-2026-46640. The vulnerability requires the `obj.(expr)` dynamic-attribute syntax with parenthesized expressions, which was introduced in Twig 3.15.0 and does not exist in Twig 2.x. The target version only supports `obj.name` (static identifiers), `obj[expr]` (bracket notation), and the `attribute()` function, all of which use safe mechanisms. Additionally, the macro call path in 2.x uses `->repr()` to escape method names when generating PHP code, preventing injection even if the syntax were supported.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-46640" }, "impact_statement": "Twig 2.16.1-p2+tuxcare is not affected by CVE-2026-46640. The vulnerability requires the `obj.(expr)` dynamic-attribute syntax with parenthesized expressions, which was introduced in Twig 3.15.0 and does not exist in Twig 2.x. The target version only supports `obj.name` (static identifiers), `obj[expr]` (bracket notation), and the `attribute()` function, all of which use safe mechanisms. Additionally, the macro call path in 2.x uses `->repr()` to escape method names when generating PHP code, preventing injection even if the syntax were supported." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-11-04T11:49:00.031657+00:00", "status_notes": "Vulnerability CVE-2026-47730 affects version v2.16.1-p1+tuxcare of twig/twig, and is fixed in v2.16.1-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-47730" }, "action_statement": "Vulnerability CVE-2026-47730 affects version v2.16.1-p1+tuxcare of twig/twig, and is fixed in v2.16.1-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47732 is fixed in version v2.16.1-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-47732" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48805 does not affect version v2.16.1-p1+tuxcare of twig/twig. not_affected \u2014 CVE-2026-48805 describes a sandbox bypass in Twig v3.26.0 where deprecated wrapper functions in src/Resources/core.php fail to forward sandbox state to refactored CoreExtension class methods. Target v2.16.1 uses a completely different architecture where the vulnerable delegation pattern does not exist. The functions twig_array_some() and twig_array_every() don't exist in v2.16.1, and twig_check...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48805" }, "impact_statement": "not_affected \u2014 CVE-2026-48805 describes a sandbox bypass in Twig v3.26.0 where deprecated wrapper functions in src/Resources/core.php fail to forward sandbox state to refactored CoreExtension class methods. Target v2.16.1 uses a completely different architecture where the vulnerable delegation pattern does not exist. The functions twig_array_some() and twig_array_every() don't exist in v2.16.1, and twig_check..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48806 affects version v2.16.1-p1+tuxcare of twig/twig, and is fixed in v2.16.1-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-48806" }, "action_statement": "Vulnerability CVE-2026-48806 affects version v2.16.1-p1+tuxcare of twig/twig, and is fixed in v2.16.1-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48807 is fixed in version v2.16.1-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48807" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48808 is fixed in version v2.16.1-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49981 is fixed in version v2.16.1-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-49981" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 7.30.7-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 7.30.7-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 7.30.7-p6+tuxcare is not affected by CVE-2017-14775. Both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() comparison for remember_me tokens, preventing timing attacks. This fix was already present in the upstream Laravel 7.30.7 release (originally fixed in Laravel 5.5.10 by commit 576cba749f), which TuxCare imported via snapshot commit 5082773b92.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel 7.30.7-p6+tuxcare is not affected by CVE-2017-14775. Both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() comparison for remember_me tokens, preventing timing attacks. This fix was already present in the upstream Laravel 7.30.7 release (originally fixed in Laravel 5.5.10 by commit 576cba749f), which TuxCare imported via snapshot commit 5082773b92." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 7.30.7-p4+tuxcare of laravel/framework. CVE-2018-15133 is NOT present in laravel/framework v7.30.7. The vulnerability affected versions through 5.5.40 and 5.6.x through 5.6.29. The target version (7.30.7, released in 2020) includes upstream fixes from August 2018 that disable PHP serialization for all encrypted cookies, preventing unsafe unserialize() calls on attacker-controlled cookie data. The fix was shipped in the upstream Laravel release, not applied by TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 is NOT present in laravel/framework v7.30.7. The vulnerability affected versions through 5.5.40 and 5.6.x through 5.6.29. The target version (7.30.7, released in 2020) includes upstream fixes from August 2018 that disable PHP serialization for all encrypted cookies, preventing unsafe unserialize() calls on attacker-controlled cookie data. The fix was shipped in the upstream Laravel release, not applied by TuxCare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 7.30.7-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 7.30.7-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 7.30.7-p4+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before version 5.8.17. The target version 7.30.7-p6+tuxcare already contains the upstream fix. The vulnerability was an OS command injection in the `link()` function in Filesystem.php, where user-controlled `$link` and `$target` parameters were passed to `exec(\"mklink ...\")` without proper escaping. The fix, applied by Laravel upstream in May 2019 (commit 44c3feb6), wraps both parameters with `escapeshellarg()` to prevent shell metacharacter injection. This fix was already present in Laravel 7.30.7 when TuxCare onboarded it in the snapshot commit 5082773b92.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before version 5.8.17. The target version 7.30.7-p6+tuxcare already contains the upstream fix. The vulnerability was an OS command injection in the `link()` function in Filesystem.php, where user-controlled `$link` and `$target` parameters were passed to `exec(\"mklink ...\")` without proper escaping. The fix, applied by Laravel upstream in May 2019 (commit 44c3feb6), wraps both parameters with `escapeshellarg()` to prevent shell metacharacter injection. This fix was already present in Laravel 7.30.7 when TuxCare onboarded it in the snapshot commit 5082773b92." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:42:21.835037+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 7.30.7-p4+tuxcare of laravel/framework. The target repository (laravel/framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2020-24941. The vulnerability affected Laravel versions before 6.18.35 and 7.x before 7.24.0. The target version 7.30.7 is greater than 7.24.0, and the fix was already present in the upstream v7.30.7 release that was onboarded into the TuxCare branch via snapshot commit 5082773b92. The fix adds validation to ensure mass-assigned attributes are actual database columns, preventing attackers from bypassing the $guarded property protection using fake column names with JSON-like syntax. The vulnerable code pattern (missing isGuardableColumn validation) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target repository (laravel/framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2020-24941. The vulnerability affected Laravel versions before 6.18.35 and 7.x before 7.24.0. The target version 7.30.7 is greater than 7.24.0, and the fix was already present in the upstream v7.30.7 release that was onboarded into the TuxCare branch via snapshot commit 5082773b92. The fix adds validation to ensure mass-assigned attributes are actual database columns, preventing attackers from bypassing the $guarded property protection using fake column names with JSON-like syntax. The vulnerable code pattern (missing isGuardableColumn validation) is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 7.30.7-p4+tuxcare of laravel/framework. CVE-2021-21263 affects Laravel versions <6.20.12, <7.30.3, and <8.22.1. The target is Laravel v7.30.7-p6+tuxcare, which is >7.30.3. The upstream Laravel v7.30.7 release already included the fix via the flattenValue() method and array_slice() limiting, which was snapshotted into the TuxCare branch. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) now properly limit array inputs to prevent query binding exploitation. The vulnerable pattern is not present in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "CVE-2021-21263 affects Laravel versions <6.20.12, <7.30.3, and <8.22.1. The target is Laravel v7.30.7-p6+tuxcare, which is >7.30.3. The upstream Laravel v7.30.7 release already included the fix via the flattenValue() method and array_slice() limiting, which was snapshotted into the TuxCare branch. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) now properly limit array inputs to prevent query binding exploitation. The vulnerable pattern is not present in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 7.30.7-p4+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 7.30.7-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2021-43808 (Blade XSS via predictable parent placeholder). The upstream fix was already present in v7.30.7 when TuxCare onboarded it. The fix implements random per-request salt for parent placeholders, making them unguessable and preventing XSS exploitation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2021-43808 (Blade XSS via predictable parent placeholder). The upstream fix was already present in v7.30.7 when TuxCare onboarded it. The fix implements random per-request salt for parent placeholders, making them unguessable and preventing XSS exploitation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 7.30.7-p4+tuxcare of laravel/framework. The target repository (Laravel framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled. The fix\u2014checking runningInConsole() before using $_SERVER['argv']\u2014was already present in the upstream Laravel v7.30.7 release that TuxCare imported via snapshot on 2026-05-05. The upstream fix was authored by Taylor Otwell on 2024-11-12. The target code at Application.php:560-562 correctly guards $_SERVER['argv'] access, preventing web requests from manipulating the framework's environment detection.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target repository (Laravel framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled. The fix\u2014checking runningInConsole() before using $_SERVER['argv']\u2014was already present in the upstream Laravel v7.30.7 release that TuxCare imported via snapshot on 2026-05-05. The upstream fix was authored by Taylor Otwell on 2024-11-12. The target code at Application.php:560-562 correctly guards $_SERVER['argv'] access, preventing web requests from manipulating the framework's environment detection." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 7.30.7-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-09-29T20:36:58.499788+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 7.30.7-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is NOT affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's exception renderer system which uses Tippy.js tooltips with `allowHTML: true` on user-controlled data. Laravel 7.30.7 predates this feature entirely and uses the Whoops library for debug mode exception handling - a completely different architecture with no Tippy.js tooltips, no `data-tippy-content` att...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is NOT affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's exception renderer system which uses Tippy.js tooltips with `allowHTML: true` on user-controlled data. Laravel 7.30.7 predates this feature entirely and uses the Whoops library for debug mode exception handling - a completely different architecture with no Tippy.js tooltips, no `data-tippy-content` att..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 7.30.7-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource system, which was introduced in version 12.x, five major versions after the target. The vulnerable pattern requires: (1) JsonApi resources processing user-supplied `include` query parameters, (2) passing unsanitized nested relationship names to `loadMissing()`, and (3) potential invocation ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource system, which was introduced in version 12.x, five major versions after the target. The vulnerable pattern requires: (1) JsonApi resources processing user-supplied `include` query parameters, (2) passing unsanitized nested relationship names to `loadMissing()`, and (3) potential invocation ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-11-04T11:50:18.837974+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 7.30.7-p4+tuxcare of laravel/framework, and is fixed in 7.30.7-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 7.30.7-p4+tuxcare of laravel/framework, and is fixed in 7.30.7-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:52:18.183384+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 7.30.7-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework v7.30.7-p6+tuxcare is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is absent because the upstream Laravel v7.30.5 release already included the fix, which adds integer casting to limit() and offset() methods in Builder.php. This version (7.30.7) inherits that upstream fix via the snapshot commit that imported the v7.30.7...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Laravel Framework v7.30.7-p6+tuxcare is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is absent because the upstream Laravel v7.30.5 release already included the fix, which adds integer casting to limit() and offset() methods in Builder.php. This version (7.30.7) inherits that upstream fix via the snapshot commit that imported the v7.30.7..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 7.30.7-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:03:57.153420+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 7.30.7-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 7.30.7-p6+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling PHP object serialization in cookies. Laravel 7.30.7 (released September 2020) already contains this fix. The target was onboarded from the upstream Laravel 7.30.7 release, which shipped wit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 7.30.7-p6+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling PHP object serialization in cookies. Laravel 7.30.7 (released September 2020) already contains this fix. The target was onboarded from the upstream Laravel 7.30.7 release, which shipped wit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 7.30.7-p4+tuxcare of laravel/framework. not_affected \u2014 Target Laravel v7.30.7 already contains the upstream IV length validation fix. The vulnerability (GHSA-7852-w36x-6mf6) allows decryption to return false instead of throwing an exception when processing payloads with manipulated IV length. The fix validates that decoded IV length matches expected cipher IV length (Encrypter.php:214). This was authored by Taylor Otwell on March 30, 2018, and ship...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 Target Laravel v7.30.7 already contains the upstream IV length validation fix. The vulnerability (GHSA-7852-w36x-6mf6) allows decryption to return false instead of throwing an exception when processing payloads with manipulated IV length. The fix validates that decoded IV length matches expected cipher IV length (Encrypter.php:214). This was authored by Taylor Otwell on March 30, 2018, and ship..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 7.30.7-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7-p1+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in the LocalFilesystemAdapter class which provides temporary signed URL generation for local filesystems. This class and the associated local file serving feature were introduced in Laravel 9.x and do not exist in Laravel 7.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7-p1+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in the LocalFilesystemAdapter class which provides temporary signed URL generation for local filesystems. This class and the associated local file serving feature were introduced in Laravel 9.x and do not exist in Laravel 7.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:20:09.538096+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 7.30.7-p4+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 7.30.7 is NOT AFFECTED. All security fixes for GHSA-jwvj-pwww-3mj5 (preventing unexpected query bindings from array-valued parameters) were already present in the upstream Laravel 7.30.7 release before TuxCare created the snapshot. The target contains the `flattenValue()` method and uses it in all affected query builder methods (where, having, whereDate, whereTime, whereDay, wher...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 Target Laravel 7.30.7 is NOT AFFECTED. All security fixes for GHSA-jwvj-pwww-3mj5 (preventing unexpected query bindings from array-valued parameters) were already present in the upstream Laravel 7.30.7 release before TuxCare created the snapshot. The target contains the `flattenValue()` method and uses it in all affected query builder methods (where, having, whereDate, whereTime, whereDay, wher..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:19:00.105438+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 7.30.7-p4+tuxcare of laravel/framework. Laravel framework 7.30.7 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (RCE via cookie session driver + encryption oracle). The vulnerability was fixed in upstream Laravel 7.22.2 (July 27, 2020) by replacing the publicly-computable SHA1 hash cookie prefix with an HMAC requiring the secret encryption key. Laravel 7.30.7 (released October 22, 2020) already contains this fix. The TuxCare snapshot merely imported the already-patched upstream version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel framework 7.30.7 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (RCE via cookie session driver + encryption oracle). The vulnerability was fixed in upstream Laravel 7.22.2 (July 27, 2020) by replacing the publicly-computable SHA1 hash cookie prefix with an HMAC requiring the secret encryption key. Laravel 7.30.7 (released October 22, 2020) already contains this fix. The TuxCare snapshot merely imported the already-patched upstream version." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 7.30.7-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 7.30.7-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:42:21.835037+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 7.30.7-p4+tuxcare of laravel/framework. Laravel framework 7.30.7-p6+tuxcare is NOT affected by GHSA-x7p5-p2c9-phvg (unexpected query binding vulnerability). The fix was already present in the upstream Laravel v7.30.7 release, which was onboarded by TuxCare. All vulnerable query builder methods (where, having, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, havingBetween) correctly use flattenValue() to extract scalar values from arrays and limit bindings appropriately.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "Laravel framework 7.30.7-p6+tuxcare is NOT affected by GHSA-x7p5-p2c9-phvg (unexpected query binding vulnerability). The fix was already present in the upstream Laravel v7.30.7 release, which was onboarded by TuxCare. All vulnerable query builder methods (where, having, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, havingBetween) correctly use flattenValue() to extract scalar values from arrays and limit bindings appropriately." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:41:00.032627+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.2-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.2 (released December 2020) inherited the fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time compa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.2 (released December 2020) inherited the fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time compa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:41:00.032627+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.2-p6+tuxcare of laravel/framework. CVE-2018-15133 describes a PHP deserialization vulnerability in Laravel's cookie decryption, allowing remote code execution via crafted X-XSRF-TOKEN values when the attacker knows the application key. The target version 8.12.2 already contains the upstream fix that disables automatic unserialization of decrypted cookie data. The fix sets static $serialize = false by default and passes this flag through the entire encryption/decryption chain (EncryptCookies::serialized() \u2192 VerifyCsrfToken::decrypt() \u2192 Encrypter::decrypt()), preventing unserialize() from being called on attacker-controlled data. The vulnerability was patched by Laravel in August 2018; version 8.12.2 (released 2020) included the fix when onboarded via snapshot commit 58ccc3bfb7 by contact@bikramlama.com.np, prior to any TuxCare involvement.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 describes a PHP deserialization vulnerability in Laravel's cookie decryption, allowing remote code execution via crafted X-XSRF-TOKEN values when the attacker knows the application key. The target version 8.12.2 already contains the upstream fix that disables automatic unserialization of decrypted cookie data. The fix sets static $serialize = false by default and passes this flag through the entire encryption/decryption chain (EncryptCookies::serialized() \u2192 VerifyCsrfToken::decrypt() \u2192 Encrypter::decrypt()), preventing unserialize() from being called on attacker-controlled data. The vulnerability was patched by Laravel in August 2018; version 8.12.2 (released 2020) included the fix when onboarded via snapshot commit 58ccc3bfb7 by contact@bikramlama.com.np, prior to any TuxCare involvement." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:41:00.032627+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 8.12.2-p6+tuxcare of laravel/framework. Laravel Framework 8.12.2-p5+tuxcare contains the PendingCommand deserialization gadget (__destruct method at line 340-347) that CVE-2019-9081 describes. However, this version is not exploitable in default configuration because: (1) File-based sessions store data server-side in storage/framework/sessions/ which attackers cannot directly modify; (2) Cookie-based sessions use JSON encoding (CookieSessionHandler lines 71, 85), not PHP serialization; (3) Cache data is server-side; (4) No code path exists for attacker-controlled serialized data to reach unserialize() calls in Session\\Store (line 98) or Cache stores (FileStore line 223) without a separate vulnerability. The CVE states the vulnerability exists \"if the content is controllable\" - in default Laravel 8.12.2, serialized content is NOT attacker-controllable. While the gadget chain exists and could be exploited in combination with file upload vulnerabilities, shared hosting scenarios, or custom code that unserializes user input, these require non-default configurations or separate vulnerabilities beyond CVE-2019-9081's scope.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "Laravel Framework 8.12.2-p5+tuxcare contains the PendingCommand deserialization gadget (__destruct method at line 340-347) that CVE-2019-9081 describes. However, this version is not exploitable in default configuration because: (1) File-based sessions store data server-side in storage/framework/sessions/ which attackers cannot directly modify; (2) Cookie-based sessions use JSON encoding (CookieSessionHandler lines 71, 85), not PHP serialization; (3) Cache data is server-side; (4) No code path exists for attacker-controlled serialized data to reach unserialize() calls in Session\\Store (line 98) or Cache stores (FileStore line 223) without a separate vulnerability. The CVE states the vulnerability exists \"if the content is controllable\" - in default Laravel 8.12.2, serialized content is NOT attacker-controllable. While the gadget chain exists and could be exploited in combination with file upload vulnerabilities, shared hosting scenarios, or custom code that unserializes user input, these require non-default configurations or separate vulnerabilities beyond CVE-2019-9081's scope." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:41:00.032627+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.2-p6+tuxcare of laravel/framework. The target laravel/framework version 8.12.2 is not affected by CVE-2020-19316. The vulnerability (OS command injection in the Filesystem::link() method) was fixed upstream by Taylor Otwell in May 2019 (commit 44c3feb6) for Laravel 5.8.17. The fix adds escapeshellarg() to both the $link and $target parameters before passing them to the exec() call. Since the target version 8.12.2 (released in 2020) is significantly newer than 5.8.17, the fix was already present in the upstream release that TuxCare onboarded via snapshot commit 58ccc3bfb7. The vulnerable code pattern does not exist in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target laravel/framework version 8.12.2 is not affected by CVE-2020-19316. The vulnerability (OS command injection in the Filesystem::link() method) was fixed upstream by Taylor Otwell in May 2019 (commit 44c3feb6) for Laravel 5.8.17. The fix adds escapeshellarg() to both the $link and $target parameters before passing them to the exec() call. Since the target version 8.12.2 (released in 2020) is significantly newer than 5.8.17, the fix was already present in the upstream release that TuxCare onboarded via snapshot commit 58ccc3bfb7. The vulnerable code pattern does not exist in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:41:00.032627+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.2-p6+tuxcare of laravel/framework. CVE-2020-24941 is NOT present in Laravel 8.12.2-p5+tuxcare. The vulnerability affects Laravel before 6.18.35 and 7.x before 7.24.0. The fix was committed to Laravel 6.x on August 7, 2020 (commit 897d107775), before Laravel 8.0.0 was released (September 8, 2020). Laravel 8.12.2 shipped with the fix already included. The target repository's snapshot commit (58ccc3bfb7) by contact@bikramlama.com.np brought in Laravel 8.12.2 with the complete fix: the isGuardableColumn() method validates that attribute keys correspond to actual database columns, preventing mass assignment bypass via non-existent column names.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 is NOT present in Laravel 8.12.2-p5+tuxcare. The vulnerability affects Laravel before 6.18.35 and 7.x before 7.24.0. The fix was committed to Laravel 6.x on August 7, 2020 (commit 897d107775), before Laravel 8.0.0 was released (September 8, 2020). Laravel 8.12.2 shipped with the fix already included. The target repository's snapshot commit (58ccc3bfb7) by contact@bikramlama.com.np brought in Laravel 8.12.2 with the complete fix: the isGuardableColumn() method validates that attribute keys correspond to actual database columns, preventing mass assignment bypass via non-existent column names." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:41:00.032627+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.2-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:41:00.032627+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.2-p6+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:41:00.032627+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.2-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:41:00.032627+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.2-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:41:00.032627+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.2-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:41:00.032627+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.2-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer which uses Tippy.js tooltips with allowHTML: true. Laravel 8.12.2 uses a completely different exception rendering system (Whoops/filp/whoops) that does not include Tippy.js or any JavaScript tooltip functionality. The vulnerable component was introduced in Laravel 11.x+, sever...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer which uses Tippy.js tooltips with allowHTML: true. Laravel 8.12.2 uses a completely different exception rendering system (Whoops/filp/whoops) that does not include Tippy.js or any JavaScript tooltip functionality. The vulnerable component was introduced in Laravel 11.x+, sever..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:41:00.032627+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.2-p6+tuxcare of laravel/framework. not_affected \u2014 Target version 8.12.2 predates the introduction of Laravel's JSON:API resource feature by approximately 5 years. The vulnerable code (ResolvesJsonApiElements trait with loadMissing() call) does not exist in this version. JSON:API resources were first introduced in Laravel v12.45.0 (December 2025) via commit 2f309363, while the target is from the 8.x series released around 2020. Exhaustive searc...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Target version 8.12.2 predates the introduction of Laravel's JSON:API resource feature by approximately 5 years. The vulnerable code (ResolvesJsonApiElements trait with loadMissing() call) does not exist in this version. JSON:API resources were first introduced in Laravel v12.45.0 (December 2025) via commit 2f309363, while the target is from the 8.x series released around 2020. Exhaustive searc..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:42:00.096965+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 8.12.2-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:41:00.032627+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.2-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:41:00.032627+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.2-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:41:00.032627+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.2-p6+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 8.12.2 is not affected by GHSA-6jvx-8ch9-j2jr (Laravel 5.6.30 cookie deserialization vulnerability). The fix disabling automatic cookie serialization was already present in the upstream Laravel 8.12.2 release, which predates TuxCare's onboarding of this repository. The vulnerable pattern (unsafe cookie deserialization enabling PHP object injection) is absent: EncryptCookies middl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target Laravel 8.12.2 is not affected by GHSA-6jvx-8ch9-j2jr (Laravel 5.6.30 cookie deserialization vulnerability). The fix disabling automatic cookie serialization was already present in the upstream Laravel 8.12.2 release, which predates TuxCare's onboarding of this repository. The vulnerable pattern (unsafe cookie deserialization enabling PHP object injection) is absent: EncryptCookies middl..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:41:00.032627+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.2-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false when IV length is manipulated) was already fixed in the upstream Laravel 8.12.2 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 contains the required IV length validation that matches the vendor ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false when IV length is manipulated) was already fixed in the upstream Laravel 8.12.2 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 contains the required IV length validation that matches the vendor ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:41:00.032627+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.2-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.2 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in Laravel 12.x's LocalFilesystemAdapter class which provides signed URL functionality for local filesystem storage. This feature does not exist in Laravel 8.12.2, which uses a different architecture where local filesystem adapters cannot generate temporary signed URLs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.2 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in Laravel 12.x's LocalFilesystemAdapter class which provides signed URL functionality for local filesystem storage. This feature does not exist in Laravel 8.12.2, which uses a different architecture where local filesystem adapters cannot generate temporary signed URLs." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:41:00.032627+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.2-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:41:00.032627+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.2-p6+tuxcare of laravel/framework. Laravel framework 8.12.2 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability involved using plain SHA1 hashes for cookie value prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The fix (using HMAC with the encryption key instead of plain SHA1) was released in Laravel 6.18.31 on July 27, 2020. Laravel 8.0.0 was released on September 8, 2020, after the security fix, so all Laravel 8.x versions including 8.12.2 shipped with the fix from their original upstream release. The target contains CookieValuePrefix class using hash_hmac() at line 16, confirming the fixed pattern is present. The vulnerable pattern (plain sha1) is absent from the codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel framework 8.12.2 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability involved using plain SHA1 hashes for cookie value prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The fix (using HMAC with the encryption key instead of plain SHA1) was released in Laravel 6.18.31 on July 27, 2020. Laravel 8.0.0 was released on September 8, 2020, after the security fix, so all Laravel 8.x versions including 8.12.2 shipped with the fix from their original upstream release. The target contains CookieValuePrefix class using hash_hmac() at line 16, confirming the fixed pattern is present. The vulnerable pattern (plain sha1) is absent from the codebase." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:41:00.032627+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.2-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:41:00.032627+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.2-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2022-23614 does not affect version v1.44.8-p2+tuxcare of twig/twig. CVE-2022-23614 affects Twig's `sort` filter when an `arrow` parameter is passed in sandbox mode, allowing arbitrary PHP function execution. However, Twig v1.44.8 does not have the arrow parameter feature in the sort filter. The vulnerable code pattern (accepting an arrow callable parameter) does not exist in this version. The arrow parameter was introduced in v2.12.0 (August 2019), while the target is based on the 1.x branch which never received this feature. The sort filter signature in v1.44.8 is `function twig_sort_filter($array)` with only one parameter, making the vulnerability not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-23614" }, "impact_statement": "CVE-2022-23614 affects Twig's `sort` filter when an `arrow` parameter is passed in sandbox mode, allowing arbitrary PHP function execution. However, Twig v1.44.8 does not have the arrow parameter feature in the sort filter. The vulnerable code pattern (accepting an arrow callable parameter) does not exist in this version. The arrow parameter was introduced in v2.12.0 (August 2019), while the target is based on the 1.x branch which never received this feature. The sort filter signature in v1.44.8 is `function twig_sort_filter($array)` with only one parameter, making the vulnerability not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2022-39261 does not affect version v1.44.8-p2+tuxcare of twig/twig. The target repository (twig/twig v1.44.8-p2+tuxcare) is not affected by CVE-2022-39261. The vulnerability was a path traversal issue in Twig's FilesystemLoader that allowed reading files outside configured template directories when using namespace syntax like '@namespace/../file'. The fix was applied in upstream Twig v1.44.7 (2022-09-28) by Fabien Potencier, and the target is based on v1.44.8 (2024-09-09), which already included this fix. The vulnerable code pattern (validating template name before parsing namespace) is not present; the target code correctly validates the shortname after parsing the namespace prefix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-39261" }, "impact_statement": "The target repository (twig/twig v1.44.8-p2+tuxcare) is not affected by CVE-2022-39261. The vulnerability was a path traversal issue in Twig's FilesystemLoader that allowed reading files outside configured template directories when using namespace syntax like '@namespace/../file'. The fix was applied in upstream Twig v1.44.7 (2022-09-28) by Fabien Potencier, and the target is based on v1.44.8 (2024-09-09), which already included this fix. The vulnerable code pattern (validating template name before parsing namespace) is not present; the target code correctly validates the shortname after parsing the namespace prefix." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2024-45411 affects version v1.44.8-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-45411" }, "action_statement": "Vulnerability CVE-2024-45411 affects version v1.44.8-p2+tuxcare of twig/twig." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51754 is fixed in version v1.44.8-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-51754" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51755 is fixed in version v1.44.8-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-51755" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2026-24425 does not affect version v1.44.8-p2+tuxcare of twig/twig. CVE-2026-24425 affects Twig when using SourcePolicyInterface to enable per-template sandboxing. The target (Twig v1.44.8) does not have SourcePolicyInterface - this feature was introduced in later versions (2.x/3.x). The vulnerability chain cannot form because the required SourcePolicyInterface mechanism is absent from this version. The existing sandboxing mechanisms (global and {% sandbox %} tag) work correctly with the current implementation.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-24425" }, "impact_statement": "CVE-2026-24425 affects Twig when using SourcePolicyInterface to enable per-template sandboxing. The target (Twig v1.44.8) does not have SourcePolicyInterface - this feature was introduced in later versions (2.x/3.x). The vulnerability chain cannot form because the required SourcePolicyInterface mechanism is absent from this version. The existing sandboxing mechanisms (global and {% sandbox %} tag) work correctly with the current implementation." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46628 is fixed in version v1.44.8-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46628" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46633 is fixed in version v1.44.8-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46633" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:19:23.616509+00:00", "status_notes": "Vulnerability CVE-2026-46634 does not affect version v1.44.8-p2+tuxcare of twig/twig. CVE-2026-46634 is NOT applicable to Twig v1.44.8-p2+tuxcare. The vulnerability specifically requires SourcePolicyInterface (introduced in Twig 3.x) for selective name-based sandboxing. Twig 1.44.8 uses state-based sandboxing where all templates share the same SandboxExtension instance from the Environment. Templates created via template_from_string() inherit the sandbox state through this shared instance, preventing the bypass described in the CVE. The attack chain (synthesized template name bypassing name-based policy \u2192 checkSecurity() no-op) does not exist in this architecture.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-46634" }, "impact_statement": "CVE-2026-46634 is NOT applicable to Twig v1.44.8-p2+tuxcare. The vulnerability specifically requires SourcePolicyInterface (introduced in Twig 3.x) for selective name-based sandboxing. Twig 1.44.8 uses state-based sandboxing where all templates share the same SandboxExtension instance from the Environment. Templates created via template_from_string() inherit the sandbox state through this shared instance, preventing the bypass described in the CVE. The attack chain (synthesized template name bypassing name-based policy \u2192 checkSecurity() no-op) does not exist in this architecture." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46635 does not affect version v1.44.8-p2+tuxcare of twig/twig. not_affected \u2014 The `column` filter that is the subject of CVE-2026-46635 does not exist in Twig 1.44.8. This version is part of the Twig 1.x series (CHANGELOG notes v1.44.6 as \"Last version for the 1.x series\"), while the column filter was introduced in Twig 2.x. Without this filter, the vulnerable code path (template calls column filter \u2192 delegates to array_column() \u2192 reads object properties bypassing sandbo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-46635" }, "impact_statement": "not_affected \u2014 The `column` filter that is the subject of CVE-2026-46635 does not exist in Twig 1.44.8. This version is part of the Twig 1.x series (CHANGELOG notes v1.44.6 as \"Last version for the 1.x series\"), while the column filter was introduced in Twig 2.x. Without this filter, the vulnerable code path (template calls column filter \u2192 delegates to array_column() \u2192 reads object properties bypassing sandbo..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46638 is fixed in version v1.44.8-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46638" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:19:23.616509+00:00", "status_notes": "Vulnerability CVE-2026-46640 does not affect version v1.44.8-p2+tuxcare of twig/twig. Twig 1.44.8 is not affected by CVE-2026-46640. The vulnerability requires the `obj.(expr)` dynamic-attribute syntax for macro references, which was introduced in Twig 3.15.0 and does not exist in Twig 1.x. The target explicitly rejects dynamic macro names (ExpressionParser.php:506) and only supports static attribute access after the dot operator. The vulnerable code path involving MacroReferenceExpression and DotExpressionParser does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-46640" }, "impact_statement": "Twig 1.44.8 is not affected by CVE-2026-46640. The vulnerability requires the `obj.(expr)` dynamic-attribute syntax for macro references, which was introduced in Twig 3.15.0 and does not exist in Twig 1.x. The target explicitly rejects dynamic macro names (ExpressionParser.php:506) and only supports static attribute access after the dot operator. The vulnerable code path involving MacroReferenceExpression and DotExpressionParser does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-11-04T11:38:52.435560+00:00", "status_notes": "Vulnerability CVE-2026-47730 affects version v1.44.8-p2+tuxcare of twig/twig, and is fixed in v1.44.8-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-47730" }, "action_statement": "Vulnerability CVE-2026-47730 affects version v1.44.8-p2+tuxcare of twig/twig, and is fixed in v1.44.8-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47732 is fixed in version v1.44.8-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-47732" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48805 does not affect version v1.44.8-p2+tuxcare of twig/twig. not_affected \u2014 Target Twig 1.44.8 is NOT AFFECTED by CVE-2026-48805. This vulnerability is specific to Twig 3.26.0+ architectural changes that introduced per-source sandbox state with boolean parameters. The three vulnerable deprecated wrapper functions mentioned in the CVE (twig_array_some(), twig_array_every(), twig_check_arrow_in_sandbox()) do not exist in Twig 1.44.x. The equivalent functionality in Twig ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48805" }, "impact_statement": "not_affected \u2014 Target Twig 1.44.8 is NOT AFFECTED by CVE-2026-48805. This vulnerability is specific to Twig 3.26.0+ architectural changes that introduced per-source sandbox state with boolean parameters. The three vulnerable deprecated wrapper functions mentioned in the CVE (twig_array_some(), twig_array_every(), twig_check_arrow_in_sandbox()) do not exist in Twig 1.44.x. The equivalent functionality in Twig ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48806 is fixed in version v1.44.8-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48806" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48807 is fixed in version v1.44.8-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48807" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48808 does not affect version v1.44.8-p2+tuxcare of twig/twig. not_affected \u2014 Twig v1.44.8 is not affected by CVE-2026-48808. The vulnerability concerns a sandbox bypass in the `column` filter when sandboxing is enabled via `SourcePolicyInterface`. However, v1.44.8 lacks both the column filter feature (introduced in later Twig versions 2.x/3.x) and the SourcePolicyInterface mechanism. Exhaustive searches across the codebase confirmed no column filter registration in Core...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48808" }, "impact_statement": "not_affected \u2014 Twig v1.44.8 is not affected by CVE-2026-48808. The vulnerability concerns a sandbox bypass in the `column` filter when sandboxing is enabled via `SourcePolicyInterface`. However, v1.44.8 lacks both the column filter feature (introduced in later Twig versions 2.x/3.x) and the SourcePolicyInterface mechanism. Exhaustive searches across the codebase confirmed no column filter registration in Core..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v1.44.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49981 is fixed in version v1.44.8-p2+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-49981" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.1-p3+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 does not affect Laravel 8.12.1-p5+tuxcare. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017), and the fix was already present in the upstream Laravel 8.12.1 release (December 2020) that TuxCare onboarded. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison, preventing...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 does not affect Laravel 8.12.1-p5+tuxcare. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017), and the fix was already present in the upstream Laravel 8.12.1 release (December 2020) that TuxCare onboarded. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison, preventing..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.1-p3+tuxcare of laravel/framework. The target Laravel v8.12.1 is NOT affected by CVE-2018-15133. The vulnerability (uncontrolled deserialization of encrypted cookie data) has been mitigated by the upstream Laravel framework prior to v8.12.1. The target code passes `false` to `decrypt()` for all cookie operations, preventing automatic unserialization and blocking PHP object injection attacks. This fix was authored by Taylor Otwell in August 2018 and was included in the upstream v8.12.1 release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "The target Laravel v8.12.1 is NOT affected by CVE-2018-15133. The vulnerability (uncontrolled deserialization of encrypted cookie data) has been mitigated by the upstream Laravel framework prior to v8.12.1. The target code passes `false` to `decrypt()` for all cookie operations, preventing automatic unserialization and blocking PHP object injection attacks. This fix was authored by Taylor Otwell in August 2018 and was included in the upstream v8.12.1 release that TuxCare onboarded." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.1-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.1-p3+tuxcare of laravel/framework. The target Laravel Framework 8.12.1 is NOT AFFECTED by CVE-2020-19316. The vulnerable code pattern (unescaped shell parameters in the link() method's mklink exec call) is not present. The target has the proper fix with escapeshellarg() sanitization on both $link and $target parameters (line 320 of Filesystem.php). This fix was authored by upstream Laravel maintainer Taylor Otwell in May 2019 (commit 44c3feb604944599ad1c782a9942981c3991fa31) and was already present in the upstream Laravel 8.12.1 release when TuxCare onboarded it via snapshot commit 4993dfe2ac. CVE affected versions \"before 5.8.17\"; target is 8.12.1, which naturally includes the fix from the 5.8.17 era.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target Laravel Framework 8.12.1 is NOT AFFECTED by CVE-2020-19316. The vulnerable code pattern (unescaped shell parameters in the link() method's mklink exec call) is not present. The target has the proper fix with escapeshellarg() sanitization on both $link and $target parameters (line 320 of Filesystem.php). This fix was authored by upstream Laravel maintainer Taylor Otwell in May 2019 (commit 44c3feb604944599ad1c782a9942981c3991fa31) and was already present in the upstream Laravel 8.12.1 release when TuxCare onboarded it via snapshot commit 4993dfe2ac. CVE affected versions \"before 5.8.17\"; target is 8.12.1, which naturally includes the fix from the 5.8.17 era." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:41:10.796701+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.1-p3+tuxcare of laravel/framework. Laravel 8.12.1 was released after CVE-2020-24941 was fixed upstream. The vulnerability affected Laravel <6.18.35 and 7.x <7.24.0. The fix (commit 897d107) was applied on August 7, 2020, before Laravel 8.0's September 2020 release. Version 8.12.1 shipped with the fix already present: the isGuardableColumn() method validates attribute keys against actual database columns, preventing the JSON column nesting bypass. The vulnerable pattern (stripping '->' before guard checks) is not present. This is an upstream fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "Laravel 8.12.1 was released after CVE-2020-24941 was fixed upstream. The vulnerability affected Laravel <6.18.35 and 7.x <7.24.0. The fix (commit 897d107) was applied on August 7, 2020, before Laravel 8.0's September 2020 release. Version 8.12.1 shipped with the fix already present: the isGuardableColumn() method validates attribute keys against actual database columns, preventing the JSON column nesting bypass. The vulnerable pattern (stripping '->' before guard checks) is not present. This is an upstream fix, not a TuxCare backport." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.1-p3+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.1-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer that uses Tippy.js tooltips with allowHTML enabled. Laravel 8.x uses a completely different exception rendering system (Whoops library from filp/whoops) and does not contain the vulnerable code. The Tippy.js-based exception renderer infrastructure does not exist in this versio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer that uses Tippy.js tooltips with allowHTML enabled. Laravel 8.x uses a completely different exception rendering system (Whoops library from filp/whoops) and does not contain the vulnerable code. The Tippy.js-based exception renderer infrastructure does not exist in this versio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.1-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 11/12. Version 8.12.1 predates this feature entirely - it only has basic JsonResource with no include parameter processing or relationship compilation logic. The entire vulnerable code path is absent f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 11/12. Version 8.12.1 predates this feature entirely - it only has basic JsonResource with no include parameter processing or relationship compilation logic. The entire vulnerable code path is absent f..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:38:00.180821+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.1-p3+tuxcare of laravel/framework, and is fixed in 8.12.1-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.1-p3+tuxcare of laravel/framework, and is fixed in 8.12.1-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:53:45.635911+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.1-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via unsafe cookie deserialization). The vulnerability affected Laravel 5.6.x prior to 5.6.30 and was fixed in August 2018 by disabling cookie serialization. Laravel 8.12.1 (released December 2020) already contains the fix in its upstream release: `protected static $serialize = false` in EncryptCookies.php globally disab...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via unsafe cookie deserialization). The vulnerability affected Laravel 5.6.x prior to 5.6.30 and was fixed in August 2018 by disabling cookie serialization. Laravel 8.12.1 (released December 2020) already contains the fix in its upstream release: `protected static $serialize = false` in EncryptCookies.php globally disab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.1-p3+tuxcare of laravel/framework. not_affected \u2014 The Laravel Encrypter IV length validation vulnerability (GHSA-7852-w36x-6mf6) is NOT present in this target. The fix was included in upstream Laravel 8.12.1 (released December 2020) and imported via snapshot commit 4993dfe2ac. The validPayload method at lines 211-215 of src/Illuminate/Encryption/Encrypter.php contains the exact IV length validation (line 214: strlen(base64_decode($payload['iv'...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The Laravel Encrypter IV length validation vulnerability (GHSA-7852-w36x-6mf6) is NOT present in this target. The fix was included in upstream Laravel 8.12.1 (released December 2020) and imported via snapshot commit 4993dfe2ac. The validPayload method at lines 211-215 of src/Illuminate/Encryption/Encrypter.php contains the exact IV length validation (line 214: strlen(base64_decode($payload['iv'..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.1-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns ambiguous URL parsing in local filesystem temporary signed URLs, but Laravel 8.x does not have the local filesystem signed URL feature. The temporaryUrl() method throws RuntimeException for local storage adapters. This feature was introduced in Laravel 11+/12.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns ambiguous URL parsing in local filesystem temporary signed URLs, but Laravel 8.x does not have the local filesystem signed URL feature. The temporaryUrl() method throws RuntimeException for local storage adapters. This feature was introduced in Laravel 11+/12.x." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:14:30.754022+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.1-p3+tuxcare of laravel/framework. Target version 8.12.1-p5+tuxcare is NOT AFFECTED. The encryption oracle vulnerability (GHSA-qm5c-m76r-2hfr) was fixed in upstream Laravel framework on July 27, 2020, when Taylor Otwell replaced the unkeyed sha1() cookie prefix with a keyed HMAC via the CookieValuePrefix class. Laravel 8.12.1 was released November 5, 2020, four months AFTER the fix, so the vulnerable pattern is not present in the onboarded upstream release. The target uses CookieValuePrefix::create() with hash_hmac('sha1', $cookieName.'v2', $key), making cookie prefixes unforgeable without the encryption key.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Target version 8.12.1-p5+tuxcare is NOT AFFECTED. The encryption oracle vulnerability (GHSA-qm5c-m76r-2hfr) was fixed in upstream Laravel framework on July 27, 2020, when Taylor Otwell replaced the unkeyed sha1() cookie prefix with a keyed HMAC via the CookieValuePrefix class. Laravel 8.12.1 was released November 5, 2020, four months AFTER the fix, so the vulnerable pattern is not present in the onboarded upstream release. The target uses CookieValuePrefix::create() with hash_hmac('sha1', $cookieName.'v2', $key), making cookie prefixes unforgeable without the encryption key." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 6.20.45-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 6.20.45-p1+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:45:39.779746+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 6.20.45-p1+tuxcare of laravel/framework. CVE-2018-15133 is NOT present in Laravel 6.20.45-p6+tuxcare. The vulnerability (RCE via unserialize on X-XSRF-TOKEN) was fixed in upstream Laravel 5.6.30/5.5.41 (August 2018) by disabling cookie serialization. The fix (protected static $serialize = false; using static::serialized() in decrypt calls) was already present when Laravel 6.20.45 was released and onboarded by TuxCare. The vulnerable code pattern does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 is NOT present in Laravel 6.20.45-p6+tuxcare. The vulnerability (RCE via unserialize on X-XSRF-TOKEN) was fixed in upstream Laravel 5.6.30/5.5.41 (August 2018) by disabling cookie serialization. The fix (protected static $serialize = false; using static::serialized() in decrypt calls) was already present when Laravel 6.20.45 was released and onboarded by TuxCare. The vulnerable code pattern does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 6.20.45-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 6.20.45-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 6.20.45-p1+tuxcare of laravel/framework. The target Laravel Framework 6.20.45 is NOT vulnerable to CVE-2020-19316. The vulnerable code pattern (unescaped parameters in Windows mklink exec call) is not present. The fix using escapeshellarg() was already included in the upstream Laravel v6.20.45 release that TuxCare onboarded. The vulnerability affected Laravel before 5.8.17 (patched May 2019), and version 6.20.45 already contains the upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target Laravel Framework 6.20.45 is NOT vulnerable to CVE-2020-19316. The vulnerable code pattern (unescaped parameters in Windows mklink exec call) is not present. The fix using escapeshellarg() was already included in the upstream Laravel v6.20.45 release that TuxCare onboarded. The vulnerability affected Laravel before 5.8.17 (patched May 2019), and version 6.20.45 already contains the upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:42:21.835037+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 6.20.45-p1+tuxcare of laravel/framework. The target Laravel framework version 6.20.45-p6+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability (mass assignment bypass via non-existent column names) was fixed in upstream Laravel v6.18.35 (commit 897d107775 by Taylor Otwell). The target version 6.20.45 already contains this fix, which validates that attribute keys exist as actual database columns via the isGuardableColumn() method. The fix was shipped in the upstream release and onboarded to TuxCare via snapshot commit abbc62d18a. The vulnerable pattern (allowing mass assignment to arbitrary non-column attributes) is not present in the target code.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel framework version 6.20.45-p6+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability (mass assignment bypass via non-existent column names) was fixed in upstream Laravel v6.18.35 (commit 897d107775 by Taylor Otwell). The target version 6.20.45 already contains this fix, which validates that attribute keys exist as actual database columns via the isGuardableColumn() method. The fix was shipped in the upstream release and onboarded to TuxCare via snapshot commit abbc62d18a. The vulnerable pattern (allowing mass assignment to arbitrary non-column attributes) is not present in the target code." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 6.20.45-p1+tuxcare of laravel/framework. CVE-2021-21263 affects Laravel versions <6.20.12. The target is version 6.20.45, which includes the upstream fix that prevents query binding exploitation. The vulnerability allowed array values to be passed to query builder methods where scalar values were expected, causing incorrect binding counts and corrupted query results. The target contains comprehensive protections using a `flattenValue()` helper method across all affected methods (where, having, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, whereBetween). The fix was present in the upstream v6.20.45 release and was imported via TuxCare's snapshot commit abbc62d18a, with no subsequent modifications to the query builder.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "CVE-2021-21263 affects Laravel versions <6.20.12. The target is version 6.20.45, which includes the upstream fix that prevents query binding exploitation. The vulnerability allowed array values to be passed to query builder methods where scalar values were expected, causing incorrect binding counts and corrupted query results. The target contains comprehensive protections using a `flattenValue()` helper method across all affected methods (where, having, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, whereBetween). The fix was present in the upstream v6.20.45 release and was imported via TuxCare's snapshot commit abbc62d18a, with no subsequent modifications to the query builder." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 6.20.45-p1+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:30:41.069534+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 6.20.45-p1+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 6.20.45-p1+tuxcare of laravel/framework. The target repository (Laravel framework 6.20.45-p6+tuxcare) is not affected by CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled, allowing attackers to control environment detection through $_SERVER['argv']. The fix adds a runningInConsole() check before using argv values. This fix was already present in the upstream Laravel v6.20.45 release (authored by Taylor Otwell, taylor@laravel.com, Nov 2024) before TuxCare created their snapshot. The TuxCare branch started from a snapshot of v6.20.45 (commit abbc62d18a) which already contained the fixed code. No TuxCare backport was necessary as the vulnerable code pattern never existed in this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target repository (Laravel framework 6.20.45-p6+tuxcare) is not affected by CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled, allowing attackers to control environment detection through $_SERVER['argv']. The fix adds a runningInConsole() check before using argv values. This fix was already present in the upstream Laravel v6.20.45 release (authored by Taylor Otwell, taylor@laravel.com, Nov 2024) before TuxCare created their snapshot. The TuxCare branch started from a snapshot of v6.20.45 (commit abbc62d18a) which already contained the fixed code. No TuxCare backport was necessary as the vulnerable code pattern never existed in this branch." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 6.20.45-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:36:58.499788+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 6.20.45-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 6.20.45-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-11-04T11:46:15.891205+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 6.20.45-p1+tuxcare of laravel/framework, and is fixed in 6.20.45-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 6.20.45-p1+tuxcare of laravel/framework, and is fixed in 6.20.45-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:50:01.681995+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 6.20.45-p1+tuxcare of laravel/framework. not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 6.20.45-p1+tuxcare of laravel/framework, and is fixed in 6.20.45-p2+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 6.20.45-p1+tuxcare of laravel/framework, and is fixed in 6.20.45-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:05:58.501817+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 6.20.45-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 6.20.45-p1+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 6.20.45-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 6.20.45-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:19:00.105438+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 6.20.45-p1+tuxcare of laravel/framework. Laravel Framework 6.20.45 is not affected by GHSA-qm5c-m76r-2hfr (encryption oracle RCE via cookie session driver). The vulnerability was fixed by upstream Laravel in version 6.18.31 on July 27, 2020, by replacing predictable SHA1 hash prefixes with keyed HMAC values in cookie encryption. Version 6.20.45 was released after this fix and already includes the CookieValuePrefix class with hash_hmac() implementation. The target contains the secure code pattern, not the vulnerable one.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel Framework 6.20.45 is not affected by GHSA-qm5c-m76r-2hfr (encryption oracle RCE via cookie session driver). The vulnerability was fixed by upstream Laravel in version 6.18.31 on July 27, 2020, by replacing predictable SHA1 hash prefixes with keyed HMAC values in cookie encryption. Version 6.20.45 was released after this fix and already includes the CookieValuePrefix class with hash_hmac() implementation. The target contains the secure code pattern, not the vulnerable one." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 6.20.45-p1+tuxcare of laravel/framework. not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:42:21.835037+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 6.20.45-p1+tuxcare of laravel/framework. The target repository (Laravel 6.20.45) is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involving unexpected query bindings from array values has already been fixed in the upstream Laravel release v6.20.11 (Jan 13, 2021) and v6.20.14 (Jan 21, 2021), which were released well before v6.20.45. All query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the `flattenValue()` helper method to extract scalar values from array inputs, preventing the SQL binding mismatch vulnerability. The fix was authored by Taylor Otwell for the upstream Laravel framework and was included in the v6.20.45 release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "The target repository (Laravel 6.20.45) is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involving unexpected query bindings from array values has already been fixed in the upstream Laravel release v6.20.11 (Jan 13, 2021) and v6.20.14 (Jan 21, 2021), which were released well before v6.20.45. All query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the `flattenValue()` helper method to extract scalar values from array inputs, preventing the SQL binding mismatch vulnerability. The fix was authored by Taylor Otwell for the upstream Laravel framework and was included in the v6.20.45 release that TuxCare onboarded." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:49:56.996971+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 7.30.7-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:49:56.996971+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 7.30.7-p7+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 7.30.7-p6+tuxcare is not affected by CVE-2017-14775. Both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() comparison for remember_me tokens, preventing timing attacks. This fix was already present in the upstream Laravel 7.30.7 release (originally fixed in Laravel 5.5.10 by commit 576cba749f), which TuxCare imported via snapshot commit 5082773b92.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel 7.30.7-p6+tuxcare is not affected by CVE-2017-14775. Both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() comparison for remember_me tokens, preventing timing attacks. This fix was already present in the upstream Laravel 7.30.7 release (originally fixed in Laravel 5.5.10 by commit 576cba749f), which TuxCare imported via snapshot commit 5082773b92." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:49:56.996971+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 7.30.7-p7+tuxcare of laravel/framework. CVE-2018-15133 is NOT present in laravel/framework v7.30.7. The vulnerability affected versions through 5.5.40 and 5.6.x through 5.6.29. The target version (7.30.7, released in 2020) includes upstream fixes from August 2018 that disable PHP serialization for all encrypted cookies, preventing unsafe unserialize() calls on attacker-controlled cookie data. The fix was shipped in the upstream Laravel release, not applied by TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 is NOT present in laravel/framework v7.30.7. The vulnerability affected versions through 5.5.40 and 5.6.x through 5.6.29. The target version (7.30.7, released in 2020) includes upstream fixes from August 2018 that disable PHP serialization for all encrypted cookies, preventing unsafe unserialize() calls on attacker-controlled cookie data. The fix was shipped in the upstream Laravel release, not applied by TuxCare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:49:56.996971+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 7.30.7-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 7.30.7-p7+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:49:56.996971+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 7.30.7-p7+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before version 5.8.17. The target version 7.30.7-p6+tuxcare already contains the upstream fix. The vulnerability was an OS command injection in the `link()` function in Filesystem.php, where user-controlled `$link` and `$target` parameters were passed to `exec(\"mklink ...\")` without proper escaping. The fix, applied by Laravel upstream in May 2019 (commit 44c3feb6), wraps both parameters with `escapeshellarg()` to prevent shell metacharacter injection. This fix was already present in Laravel 7.30.7 when TuxCare onboarded it in the snapshot commit 5082773b92.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before version 5.8.17. The target version 7.30.7-p6+tuxcare already contains the upstream fix. The vulnerability was an OS command injection in the `link()` function in Filesystem.php, where user-controlled `$link` and `$target` parameters were passed to `exec(\"mklink ...\")` without proper escaping. The fix, applied by Laravel upstream in May 2019 (commit 44c3feb6), wraps both parameters with `escapeshellarg()` to prevent shell metacharacter injection. This fix was already present in Laravel 7.30.7 when TuxCare onboarded it in the snapshot commit 5082773b92." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:49:56.996971+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 7.30.7-p7+tuxcare of laravel/framework. The target repository (laravel/framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2020-24941. The vulnerability affected Laravel versions before 6.18.35 and 7.x before 7.24.0. The target version 7.30.7 is greater than 7.24.0, and the fix was already present in the upstream v7.30.7 release that was onboarded into the TuxCare branch via snapshot commit 5082773b92. The fix adds validation to ensure mass-assigned attributes are actual database columns, preventing attackers from bypassing the $guarded property protection using fake column names with JSON-like syntax. The vulnerable code pattern (missing isGuardableColumn validation) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target repository (laravel/framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2020-24941. The vulnerability affected Laravel versions before 6.18.35 and 7.x before 7.24.0. The target version 7.30.7 is greater than 7.24.0, and the fix was already present in the upstream v7.30.7 release that was onboarded into the TuxCare branch via snapshot commit 5082773b92. The fix adds validation to ensure mass-assigned attributes are actual database columns, preventing attackers from bypassing the $guarded property protection using fake column names with JSON-like syntax. The vulnerable code pattern (missing isGuardableColumn validation) is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:49:56.996971+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 7.30.7-p7+tuxcare of laravel/framework. CVE-2021-21263 affects Laravel versions <6.20.12, <7.30.3, and <8.22.1. The target is Laravel v7.30.7-p6+tuxcare, which is >7.30.3. The upstream Laravel v7.30.7 release already included the fix via the flattenValue() method and array_slice() limiting, which was snapshotted into the TuxCare branch. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) now properly limit array inputs to prevent query binding exploitation. The vulnerable pattern is not present in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "CVE-2021-21263 affects Laravel versions <6.20.12, <7.30.3, and <8.22.1. The target is Laravel v7.30.7-p6+tuxcare, which is >7.30.3. The upstream Laravel v7.30.7 release already included the fix via the flattenValue() method and array_slice() limiting, which was snapshotted into the TuxCare branch. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) now properly limit array inputs to prevent query binding exploitation. The vulnerable pattern is not present in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:49:56.996971+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 7.30.7-p7+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:49:56.996971+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 7.30.7-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2021-43808 (Blade XSS via predictable parent placeholder). The upstream fix was already present in v7.30.7 when TuxCare onboarded it. The fix implements random per-request salt for parent placeholders, making them unguessable and preventing XSS exploitation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2021-43808 (Blade XSS via predictable parent placeholder). The upstream fix was already present in v7.30.7 when TuxCare onboarded it. The fix implements random per-request salt for parent placeholders, making them unguessable and preventing XSS exploitation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:49:56.996971+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 7.30.7-p7+tuxcare of laravel/framework. The target repository (Laravel framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled. The fix\u2014checking runningInConsole() before using $_SERVER['argv']\u2014was already present in the upstream Laravel v7.30.7 release that TuxCare imported via snapshot on 2026-05-05. The upstream fix was authored by Taylor Otwell on 2024-11-12. The target code at Application.php:560-562 correctly guards $_SERVER['argv'] access, preventing web requests from manipulating the framework's environment detection.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target repository (Laravel framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled. The fix\u2014checking runningInConsole() before using $_SERVER['argv']\u2014was already present in the upstream Laravel v7.30.7 release that TuxCare imported via snapshot on 2026-05-05. The upstream fix was authored by Taylor Otwell on 2024-11-12. The target code at Application.php:560-562 correctly guards $_SERVER['argv'] access, preventing web requests from manipulating the framework's environment detection." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:49:56.996971+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 7.30.7-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:49:56.996971+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 7.30.7-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is NOT affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's exception renderer system which uses Tippy.js tooltips with `allowHTML: true` on user-controlled data. Laravel 7.30.7 predates this feature entirely and uses the Whoops library for debug mode exception handling - a completely different architecture with no Tippy.js tooltips, no `data-tippy-content` att...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is NOT affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's exception renderer system which uses Tippy.js tooltips with `allowHTML: true` on user-controlled data. Laravel 7.30.7 predates this feature entirely and uses the Whoops library for debug mode exception handling - a completely different architecture with no Tippy.js tooltips, no `data-tippy-content` att..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:49:56.996971+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 7.30.7-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource system, which was introduced in version 12.x, five major versions after the target. The vulnerable pattern requires: (1) JsonApi resources processing user-supplied `include` query parameters, (2) passing unsanitized nested relationship names to `loadMissing()`, and (3) potential invocation ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource system, which was introduced in version 12.x, five major versions after the target. The vulnerable pattern requires: (1) JsonApi resources processing user-supplied `include` query parameters, (2) passing unsanitized nested relationship names to `loadMissing()`, and (3) potential invocation ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:50:18.837974+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 7.30.7-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:49:56.996971+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 7.30.7-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework v7.30.7-p6+tuxcare is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is absent because the upstream Laravel v7.30.5 release already included the fix, which adds integer casting to limit() and offset() methods in Builder.php. This version (7.30.7) inherits that upstream fix via the snapshot commit that imported the v7.30.7...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Laravel Framework v7.30.7-p6+tuxcare is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is absent because the upstream Laravel v7.30.5 release already included the fix, which adds integer casting to limit() and offset() methods in Builder.php. This version (7.30.7) inherits that upstream fix via the snapshot commit that imported the v7.30.7..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:49:56.996971+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 7.30.7-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:49:56.996971+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 7.30.7-p7+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 7.30.7-p6+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling PHP object serialization in cookies. Laravel 7.30.7 (released September 2020) already contains this fix. The target was onboarded from the upstream Laravel 7.30.7 release, which shipped wit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 7.30.7-p6+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling PHP object serialization in cookies. Laravel 7.30.7 (released September 2020) already contains this fix. The target was onboarded from the upstream Laravel 7.30.7 release, which shipped wit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:49:56.996971+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 7.30.7-p7+tuxcare of laravel/framework. not_affected \u2014 Target Laravel v7.30.7 already contains the upstream IV length validation fix. The vulnerability (GHSA-7852-w36x-6mf6) allows decryption to return false instead of throwing an exception when processing payloads with manipulated IV length. The fix validates that decoded IV length matches expected cipher IV length (Encrypter.php:214). This was authored by Taylor Otwell on March 30, 2018, and ship...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 Target Laravel v7.30.7 already contains the upstream IV length validation fix. The vulnerability (GHSA-7852-w36x-6mf6) allows decryption to return false instead of throwing an exception when processing payloads with manipulated IV length. The fix validates that decoded IV length matches expected cipher IV length (Encrypter.php:214). This was authored by Taylor Otwell on March 30, 2018, and ship..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:49:56.996971+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 7.30.7-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7-p1+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in the LocalFilesystemAdapter class which provides temporary signed URL generation for local filesystems. This class and the associated local file serving feature were introduced in Laravel 9.x and do not exist in Laravel 7.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7-p1+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in the LocalFilesystemAdapter class which provides temporary signed URL generation for local filesystems. This class and the associated local file serving feature were introduced in Laravel 9.x and do not exist in Laravel 7.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:49:56.996971+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 7.30.7-p7+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 7.30.7 is NOT AFFECTED. All security fixes for GHSA-jwvj-pwww-3mj5 (preventing unexpected query bindings from array-valued parameters) were already present in the upstream Laravel 7.30.7 release before TuxCare created the snapshot. The target contains the `flattenValue()` method and uses it in all affected query builder methods (where, having, whereDate, whereTime, whereDay, wher...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 Target Laravel 7.30.7 is NOT AFFECTED. All security fixes for GHSA-jwvj-pwww-3mj5 (preventing unexpected query bindings from array-valued parameters) were already present in the upstream Laravel 7.30.7 release before TuxCare created the snapshot. The target contains the `flattenValue()` method and uses it in all affected query builder methods (where, having, whereDate, whereTime, whereDay, wher..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:49:56.996971+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 7.30.7-p7+tuxcare of laravel/framework. Laravel framework 7.30.7 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (RCE via cookie session driver + encryption oracle). The vulnerability was fixed in upstream Laravel 7.22.2 (July 27, 2020) by replacing the publicly-computable SHA1 hash cookie prefix with an HMAC requiring the secret encryption key. Laravel 7.30.7 (released October 22, 2020) already contains this fix. The TuxCare snapshot merely imported the already-patched upstream version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel framework 7.30.7 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (RCE via cookie session driver + encryption oracle). The vulnerability was fixed in upstream Laravel 7.22.2 (July 27, 2020) by replacing the publicly-computable SHA1 hash cookie prefix with an HMAC requiring the secret encryption key. Laravel 7.30.7 (released October 22, 2020) already contains this fix. The TuxCare snapshot merely imported the already-patched upstream version." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:49:56.996971+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 7.30.7-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 7.30.7-p7+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:49:56.996971+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 7.30.7-p7+tuxcare of laravel/framework. Laravel framework 7.30.7-p6+tuxcare is NOT affected by GHSA-x7p5-p2c9-phvg (unexpected query binding vulnerability). The fix was already present in the upstream Laravel v7.30.7 release, which was onboarded by TuxCare. All vulnerable query builder methods (where, having, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, havingBetween) correctly use flattenValue() to extract scalar values from arrays and limit bindings appropriately.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "Laravel framework 7.30.7-p6+tuxcare is NOT affected by GHSA-x7p5-p2c9-phvg (unexpected query binding vulnerability). The fix was already present in the upstream Laravel v7.30.7 release, which was onboarded by TuxCare. All vulnerable query builder methods (where, having, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, havingBetween) correctly use flattenValue() to extract scalar values from arrays and limit bindings appropriately." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.0-p4+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 8.12.0 is NOT AFFECTED by CVE-2017-14775. The vulnerability (timing attack on remember_me token verification via database string comparison) is not present. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison. The fix was shipped in upstream Laravel 5.5.10 (September 2017) and is present in Laravel 8.12.0, which TuxCare onboarde...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Target Laravel 8.12.0 is NOT AFFECTED by CVE-2017-14775. The vulnerability (timing attack on remember_me token verification via database string comparison) is not present. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison. The fix was shipped in upstream Laravel 5.5.10 (September 2017) and is present in Laravel 8.12.0, which TuxCare onboarde..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.0-p4+tuxcare of laravel/framework. Laravel Framework v8.12.0 is not affected by CVE-2018-15133. The vulnerability involved unserialize being called on untrusted X-XSRF-TOKEN cookie values, enabling remote code execution. The upstream fix (disabling serialization for cookie encryption/decryption) was already present in Laravel v8.12.0 when TuxCare onboarded this version. The fix was originally applied by Taylor Otwell in August 2018 (commits c0eb9073, 7c90d413, 97467e3c, 240d9046), well before the v8.x release line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "Laravel Framework v8.12.0 is not affected by CVE-2018-15133. The vulnerability involved unserialize being called on untrusted X-XSRF-TOKEN cookie values, enabling remote code execution. The upstream fix (disabling serialization for cookie encryption/decryption) was already present in Laravel v8.12.0 when TuxCare onboarded this version. The fix was originally applied by Taylor Otwell in August 2018 (commits c0eb9073, 7c90d413, 97467e3c, 240d9046), well before the v8.x release line." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.0-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.0-p4+tuxcare of laravel/framework. CVE-2020-19316 command injection vulnerability is NOT present in Laravel Framework 8.12.0-p7+tuxcare. The vulnerable pattern (unescaped shell parameters in exec() call) does not exist. The fix (escapeshellarg() wrapping) was already present in upstream Laravel v8.12.0 when TuxCare onboarded it. File src/Illuminate/Filesystem/Filesystem.php line 320 correctly applies escapeshellarg() to both $link and $target parameters before passing them to exec(). Original upstream fix by Taylor Otwell (May 2019, commit 44c3feb604) shipped in Laravel 8.12.0 release (~Nov 2020), 18 months before TuxCare onboarding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 command injection vulnerability is NOT present in Laravel Framework 8.12.0-p7+tuxcare. The vulnerable pattern (unescaped shell parameters in exec() call) does not exist. The fix (escapeshellarg() wrapping) was already present in upstream Laravel v8.12.0 when TuxCare onboarded it. File src/Illuminate/Filesystem/Filesystem.php line 320 correctly applies escapeshellarg() to both $link and $target parameters before passing them to exec(). Original upstream fix by Taylor Otwell (May 2019, commit 44c3feb604) shipped in Laravel 8.12.0 release (~Nov 2020), 18 months before TuxCare onboarding." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:40:50.094173+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.0-p4+tuxcare of laravel/framework. The target Laravel 8.12.0-p7+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability fix was already present in the upstream Laravel 8.12.0 release. The affected code (GuardsAttributes.php) contains the complete patched version with isGuardableColumn() validation that blocks mass assignment to non-existent columns. The TuxCare snapshot commit (9014f5a2) simply onboarded the already-fixed upstream release; no backport was needed. CVE affected versions before 6.18.35 and 7.x before 7.24.0; Laravel 8.12.0 is post-fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel 8.12.0-p7+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability fix was already present in the upstream Laravel 8.12.0 release. The affected code (GuardsAttributes.php) contains the complete patched version with isGuardableColumn() validation that blocks mass assignment to non-existent columns. The TuxCare snapshot commit (9014f5a2) simply onboarded the already-fixed upstream release; no backport was needed. CVE affected versions before 6.18.35 and 7.x before 7.24.0; Laravel 8.12.0 is post-fix." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.0-p4+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.0-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.0-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resource feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, Dec 2025), approximately 5 years after version 8.12.0 (Dec 2020). The target version lacks the entire JSON:API resource system, including the vulnerabl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resource feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, Dec 2025), approximately 5 years after version 8.12.0 (Dec 2020). The target version lacks the entire JSON:API resource system, including the vulnerabl..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-11-04T11:40:03.913990+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.0-p4+tuxcare of laravel/framework, and is fixed in 8.12.0-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.0-p4+tuxcare of laravel/framework, and is fixed in 8.12.0-p8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:52:55.704640+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.0-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization via cookies). The upstream Laravel 8.12.0 release already contained the fix with `protected static $serialize = false`, which disables cookie serialization globally. This defense was present in the snapshot commit 9014f5a213 that imported upstream Laravel 8.12.0 into the TuxCare repository, preventing the exploita...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization via cookies). The upstream Laravel 8.12.0 release already contained the fix with `protected static $serialize = false`, which disables cookie serialization globally. This defense was present in the snapshot commit 9014f5a213 that imported upstream Laravel 8.12.0 into the TuxCare repository, preventing the exploita..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.0-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework v8.12.0 is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false instead of throwing exception when IV length is invalid) is not present because the IV length validation fix was already included in the upstream Laravel v8.12.0 release. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the defensive che...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel Framework v8.12.0 is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false instead of throwing exception when IV length is invalid) is not present because the IV length validation fix was already included in the upstream Laravel v8.12.0 release. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the defensive che..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.0-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:13:26.008802+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.0-p4+tuxcare of laravel/framework. The target Laravel framework 8.12.0-p7+tuxcare is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (encryption oracle vulnerability). The vulnerable pattern (keyless SHA1 cookie prefix) is not present because the fix was already included in the upstream Laravel 8.12.0 release. The target uses HMAC-based cookie prefixes that incorporate the encryption key, preventing attackers from crafting valid prefixes via encryption oracles.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework 8.12.0-p7+tuxcare is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (encryption oracle vulnerability). The vulnerable pattern (keyless SHA1 cookie prefix) is not present because the fix was already included in the upstream Laravel 8.12.0 release. The target uses HMAC-based cookie prefixes that incorporate the encryption key, preventing attackers from crafting valid prefixes via encryption oracles." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:48:29.435115+00:00", "status_notes": "Vulnerability CVE-2015-7809 does not affect version v2.16.1-p3+tuxcare of twig/twig. already_fixed \u2014 CVE-2015-7809 affects Twig before version 1.20.0. The target repository is Twig version 2.16.1, which contains the fix introduced in 1.20.0. The vulnerability allowed remote code execution via the _self variable in templates when Sandbox mode was enabled. The fix adds a type validation check in the displayBlock function that ensures template blocks must be instances of \\Twig\\Template, preventin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-7809" }, "impact_statement": "already_fixed \u2014 CVE-2015-7809 affects Twig before version 1.20.0. The target repository is Twig version 2.16.1, which contains the fix introduced in 1.20.0. The vulnerability allowed remote code execution via the _self variable in templates when Sandbox mode was enabled. The fix adds a type validation check in the displayBlock function that ensures template blocks must be instances of \\Twig\\Template, preventin..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:48:29.435115+00:00", "status_notes": "Vulnerability CVE-2019-9942 does not affect version v2.16.1-p3+tuxcare of twig/twig. already_fixed \u2014 CVE-2019-9942 has been fixed in Twig 2.16.1. The target contains the complete mitigation introduced in Twig 2.7.0 that prevents __toString() method calls from bypassing sandbox security policy restrictions.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-9942" }, "impact_statement": "already_fixed \u2014 CVE-2019-9942 has been fixed in Twig 2.16.1. The target contains the complete mitigation introduced in Twig 2.7.0 that prevents __toString() method calls from bypassing sandbox security policy restrictions." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:48:29.435115+00:00", "status_notes": "Vulnerability CVE-2022-23614 does not affect version v2.16.1-p3+tuxcare of twig/twig. The target repository (Twig v2.16.1-p2+tuxcare) is NOT AFFECTED by CVE-2022-23614. The vulnerability (sandbox bypass via non-Closure callables in the sort filter) was fixed in upstream Twig v2.14.11 (released 2022-02-04). Since the target version v2.16.1 is newer than v2.14.11, the fix was already present in the upstream release that TuxCare onboarded. The defense code (twig_check_arrow_in_sandbox validation) is present in CoreExtension.php at line 954 and blocks the attack by throwing a RuntimeError when a non-Closure callable is passed to the sort filter in sandbox mode.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-23614" }, "impact_statement": "The target repository (Twig v2.16.1-p2+tuxcare) is NOT AFFECTED by CVE-2022-23614. The vulnerability (sandbox bypass via non-Closure callables in the sort filter) was fixed in upstream Twig v2.14.11 (released 2022-02-04). Since the target version v2.16.1 is newer than v2.14.11, the fix was already present in the upstream release that TuxCare onboarded. The defense code (twig_check_arrow_in_sandbox validation) is present in CoreExtension.php at line 954 and blocks the attack by throwing a RuntimeError when a non-Closure callable is passed to the sort filter in sandbox mode." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:48:29.435115+00:00", "status_notes": "Vulnerability CVE-2022-39261 does not affect version v2.16.1-p3+tuxcare of twig/twig. CVE-2022-39261 describes a path traversal vulnerability in Twig's FilesystemLoader where namespaced template names like `@foo/../file.txt` could bypass validation to read arbitrary files outside configured template directories. The target repository (twig/twig v2.16.1-p2+tuxcare) is NOT AFFECTED because the upstream fix was already present in the v2.16.1 release that TuxCare onboarded. The fix changed validation order in FilesystemLoader::findTemplate() to validate the shortname AFTER namespace parsing (lines 209-211), ensuring path traversal sequences are detected. This was an upstream fix by Fabien Potencier, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-39261" }, "impact_statement": "CVE-2022-39261 describes a path traversal vulnerability in Twig's FilesystemLoader where namespaced template names like `@foo/../file.txt` could bypass validation to read arbitrary files outside configured template directories. The target repository (twig/twig v2.16.1-p2+tuxcare) is NOT AFFECTED because the upstream fix was already present in the v2.16.1 release that TuxCare onboarded. The fix changed validation order in FilesystemLoader::findTemplate() to validate the shortname AFTER namespace parsing (lines 209-211), ensuring path traversal sequences are detected. This was an upstream fix by Fabien Potencier, not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:48:29.435115+00:00", "status_notes": "Vulnerability CVE-2024-45411 does not affect version v2.16.1-p3+tuxcare of twig/twig. twig/twig 2.16.1 is the upstream release that fixes CVE-2024-45411 (GHSA-6j75-5wfj-gh66: affected >2.0.0,<=2.16.0; patched 2.16.1). The upstream fix (commit 2102dd1359) is part of the 2.16.1 code. In the TuxCare build the sandbox check was later moved into Template::ensureSecurityChecked(), which runs on every sandboxed render, including templates rendered via include(). The CVE-2024-45411 regression tests (testSandboxedInclude, testSandboxedIncludeWithPreloadedTemplate) pass on this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45411" }, "impact_statement": "twig/twig 2.16.1 is the upstream release that fixes CVE-2024-45411 (GHSA-6j75-5wfj-gh66: affected >2.0.0,<=2.16.0; patched 2.16.1). The upstream fix (commit 2102dd1359) is part of the 2.16.1 code. In the TuxCare build the sandbox check was later moved into Template::ensureSecurityChecked(), which runs on every sandboxed render, including templates rendered via include(). The CVE-2024-45411 regression tests (testSandboxedInclude, testSandboxedIncludeWithPreloadedTemplate) pass on this version." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:48:29.435115+00:00", "status_notes": "Vulnerability CVE-2024-51754 is fixed in version v2.16.1-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-51754" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:48:29.435115+00:00", "status_notes": "Vulnerability CVE-2024-51755 is fixed in version v2.16.1-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-51755" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:48:29.435115+00:00", "status_notes": "Vulnerability CVE-2026-24425 is fixed in version v2.16.1-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-24425" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:48:29.435115+00:00", "status_notes": "Vulnerability CVE-2026-46628 is fixed in version v2.16.1-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46628" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:48:29.435115+00:00", "status_notes": "Vulnerability CVE-2026-46633 is fixed in version v2.16.1-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46633" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:49:00.031657+00:00", "status_notes": "Vulnerability CVE-2026-46634 is fixed in version v2.16.1-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:48:29.435115+00:00", "status_notes": "Vulnerability CVE-2026-46635 is fixed in version v2.16.1-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46635" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:48:29.435115+00:00", "status_notes": "Vulnerability CVE-2026-46638 is fixed in version v2.16.1-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46638" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:48:29.435115+00:00", "status_notes": "Vulnerability CVE-2026-46640 does not affect version v2.16.1-p3+tuxcare of twig/twig. Twig 2.16.1-p2+tuxcare is not affected by CVE-2026-46640. The vulnerability requires the `obj.(expr)` dynamic-attribute syntax with parenthesized expressions, which was introduced in Twig 3.15.0 and does not exist in Twig 2.x. The target version only supports `obj.name` (static identifiers), `obj[expr]` (bracket notation), and the `attribute()` function, all of which use safe mechanisms. Additionally, the macro call path in 2.x uses `->repr()` to escape method names when generating PHP code, preventing injection even if the syntax were supported.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-46640" }, "impact_statement": "Twig 2.16.1-p2+tuxcare is not affected by CVE-2026-46640. The vulnerability requires the `obj.(expr)` dynamic-attribute syntax with parenthesized expressions, which was introduced in Twig 3.15.0 and does not exist in Twig 2.x. The target version only supports `obj.name` (static identifiers), `obj[expr]` (bracket notation), and the `attribute()` function, all of which use safe mechanisms. Additionally, the macro call path in 2.x uses `->repr()` to escape method names when generating PHP code, preventing injection even if the syntax were supported." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:49:00.031657+00:00", "status_notes": "Vulnerability CVE-2026-47730 is fixed in version v2.16.1-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-47730" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:48:29.435115+00:00", "status_notes": "Vulnerability CVE-2026-47732 is fixed in version v2.16.1-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-47732" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:48:29.435115+00:00", "status_notes": "Vulnerability CVE-2026-48805 does not affect version v2.16.1-p3+tuxcare of twig/twig. not_affected \u2014 CVE-2026-48805 describes a sandbox bypass in Twig v3.26.0 where deprecated wrapper functions in src/Resources/core.php fail to forward sandbox state to refactored CoreExtension class methods. Target v2.16.1 uses a completely different architecture where the vulnerable delegation pattern does not exist. The functions twig_array_some() and twig_array_every() don't exist in v2.16.1, and twig_check...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48805" }, "impact_statement": "not_affected \u2014 CVE-2026-48805 describes a sandbox bypass in Twig v3.26.0 where deprecated wrapper functions in src/Resources/core.php fail to forward sandbox state to refactored CoreExtension class methods. Target v2.16.1 uses a completely different architecture where the vulnerable delegation pattern does not exist. The functions twig_array_some() and twig_array_every() don't exist in v2.16.1, and twig_check..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:48:29.435115+00:00", "status_notes": "Vulnerability CVE-2026-48806 is fixed in version v2.16.1-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48806" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:48:29.435115+00:00", "status_notes": "Vulnerability CVE-2026-48807 is fixed in version v2.16.1-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48807" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:48:29.435115+00:00", "status_notes": "Vulnerability CVE-2026-48808 is fixed in version v2.16.1-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.16.1-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:48:29.435115+00:00", "status_notes": "Vulnerability CVE-2026-49981 is fixed in version v2.16.1-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-49981" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.2-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.2 (released December 2020) inherited the fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time compa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.2 (released December 2020) inherited the fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time compa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.2-p3+tuxcare of laravel/framework. CVE-2018-15133 describes a PHP deserialization vulnerability in Laravel's cookie decryption, allowing remote code execution via crafted X-XSRF-TOKEN values when the attacker knows the application key. The target version 8.12.2 already contains the upstream fix that disables automatic unserialization of decrypted cookie data. The fix sets static $serialize = false by default and passes this flag through the entire encryption/decryption chain (EncryptCookies::serialized() \u2192 VerifyCsrfToken::decrypt() \u2192 Encrypter::decrypt()), preventing unserialize() from being called on attacker-controlled data. The vulnerability was patched by Laravel in August 2018; version 8.12.2 (released 2020) included the fix when onboarded via snapshot commit 58ccc3bfb7 by contact@bikramlama.com.np, prior to any TuxCare involvement.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 describes a PHP deserialization vulnerability in Laravel's cookie decryption, allowing remote code execution via crafted X-XSRF-TOKEN values when the attacker knows the application key. The target version 8.12.2 already contains the upstream fix that disables automatic unserialization of decrypted cookie data. The fix sets static $serialize = false by default and passes this flag through the entire encryption/decryption chain (EncryptCookies::serialized() \u2192 VerifyCsrfToken::decrypt() \u2192 Encrypter::decrypt()), preventing unserialize() from being called on attacker-controlled data. The vulnerability was patched by Laravel in August 2018; version 8.12.2 (released 2020) included the fix when onboarded via snapshot commit 58ccc3bfb7 by contact@bikramlama.com.np, prior to any TuxCare involvement." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 8.12.2-p3+tuxcare of laravel/framework. Laravel Framework 8.12.2-p5+tuxcare contains the PendingCommand deserialization gadget (__destruct method at line 340-347) that CVE-2019-9081 describes. However, this version is not exploitable in default configuration because: (1) File-based sessions store data server-side in storage/framework/sessions/ which attackers cannot directly modify; (2) Cookie-based sessions use JSON encoding (CookieSessionHandler lines 71, 85), not PHP serialization; (3) Cache data is server-side; (4) No code path exists for attacker-controlled serialized data to reach unserialize() calls in Session\\Store (line 98) or Cache stores (FileStore line 223) without a separate vulnerability. The CVE states the vulnerability exists \"if the content is controllable\" - in default Laravel 8.12.2, serialized content is NOT attacker-controllable. While the gadget chain exists and could be exploited in combination with file upload vulnerabilities, shared hosting scenarios, or custom code that unserializes user input, these require non-default configurations or separate vulnerabilities beyond CVE-2019-9081's scope.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "Laravel Framework 8.12.2-p5+tuxcare contains the PendingCommand deserialization gadget (__destruct method at line 340-347) that CVE-2019-9081 describes. However, this version is not exploitable in default configuration because: (1) File-based sessions store data server-side in storage/framework/sessions/ which attackers cannot directly modify; (2) Cookie-based sessions use JSON encoding (CookieSessionHandler lines 71, 85), not PHP serialization; (3) Cache data is server-side; (4) No code path exists for attacker-controlled serialized data to reach unserialize() calls in Session\\Store (line 98) or Cache stores (FileStore line 223) without a separate vulnerability. The CVE states the vulnerability exists \"if the content is controllable\" - in default Laravel 8.12.2, serialized content is NOT attacker-controllable. While the gadget chain exists and could be exploited in combination with file upload vulnerabilities, shared hosting scenarios, or custom code that unserializes user input, these require non-default configurations or separate vulnerabilities beyond CVE-2019-9081's scope." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.2-p3+tuxcare of laravel/framework. The target laravel/framework version 8.12.2 is not affected by CVE-2020-19316. The vulnerability (OS command injection in the Filesystem::link() method) was fixed upstream by Taylor Otwell in May 2019 (commit 44c3feb6) for Laravel 5.8.17. The fix adds escapeshellarg() to both the $link and $target parameters before passing them to the exec() call. Since the target version 8.12.2 (released in 2020) is significantly newer than 5.8.17, the fix was already present in the upstream release that TuxCare onboarded via snapshot commit 58ccc3bfb7. The vulnerable code pattern does not exist in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target laravel/framework version 8.12.2 is not affected by CVE-2020-19316. The vulnerability (OS command injection in the Filesystem::link() method) was fixed upstream by Taylor Otwell in May 2019 (commit 44c3feb6) for Laravel 5.8.17. The fix adds escapeshellarg() to both the $link and $target parameters before passing them to the exec() call. Since the target version 8.12.2 (released in 2020) is significantly newer than 5.8.17, the fix was already present in the upstream release that TuxCare onboarded via snapshot commit 58ccc3bfb7. The vulnerable code pattern does not exist in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:41:18.186955+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.2-p3+tuxcare of laravel/framework. CVE-2020-24941 is NOT present in Laravel 8.12.2-p5+tuxcare. The vulnerability affects Laravel before 6.18.35 and 7.x before 7.24.0. The fix was committed to Laravel 6.x on August 7, 2020 (commit 897d107775), before Laravel 8.0.0 was released (September 8, 2020). Laravel 8.12.2 shipped with the fix already included. The target repository's snapshot commit (58ccc3bfb7) by contact@bikramlama.com.np brought in Laravel 8.12.2 with the complete fix: the isGuardableColumn() method validates that attribute keys correspond to actual database columns, preventing mass assignment bypass via non-existent column names.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 is NOT present in Laravel 8.12.2-p5+tuxcare. The vulnerability affects Laravel before 6.18.35 and 7.x before 7.24.0. The fix was committed to Laravel 6.x on August 7, 2020 (commit 897d107775), before Laravel 8.0.0 was released (September 8, 2020). Laravel 8.12.2 shipped with the fix already included. The target repository's snapshot commit (58ccc3bfb7) by contact@bikramlama.com.np brought in Laravel 8.12.2 with the complete fix: the isGuardableColumn() method validates that attribute keys correspond to actual database columns, preventing mass assignment bypass via non-existent column names." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.2-p3+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.2-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer which uses Tippy.js tooltips with allowHTML: true. Laravel 8.12.2 uses a completely different exception rendering system (Whoops/filp/whoops) that does not include Tippy.js or any JavaScript tooltip functionality. The vulnerable component was introduced in Laravel 11.x+, sever...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer which uses Tippy.js tooltips with allowHTML: true. Laravel 8.12.2 uses a completely different exception rendering system (Whoops/filp/whoops) that does not include Tippy.js or any JavaScript tooltip functionality. The vulnerable component was introduced in Laravel 11.x+, sever..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.2-p3+tuxcare of laravel/framework. not_affected \u2014 Target version 8.12.2 predates the introduction of Laravel's JSON:API resource feature by approximately 5 years. The vulnerable code (ResolvesJsonApiElements trait with loadMissing() call) does not exist in this version. JSON:API resources were first introduced in Laravel v12.45.0 (December 2025) via commit 2f309363, while the target is from the 8.x series released around 2020. Exhaustive searc...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Target version 8.12.2 predates the introduction of Laravel's JSON:API resource feature by approximately 5 years. The vulnerable code (ResolvesJsonApiElements trait with loadMissing() call) does not exist in this version. JSON:API resources were first introduced in Laravel v12.45.0 (December 2025) via commit 2f309363, while the target is from the 8.x series released around 2020. Exhaustive searc..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:42:00.096965+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.2-p3+tuxcare of laravel/framework, and is fixed in 8.12.2-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.2-p3+tuxcare of laravel/framework, and is fixed in 8.12.2-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:53:45.635911+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.2-p3+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 8.12.2 is not affected by GHSA-6jvx-8ch9-j2jr (Laravel 5.6.30 cookie deserialization vulnerability). The fix disabling automatic cookie serialization was already present in the upstream Laravel 8.12.2 release, which predates TuxCare's onboarding of this repository. The vulnerable pattern (unsafe cookie deserialization enabling PHP object injection) is absent: EncryptCookies middl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target Laravel 8.12.2 is not affected by GHSA-6jvx-8ch9-j2jr (Laravel 5.6.30 cookie deserialization vulnerability). The fix disabling automatic cookie serialization was already present in the upstream Laravel 8.12.2 release, which predates TuxCare's onboarding of this repository. The vulnerable pattern (unsafe cookie deserialization enabling PHP object injection) is absent: EncryptCookies middl..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.2-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false when IV length is manipulated) was already fixed in the upstream Laravel 8.12.2 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 contains the required IV length validation that matches the vendor ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false when IV length is manipulated) was already fixed in the upstream Laravel 8.12.2 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 contains the required IV length validation that matches the vendor ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.2-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.2 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in Laravel 12.x's LocalFilesystemAdapter class which provides signed URL functionality for local filesystem storage. This feature does not exist in Laravel 8.12.2, which uses a different architecture where local filesystem adapters cannot generate temporary signed URLs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.2 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in Laravel 12.x's LocalFilesystemAdapter class which provides signed URL functionality for local filesystem storage. This feature does not exist in Laravel 8.12.2, which uses a different architecture where local filesystem adapters cannot generate temporary signed URLs." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:14:55.406911+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.2-p3+tuxcare of laravel/framework. Laravel framework 8.12.2 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability involved using plain SHA1 hashes for cookie value prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The fix (using HMAC with the encryption key instead of plain SHA1) was released in Laravel 6.18.31 on July 27, 2020. Laravel 8.0.0 was released on September 8, 2020, after the security fix, so all Laravel 8.x versions including 8.12.2 shipped with the fix from their original upstream release. The target contains CookieValuePrefix class using hash_hmac() at line 16, confirming the fixed pattern is present. The vulnerable pattern (plain sha1) is absent from the codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel framework 8.12.2 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability involved using plain SHA1 hashes for cookie value prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The fix (using HMAC with the encryption key instead of plain SHA1) was released in Laravel 6.18.31 on July 27, 2020. Laravel 8.0.0 was released on September 8, 2020, after the security fix, so all Laravel 8.x versions including 8.12.2 shipped with the fix from their original upstream release. The target contains CookieValuePrefix class using hash_hmac() at line 16, confirming the fixed pattern is present. The vulnerable pattern (plain sha1) is absent from the codebase." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.2-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.2-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.2 (released December 2020) inherited the fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time compa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.2 (released December 2020) inherited the fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time compa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.2-p2+tuxcare of laravel/framework. CVE-2018-15133 describes a PHP deserialization vulnerability in Laravel's cookie decryption, allowing remote code execution via crafted X-XSRF-TOKEN values when the attacker knows the application key. The target version 8.12.2 already contains the upstream fix that disables automatic unserialization of decrypted cookie data. The fix sets static $serialize = false by default and passes this flag through the entire encryption/decryption chain (EncryptCookies::serialized() \u2192 VerifyCsrfToken::decrypt() \u2192 Encrypter::decrypt()), preventing unserialize() from being called on attacker-controlled data. The vulnerability was patched by Laravel in August 2018; version 8.12.2 (released 2020) included the fix when onboarded via snapshot commit 58ccc3bfb7 by contact@bikramlama.com.np, prior to any TuxCare involvement.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 describes a PHP deserialization vulnerability in Laravel's cookie decryption, allowing remote code execution via crafted X-XSRF-TOKEN values when the attacker knows the application key. The target version 8.12.2 already contains the upstream fix that disables automatic unserialization of decrypted cookie data. The fix sets static $serialize = false by default and passes this flag through the entire encryption/decryption chain (EncryptCookies::serialized() \u2192 VerifyCsrfToken::decrypt() \u2192 Encrypter::decrypt()), preventing unserialize() from being called on attacker-controlled data. The vulnerability was patched by Laravel in August 2018; version 8.12.2 (released 2020) included the fix when onboarded via snapshot commit 58ccc3bfb7 by contact@bikramlama.com.np, prior to any TuxCare involvement." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 8.12.2-p2+tuxcare of laravel/framework. Laravel Framework 8.12.2-p5+tuxcare contains the PendingCommand deserialization gadget (__destruct method at line 340-347) that CVE-2019-9081 describes. However, this version is not exploitable in default configuration because: (1) File-based sessions store data server-side in storage/framework/sessions/ which attackers cannot directly modify; (2) Cookie-based sessions use JSON encoding (CookieSessionHandler lines 71, 85), not PHP serialization; (3) Cache data is server-side; (4) No code path exists for attacker-controlled serialized data to reach unserialize() calls in Session\\Store (line 98) or Cache stores (FileStore line 223) without a separate vulnerability. The CVE states the vulnerability exists \"if the content is controllable\" - in default Laravel 8.12.2, serialized content is NOT attacker-controllable. While the gadget chain exists and could be exploited in combination with file upload vulnerabilities, shared hosting scenarios, or custom code that unserializes user input, these require non-default configurations or separate vulnerabilities beyond CVE-2019-9081's scope.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "Laravel Framework 8.12.2-p5+tuxcare contains the PendingCommand deserialization gadget (__destruct method at line 340-347) that CVE-2019-9081 describes. However, this version is not exploitable in default configuration because: (1) File-based sessions store data server-side in storage/framework/sessions/ which attackers cannot directly modify; (2) Cookie-based sessions use JSON encoding (CookieSessionHandler lines 71, 85), not PHP serialization; (3) Cache data is server-side; (4) No code path exists for attacker-controlled serialized data to reach unserialize() calls in Session\\Store (line 98) or Cache stores (FileStore line 223) without a separate vulnerability. The CVE states the vulnerability exists \"if the content is controllable\" - in default Laravel 8.12.2, serialized content is NOT attacker-controllable. While the gadget chain exists and could be exploited in combination with file upload vulnerabilities, shared hosting scenarios, or custom code that unserializes user input, these require non-default configurations or separate vulnerabilities beyond CVE-2019-9081's scope." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.2-p2+tuxcare of laravel/framework. The target laravel/framework version 8.12.2 is not affected by CVE-2020-19316. The vulnerability (OS command injection in the Filesystem::link() method) was fixed upstream by Taylor Otwell in May 2019 (commit 44c3feb6) for Laravel 5.8.17. The fix adds escapeshellarg() to both the $link and $target parameters before passing them to the exec() call. Since the target version 8.12.2 (released in 2020) is significantly newer than 5.8.17, the fix was already present in the upstream release that TuxCare onboarded via snapshot commit 58ccc3bfb7. The vulnerable code pattern does not exist in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target laravel/framework version 8.12.2 is not affected by CVE-2020-19316. The vulnerability (OS command injection in the Filesystem::link() method) was fixed upstream by Taylor Otwell in May 2019 (commit 44c3feb6) for Laravel 5.8.17. The fix adds escapeshellarg() to both the $link and $target parameters before passing them to the exec() call. Since the target version 8.12.2 (released in 2020) is significantly newer than 5.8.17, the fix was already present in the upstream release that TuxCare onboarded via snapshot commit 58ccc3bfb7. The vulnerable code pattern does not exist in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:41:18.186955+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.2-p2+tuxcare of laravel/framework. CVE-2020-24941 is NOT present in Laravel 8.12.2-p5+tuxcare. The vulnerability affects Laravel before 6.18.35 and 7.x before 7.24.0. The fix was committed to Laravel 6.x on August 7, 2020 (commit 897d107775), before Laravel 8.0.0 was released (September 8, 2020). Laravel 8.12.2 shipped with the fix already included. The target repository's snapshot commit (58ccc3bfb7) by contact@bikramlama.com.np brought in Laravel 8.12.2 with the complete fix: the isGuardableColumn() method validates that attribute keys correspond to actual database columns, preventing mass assignment bypass via non-existent column names.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 is NOT present in Laravel 8.12.2-p5+tuxcare. The vulnerability affects Laravel before 6.18.35 and 7.x before 7.24.0. The fix was committed to Laravel 6.x on August 7, 2020 (commit 897d107775), before Laravel 8.0.0 was released (September 8, 2020). Laravel 8.12.2 shipped with the fix already included. The target repository's snapshot commit (58ccc3bfb7) by contact@bikramlama.com.np brought in Laravel 8.12.2 with the complete fix: the isGuardableColumn() method validates that attribute keys correspond to actual database columns, preventing mass assignment bypass via non-existent column names." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.2-p2+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.2-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer which uses Tippy.js tooltips with allowHTML: true. Laravel 8.12.2 uses a completely different exception rendering system (Whoops/filp/whoops) that does not include Tippy.js or any JavaScript tooltip functionality. The vulnerable component was introduced in Laravel 11.x+, sever...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer which uses Tippy.js tooltips with allowHTML: true. Laravel 8.12.2 uses a completely different exception rendering system (Whoops/filp/whoops) that does not include Tippy.js or any JavaScript tooltip functionality. The vulnerable component was introduced in Laravel 11.x+, sever..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.2-p2+tuxcare of laravel/framework. not_affected \u2014 Target version 8.12.2 predates the introduction of Laravel's JSON:API resource feature by approximately 5 years. The vulnerable code (ResolvesJsonApiElements trait with loadMissing() call) does not exist in this version. JSON:API resources were first introduced in Laravel v12.45.0 (December 2025) via commit 2f309363, while the target is from the 8.x series released around 2020. Exhaustive searc...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Target version 8.12.2 predates the introduction of Laravel's JSON:API resource feature by approximately 5 years. The vulnerable code (ResolvesJsonApiElements trait with loadMissing() call) does not exist in this version. JSON:API resources were first introduced in Laravel v12.45.0 (December 2025) via commit 2f309363, while the target is from the 8.x series released around 2020. Exhaustive searc..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-11-04T11:42:00.096965+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.2-p2+tuxcare of laravel/framework, and is fixed in 8.12.2-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.2-p2+tuxcare of laravel/framework, and is fixed in 8.12.2-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:53:45.635911+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.2-p2+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 8.12.2 is not affected by GHSA-6jvx-8ch9-j2jr (Laravel 5.6.30 cookie deserialization vulnerability). The fix disabling automatic cookie serialization was already present in the upstream Laravel 8.12.2 release, which predates TuxCare's onboarding of this repository. The vulnerable pattern (unsafe cookie deserialization enabling PHP object injection) is absent: EncryptCookies middl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target Laravel 8.12.2 is not affected by GHSA-6jvx-8ch9-j2jr (Laravel 5.6.30 cookie deserialization vulnerability). The fix disabling automatic cookie serialization was already present in the upstream Laravel 8.12.2 release, which predates TuxCare's onboarding of this repository. The vulnerable pattern (unsafe cookie deserialization enabling PHP object injection) is absent: EncryptCookies middl..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.2-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false when IV length is manipulated) was already fixed in the upstream Laravel 8.12.2 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 contains the required IV length validation that matches the vendor ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false when IV length is manipulated) was already fixed in the upstream Laravel 8.12.2 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 contains the required IV length validation that matches the vendor ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.2-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.2 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in Laravel 12.x's LocalFilesystemAdapter class which provides signed URL functionality for local filesystem storage. This feature does not exist in Laravel 8.12.2, which uses a different architecture where local filesystem adapters cannot generate temporary signed URLs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.2 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in Laravel 12.x's LocalFilesystemAdapter class which provides signed URL functionality for local filesystem storage. This feature does not exist in Laravel 8.12.2, which uses a different architecture where local filesystem adapters cannot generate temporary signed URLs." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:14:55.406911+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.2-p2+tuxcare of laravel/framework. Laravel framework 8.12.2 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability involved using plain SHA1 hashes for cookie value prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The fix (using HMAC with the encryption key instead of plain SHA1) was released in Laravel 6.18.31 on July 27, 2020. Laravel 8.0.0 was released on September 8, 2020, after the security fix, so all Laravel 8.x versions including 8.12.2 shipped with the fix from their original upstream release. The target contains CookieValuePrefix class using hash_hmac() at line 16, confirming the fixed pattern is present. The vulnerable pattern (plain sha1) is absent from the codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel framework 8.12.2 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability involved using plain SHA1 hashes for cookie value prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The fix (using HMAC with the encryption key instead of plain SHA1) was released in Laravel 6.18.31 on July 27, 2020. Laravel 8.0.0 was released on September 8, 2020, after the security fix, so all Laravel 8.x versions including 8.12.2 shipped with the fix from their original upstream release. The target contains CookieValuePrefix class using hash_hmac() at line 16, confirming the fixed pattern is present. The vulnerable pattern (plain sha1) is absent from the codebase." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.2-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:46:00.103396+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 6.20.45-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 6.20.45-p5+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:45:39.779746+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 6.20.45-p5+tuxcare of laravel/framework. CVE-2018-15133 is NOT present in Laravel 6.20.45-p6+tuxcare. The vulnerability (RCE via unserialize on X-XSRF-TOKEN) was fixed in upstream Laravel 5.6.30/5.5.41 (August 2018) by disabling cookie serialization. The fix (protected static $serialize = false; using static::serialized() in decrypt calls) was already present when Laravel 6.20.45 was released and onboarded by TuxCare. The vulnerable code pattern does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 is NOT present in Laravel 6.20.45-p6+tuxcare. The vulnerability (RCE via unserialize on X-XSRF-TOKEN) was fixed in upstream Laravel 5.6.30/5.5.41 (August 2018) by disabling cookie serialization. The fix (protected static $serialize = false; using static::serialized() in decrypt calls) was already present when Laravel 6.20.45 was released and onboarded by TuxCare. The vulnerable code pattern does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 6.20.45-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 6.20.45-p5+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 6.20.45-p5+tuxcare of laravel/framework. The target Laravel Framework 6.20.45 is NOT vulnerable to CVE-2020-19316. The vulnerable code pattern (unescaped parameters in Windows mklink exec call) is not present. The fix using escapeshellarg() was already included in the upstream Laravel v6.20.45 release that TuxCare onboarded. The vulnerability affected Laravel before 5.8.17 (patched May 2019), and version 6.20.45 already contains the upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target Laravel Framework 6.20.45 is NOT vulnerable to CVE-2020-19316. The vulnerable code pattern (unescaped parameters in Windows mklink exec call) is not present. The fix using escapeshellarg() was already included in the upstream Laravel v6.20.45 release that TuxCare onboarded. The vulnerability affected Laravel before 5.8.17 (patched May 2019), and version 6.20.45 already contains the upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:42:21.835037+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 6.20.45-p5+tuxcare of laravel/framework. The target Laravel framework version 6.20.45-p6+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability (mass assignment bypass via non-existent column names) was fixed in upstream Laravel v6.18.35 (commit 897d107775 by Taylor Otwell). The target version 6.20.45 already contains this fix, which validates that attribute keys exist as actual database columns via the isGuardableColumn() method. The fix was shipped in the upstream release and onboarded to TuxCare via snapshot commit abbc62d18a. The vulnerable pattern (allowing mass assignment to arbitrary non-column attributes) is not present in the target code.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel framework version 6.20.45-p6+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability (mass assignment bypass via non-existent column names) was fixed in upstream Laravel v6.18.35 (commit 897d107775 by Taylor Otwell). The target version 6.20.45 already contains this fix, which validates that attribute keys exist as actual database columns via the isGuardableColumn() method. The fix was shipped in the upstream release and onboarded to TuxCare via snapshot commit abbc62d18a. The vulnerable pattern (allowing mass assignment to arbitrary non-column attributes) is not present in the target code." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 6.20.45-p5+tuxcare of laravel/framework. CVE-2021-21263 affects Laravel versions <6.20.12. The target is version 6.20.45, which includes the upstream fix that prevents query binding exploitation. The vulnerability allowed array values to be passed to query builder methods where scalar values were expected, causing incorrect binding counts and corrupted query results. The target contains comprehensive protections using a `flattenValue()` helper method across all affected methods (where, having, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, whereBetween). The fix was present in the upstream v6.20.45 release and was imported via TuxCare's snapshot commit abbc62d18a, with no subsequent modifications to the query builder.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "CVE-2021-21263 affects Laravel versions <6.20.12. The target is version 6.20.45, which includes the upstream fix that prevents query binding exploitation. The vulnerability allowed array values to be passed to query builder methods where scalar values were expected, causing incorrect binding counts and corrupted query results. The target contains comprehensive protections using a `flattenValue()` helper method across all affected methods (where, having, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, whereBetween). The fix was present in the upstream v6.20.45 release and was imported via TuxCare's snapshot commit abbc62d18a, with no subsequent modifications to the query builder." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 6.20.45-p5+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-28T21:30:41.069534+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 6.20.45-p5+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 6.20.45-p5+tuxcare of laravel/framework. The target repository (Laravel framework 6.20.45-p6+tuxcare) is not affected by CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled, allowing attackers to control environment detection through $_SERVER['argv']. The fix adds a runningInConsole() check before using argv values. This fix was already present in the upstream Laravel v6.20.45 release (authored by Taylor Otwell, taylor@laravel.com, Nov 2024) before TuxCare created their snapshot. The TuxCare branch started from a snapshot of v6.20.45 (commit abbc62d18a) which already contained the fixed code. No TuxCare backport was necessary as the vulnerable code pattern never existed in this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target repository (Laravel framework 6.20.45-p6+tuxcare) is not affected by CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled, allowing attackers to control environment detection through $_SERVER['argv']. The fix adds a runningInConsole() check before using argv values. This fix was already present in the upstream Laravel v6.20.45 release (authored by Taylor Otwell, taylor@laravel.com, Nov 2024) before TuxCare created their snapshot. The TuxCare branch started from a snapshot of v6.20.45 (commit abbc62d18a) which already contained the fixed code. No TuxCare backport was necessary as the vulnerable code pattern never existed in this branch." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:46:00.103396+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 6.20.45-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:46:00.103396+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 6.20.45-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 6.20.45-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:46:15.891205+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 6.20.45-p5+tuxcare of laravel/framework, and is fixed in 6.20.45-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 6.20.45-p5+tuxcare of laravel/framework, and is fixed in 6.20.45-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-28T20:50:01.681995+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 6.20.45-p5+tuxcare of laravel/framework. not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:46:00.103396+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 6.20.45-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-28T21:05:58.501817+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 6.20.45-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 6.20.45-p5+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:46:00.103396+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 6.20.45-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 6.20.45-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:19:00.105438+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 6.20.45-p5+tuxcare of laravel/framework. Laravel Framework 6.20.45 is not affected by GHSA-qm5c-m76r-2hfr (encryption oracle RCE via cookie session driver). The vulnerability was fixed by upstream Laravel in version 6.18.31 on July 27, 2020, by replacing predictable SHA1 hash prefixes with keyed HMAC values in cookie encryption. Version 6.20.45 was released after this fix and already includes the CookieValuePrefix class with hash_hmac() implementation. The target contains the secure code pattern, not the vulnerable one.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel Framework 6.20.45 is not affected by GHSA-qm5c-m76r-2hfr (encryption oracle RCE via cookie session driver). The vulnerability was fixed by upstream Laravel in version 6.18.31 on July 27, 2020, by replacing predictable SHA1 hash prefixes with keyed HMAC values in cookie encryption. Version 6.20.45 was released after this fix and already includes the CookieValuePrefix class with hash_hmac() implementation. The target contains the secure code pattern, not the vulnerable one." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 6.20.45-p5+tuxcare of laravel/framework. not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:42:21.835037+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 6.20.45-p5+tuxcare of laravel/framework. The target repository (Laravel 6.20.45) is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involving unexpected query bindings from array values has already been fixed in the upstream Laravel release v6.20.11 (Jan 13, 2021) and v6.20.14 (Jan 21, 2021), which were released well before v6.20.45. All query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the `flattenValue()` helper method to extract scalar values from array inputs, preventing the SQL binding mismatch vulnerability. The fix was authored by Taylor Otwell for the upstream Laravel framework and was included in the v6.20.45 release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "The target repository (Laravel 6.20.45) is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involving unexpected query bindings from array values has already been fixed in the upstream Laravel release v6.20.11 (Jan 13, 2021) and v6.20.14 (Jan 21, 2021), which were released well before v6.20.45. All query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the `flattenValue()` helper method to extract scalar values from array inputs, preventing the SQL binding mismatch vulnerability. The fix was authored by Taylor Otwell for the upstream Laravel framework and was included in the v6.20.45 release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:35:46.395275+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.1-p6+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 does not affect Laravel 8.12.1-p5+tuxcare. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017), and the fix was already present in the upstream Laravel 8.12.1 release (December 2020) that TuxCare onboarded. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison, preventing...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 does not affect Laravel 8.12.1-p5+tuxcare. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017), and the fix was already present in the upstream Laravel 8.12.1 release (December 2020) that TuxCare onboarded. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison, preventing..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:35:46.395275+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.1-p6+tuxcare of laravel/framework. The target Laravel v8.12.1 is NOT affected by CVE-2018-15133. The vulnerability (uncontrolled deserialization of encrypted cookie data) has been mitigated by the upstream Laravel framework prior to v8.12.1. The target code passes `false` to `decrypt()` for all cookie operations, preventing automatic unserialization and blocking PHP object injection attacks. This fix was authored by Taylor Otwell in August 2018 and was included in the upstream v8.12.1 release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "The target Laravel v8.12.1 is NOT affected by CVE-2018-15133. The vulnerability (uncontrolled deserialization of encrypted cookie data) has been mitigated by the upstream Laravel framework prior to v8.12.1. The target code passes `false` to `decrypt()` for all cookie operations, preventing automatic unserialization and blocking PHP object injection attacks. This fix was authored by Taylor Otwell in August 2018 and was included in the upstream v8.12.1 release that TuxCare onboarded." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:35:46.395275+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.1-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.1-p6+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:35:46.395275+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.1-p6+tuxcare of laravel/framework. The target Laravel Framework 8.12.1 is NOT AFFECTED by CVE-2020-19316. The vulnerable code pattern (unescaped shell parameters in the link() method's mklink exec call) is not present. The target has the proper fix with escapeshellarg() sanitization on both $link and $target parameters (line 320 of Filesystem.php). This fix was authored by upstream Laravel maintainer Taylor Otwell in May 2019 (commit 44c3feb604944599ad1c782a9942981c3991fa31) and was already present in the upstream Laravel 8.12.1 release when TuxCare onboarded it via snapshot commit 4993dfe2ac. CVE affected versions \"before 5.8.17\"; target is 8.12.1, which naturally includes the fix from the 5.8.17 era.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target Laravel Framework 8.12.1 is NOT AFFECTED by CVE-2020-19316. The vulnerable code pattern (unescaped shell parameters in the link() method's mklink exec call) is not present. The target has the proper fix with escapeshellarg() sanitization on both $link and $target parameters (line 320 of Filesystem.php). This fix was authored by upstream Laravel maintainer Taylor Otwell in May 2019 (commit 44c3feb604944599ad1c782a9942981c3991fa31) and was already present in the upstream Laravel 8.12.1 release when TuxCare onboarded it via snapshot commit 4993dfe2ac. CVE affected versions \"before 5.8.17\"; target is 8.12.1, which naturally includes the fix from the 5.8.17 era." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:35:46.395275+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.1-p6+tuxcare of laravel/framework. Laravel 8.12.1 was released after CVE-2020-24941 was fixed upstream. The vulnerability affected Laravel <6.18.35 and 7.x <7.24.0. The fix (commit 897d107) was applied on August 7, 2020, before Laravel 8.0's September 2020 release. Version 8.12.1 shipped with the fix already present: the isGuardableColumn() method validates attribute keys against actual database columns, preventing the JSON column nesting bypass. The vulnerable pattern (stripping '->' before guard checks) is not present. This is an upstream fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "Laravel 8.12.1 was released after CVE-2020-24941 was fixed upstream. The vulnerability affected Laravel <6.18.35 and 7.x <7.24.0. The fix (commit 897d107) was applied on August 7, 2020, before Laravel 8.0's September 2020 release. Version 8.12.1 shipped with the fix already present: the isGuardableColumn() method validates attribute keys against actual database columns, preventing the JSON column nesting bypass. The vulnerable pattern (stripping '->' before guard checks) is not present. This is an upstream fix, not a TuxCare backport." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:35:46.395275+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.1-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:35:46.395275+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.1-p6+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:35:46.395275+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.1-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:35:46.395275+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.1-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:35:46.395275+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.1-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:35:46.395275+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.1-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer that uses Tippy.js tooltips with allowHTML enabled. Laravel 8.x uses a completely different exception rendering system (Whoops library from filp/whoops) and does not contain the vulnerable code. The Tippy.js-based exception renderer infrastructure does not exist in this versio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer that uses Tippy.js tooltips with allowHTML enabled. Laravel 8.x uses a completely different exception rendering system (Whoops library from filp/whoops) and does not contain the vulnerable code. The Tippy.js-based exception renderer infrastructure does not exist in this versio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:35:46.395275+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.1-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 11/12. Version 8.12.1 predates this feature entirely - it only has basic JsonResource with no include parameter processing or relationship compilation logic. The entire vulnerable code path is absent f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 11/12. Version 8.12.1 predates this feature entirely - it only has basic JsonResource with no include parameter processing or relationship compilation logic. The entire vulnerable code path is absent f..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:38:00.180821+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 8.12.1-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:35:46.395275+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.1-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:35:46.395275+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.1-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:35:46.395275+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.1-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via unsafe cookie deserialization). The vulnerability affected Laravel 5.6.x prior to 5.6.30 and was fixed in August 2018 by disabling cookie serialization. Laravel 8.12.1 (released December 2020) already contains the fix in its upstream release: `protected static $serialize = false` in EncryptCookies.php globally disab...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via unsafe cookie deserialization). The vulnerability affected Laravel 5.6.x prior to 5.6.30 and was fixed in August 2018 by disabling cookie serialization. Laravel 8.12.1 (released December 2020) already contains the fix in its upstream release: `protected static $serialize = false` in EncryptCookies.php globally disab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:35:46.395275+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.1-p6+tuxcare of laravel/framework. not_affected \u2014 The Laravel Encrypter IV length validation vulnerability (GHSA-7852-w36x-6mf6) is NOT present in this target. The fix was included in upstream Laravel 8.12.1 (released December 2020) and imported via snapshot commit 4993dfe2ac. The validPayload method at lines 211-215 of src/Illuminate/Encryption/Encrypter.php contains the exact IV length validation (line 214: strlen(base64_decode($payload['iv'...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The Laravel Encrypter IV length validation vulnerability (GHSA-7852-w36x-6mf6) is NOT present in this target. The fix was included in upstream Laravel 8.12.1 (released December 2020) and imported via snapshot commit 4993dfe2ac. The validPayload method at lines 211-215 of src/Illuminate/Encryption/Encrypter.php contains the exact IV length validation (line 214: strlen(base64_decode($payload['iv'..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:35:46.395275+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.1-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns ambiguous URL parsing in local filesystem temporary signed URLs, but Laravel 8.x does not have the local filesystem signed URL feature. The temporaryUrl() method throws RuntimeException for local storage adapters. This feature was introduced in Laravel 11+/12.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns ambiguous URL parsing in local filesystem temporary signed URLs, but Laravel 8.x does not have the local filesystem signed URL feature. The temporaryUrl() method throws RuntimeException for local storage adapters. This feature was introduced in Laravel 11+/12.x." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:35:46.395275+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.1-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:35:46.395275+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.1-p6+tuxcare of laravel/framework. Target version 8.12.1-p5+tuxcare is NOT AFFECTED. The encryption oracle vulnerability (GHSA-qm5c-m76r-2hfr) was fixed in upstream Laravel framework on July 27, 2020, when Taylor Otwell replaced the unkeyed sha1() cookie prefix with a keyed HMAC via the CookieValuePrefix class. Laravel 8.12.1 was released November 5, 2020, four months AFTER the fix, so the vulnerable pattern is not present in the onboarded upstream release. The target uses CookieValuePrefix::create() with hash_hmac('sha1', $cookieName.'v2', $key), making cookie prefixes unforgeable without the encryption key.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Target version 8.12.1-p5+tuxcare is NOT AFFECTED. The encryption oracle vulnerability (GHSA-qm5c-m76r-2hfr) was fixed in upstream Laravel framework on July 27, 2020, when Taylor Otwell replaced the unkeyed sha1() cookie prefix with a keyed HMAC via the CookieValuePrefix class. Laravel 8.12.1 was released November 5, 2020, four months AFTER the fix, so the vulnerable pattern is not present in the onboarded upstream release. The target uses CookieValuePrefix::create() with hash_hmac('sha1', $cookieName.'v2', $key), making cookie prefixes unforgeable without the encryption key." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:35:46.395275+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.1-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:35:46.395275+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.1-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:42:36.259019+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.3-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2017-14775. The vulnerability concerned non-constant-time token comparison in remember_me token verification, which was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.3 (released in 2021) already includes the upstream fix using hash_equals() for constant-time comparison in both DatabaseUserProvider and EloquentUserProvider. The fix came w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2017-14775. The vulnerability concerned non-constant-time token comparison in remember_me token verification, which was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.3 (released in 2021) already includes the upstream fix using hash_equals() for constant-time comparison in both DatabaseUserProvider and EloquentUserProvider. The fix came w..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:42:36.259019+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.3-p7+tuxcare of laravel/framework. CVE-2018-15133 is NOT present in this target. The vulnerability involved remote code execution via PHP object injection when decrypted cookie values (especially X-XSRF-TOKEN) were passed through unserialize(). The upstream Laravel fix (August 2018, commit 97467e3ca by Taylor Otwell) disabled serialization for all cookies by setting `protected static $serialize = false` and passing `false` to all decrypt() calls. This fix was already included in Laravel v8.12.3 (December 2020) when TuxCare onboarded it via snapshot commit 90eb977a3b. The target code at HEAD (8.12.3-p5+tuxcare) contains this upstream fix: EncryptCookies.php line 34 sets `$serialize = false`, and Encrypter.php line 151 returns decrypted values directly without calling unserialize() when the flag is false. The vulnerable pattern (unserialization of decrypted cookies) does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 is NOT present in this target. The vulnerability involved remote code execution via PHP object injection when decrypted cookie values (especially X-XSRF-TOKEN) were passed through unserialize(). The upstream Laravel fix (August 2018, commit 97467e3ca by Taylor Otwell) disabled serialization for all cookies by setting `protected static $serialize = false` and passing `false` to all decrypt() calls. This fix was already included in Laravel v8.12.3 (December 2020) when TuxCare onboarded it via snapshot commit 90eb977a3b. The target code at HEAD (8.12.3-p5+tuxcare) contains this upstream fix: EncryptCookies.php line 34 sets `$serialize = false`, and Encrypter.php line 151 returns decrypted values directly without calling unserialize() when the flag is false. The vulnerable pattern (unserialization of decrypted cookies) does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:42:36.259019+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 8.12.3-p7+tuxcare of laravel/framework. Laravel Framework 8.12.3 is not affected by CVE-2019-9081. While the PendingCommand class with its __destruct method exists and can execute commands when unserialized, there is no reachable attack path in Laravel's own code where attacker-controlled serialized data reaches unserialize(). The framework's unserialize() calls (e.g., Session/Store.php:98) operate on server-side data that is not directly controllable by attackers in default configuration. This is a gadget-chain component that requires an application-level unserialize vulnerability to be exploitable, not a framework vulnerability.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "Laravel Framework 8.12.3 is not affected by CVE-2019-9081. While the PendingCommand class with its __destruct method exists and can execute commands when unserialized, there is no reachable attack path in Laravel's own code where attacker-controlled serialized data reaches unserialize(). The framework's unserialize() calls (e.g., Session/Store.php:98) operate on server-side data that is not directly controllable by attackers in default configuration. This is a gadget-chain component that requires an application-level unserialize vulnerability to be exploitable, not a framework vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:42:36.259019+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.3-p7+tuxcare of laravel/framework. The target Laravel Framework 8.12.3 is NOT AFFECTED by CVE-2020-19316 (OS command injection in Filesystem.php link() function). The vulnerability was fixed upstream by Taylor Otwell in commit 44c3feb604 (May 2019, Laravel 5.8.17). The fix wraps both $link and $target parameters with escapeshellarg() before passing to the Windows mklink shell command. Laravel 8.12.3 (released December 2020) already includes this fix. Line 320 of src/Illuminate/Filesystem/Filesystem.php shows: exec(\"mklink /{$mode} \".escapeshellarg($link).' '.escapeshellarg($target)); This protection prevents shell metacharacters from being interpreted as command injection sequences. The fix shipped in the upstream release that TuxCare onboarded via snapshot commit 90eb977a3b.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target Laravel Framework 8.12.3 is NOT AFFECTED by CVE-2020-19316 (OS command injection in Filesystem.php link() function). The vulnerability was fixed upstream by Taylor Otwell in commit 44c3feb604 (May 2019, Laravel 5.8.17). The fix wraps both $link and $target parameters with escapeshellarg() before passing to the Windows mklink shell command. Laravel 8.12.3 (released December 2020) already includes this fix. Line 320 of src/Illuminate/Filesystem/Filesystem.php shows: exec(\"mklink /{$mode} \".escapeshellarg($link).' '.escapeshellarg($target)); This protection prevents shell metacharacters from being interpreted as command injection sequences. The fix shipped in the upstream release that TuxCare onboarded via snapshot commit 90eb977a3b." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:42:36.259019+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.3-p7+tuxcare of laravel/framework. CVE-2020-24941 affects Laravel versions before 6.18.35 and 7.x before 7.24.0. The target repository is Laravel 8.12.3-p5+tuxcare, which was released after the CVE was fixed upstream (August 2020). The vulnerability pattern is not present in the target because the fix was already included in the upstream Laravel 8.12.3 release that TuxCare snapshotted. The GuardsAttributes.php file contains the isGuardableColumn() method and the fixed isGuarded() logic that validates attribute keys against actual database columns, preventing the mass-assignment bypass that the CVE describes.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 affects Laravel versions before 6.18.35 and 7.x before 7.24.0. The target repository is Laravel 8.12.3-p5+tuxcare, which was released after the CVE was fixed upstream (August 2020). The vulnerability pattern is not present in the target because the fix was already included in the upstream Laravel 8.12.3 release that TuxCare snapshotted. The GuardsAttributes.php file contains the isGuardableColumn() method and the fixed isGuarded() logic that validates attribute keys against actual database columns, preventing the mass-assignment bypass that the CVE describes." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:42:36.259019+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.3-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:42:36.259019+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.3-p7+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:42:36.259019+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.3-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:42:36.259019+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.3-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:42:36.259019+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.3-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:42:36.259019+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.3-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:42:36.259019+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.3-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-114508. The vulnerable JsonApi resources feature was introduced in Laravel 12.45.0, approximately 4 major versions after the target version. The entire JsonApi resources module, including the ResolvesJsonApiElements trait and sparseIncluded() method processing, does not exist in Laravel 8.x. The vulnerability requires processing HTTP query parameters w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-114508. The vulnerable JsonApi resources feature was introduced in Laravel 12.45.0, approximately 4 major versions after the target version. The entire JsonApi resources module, including the ResolvesJsonApiElements trait and sparseIncluded() method processing, does not exist in Laravel 8.x. The vulnerability requires processing HTTP query parameters w..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:42:36.259019+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 8.12.3-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:42:36.259019+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.3-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:42:36.259019+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.3-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:42:36.259019+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.3-p7+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 8.12.3 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie unserialization). The vulnerability affected Laravel 5.6.30 (August 2018) and was fixed by disabling PHP object serialization in cookie encryption. Laravel 8.12.3 (December 2020) shipped with this protection already in place: EncryptCookies uses `static $serialize = false` to prevent object unseria...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel 8.12.3 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie unserialization). The vulnerability affected Laravel 5.6.30 (August 2018) and was fixed by disabling PHP object serialization in cookie encryption. Laravel 8.12.3 (December 2020) shipped with this protection already in place: EncryptCookies uses `static $serialize = false` to prevent object unseria..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:42:36.259019+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.3-p7+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v8.12.3 is not affected by GHSA-7852-w36x-6mf6 (Laravel Encrypter IV length validation bypass). The vulnerability pattern is absent because the upstream fix was already present in Laravel v8.12.3 when TuxCare onboarded it. The validPayload() method includes IV length validation that prevents manipulated payloads from causing false-return decryption failures exploita...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework v8.12.3 is not affected by GHSA-7852-w36x-6mf6 (Laravel Encrypter IV length validation bypass). The vulnerability pattern is absent because the upstream fix was already present in Laravel v8.12.3 when TuxCare onboarded it. The validPayload() method includes IV length validation that prevents manipulated payloads from causing false-return decryption failures exploita..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:42:36.259019+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.3-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:42:36.259019+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.3-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:42:36.259019+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.3-p7+tuxcare of laravel/framework. Laravel framework 8.12.3-p5+tuxcare is not affected by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The vulnerability required using predictable sha1() hashes for cookie prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The target already contains the upstream security fix that replaced sha1() with hash_hmac() using the application's secret key, making cookie prefixes unguessable. This fix was shipped in upstream Laravel 8.12.3 (released October 29, 2020) before TuxCare began maintaining this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel framework 8.12.3-p5+tuxcare is not affected by GHSA-qm5c-m76r-2hfr (cookie encryption oracle RCE). The vulnerability required using predictable sha1() hashes for cookie prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The target already contains the upstream security fix that replaced sha1() with hash_hmac() using the application's secret key, making cookie prefixes unguessable. This fix was shipped in upstream Laravel 8.12.3 (released October 29, 2020) before TuxCare began maintaining this version." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:42:36.259019+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.3-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.3-p7+tuxcare" } } ], "timestamp": "2026-11-04T11:42:36.259019+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.3-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T13:22:39.175896+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 6.20.45-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 6.20.45-p6+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:45:39.779746+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 6.20.45-p6+tuxcare of laravel/framework. CVE-2018-15133 is NOT present in Laravel 6.20.45-p6+tuxcare. The vulnerability (RCE via unserialize on X-XSRF-TOKEN) was fixed in upstream Laravel 5.6.30/5.5.41 (August 2018) by disabling cookie serialization. The fix (protected static $serialize = false; using static::serialized() in decrypt calls) was already present when Laravel 6.20.45 was released and onboarded by TuxCare. The vulnerable code pattern does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 is NOT present in Laravel 6.20.45-p6+tuxcare. The vulnerability (RCE via unserialize on X-XSRF-TOKEN) was fixed in upstream Laravel 5.6.30/5.5.41 (August 2018) by disabling cookie serialization. The fix (protected static $serialize = false; using static::serialized() in decrypt calls) was already present when Laravel 6.20.45 was released and onboarded by TuxCare. The vulnerable code pattern does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 6.20.45-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 6.20.45-p6+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 6.20.45-p6+tuxcare of laravel/framework. The target Laravel Framework 6.20.45 is NOT vulnerable to CVE-2020-19316. The vulnerable code pattern (unescaped parameters in Windows mklink exec call) is not present. The fix using escapeshellarg() was already included in the upstream Laravel v6.20.45 release that TuxCare onboarded. The vulnerability affected Laravel before 5.8.17 (patched May 2019), and version 6.20.45 already contains the upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target Laravel Framework 6.20.45 is NOT vulnerable to CVE-2020-19316. The vulnerable code pattern (unescaped parameters in Windows mklink exec call) is not present. The fix using escapeshellarg() was already included in the upstream Laravel v6.20.45 release that TuxCare onboarded. The vulnerability affected Laravel before 5.8.17 (patched May 2019), and version 6.20.45 already contains the upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:42:21.835037+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 6.20.45-p6+tuxcare of laravel/framework. The target Laravel framework version 6.20.45-p6+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability (mass assignment bypass via non-existent column names) was fixed in upstream Laravel v6.18.35 (commit 897d107775 by Taylor Otwell). The target version 6.20.45 already contains this fix, which validates that attribute keys exist as actual database columns via the isGuardableColumn() method. The fix was shipped in the upstream release and onboarded to TuxCare via snapshot commit abbc62d18a. The vulnerable pattern (allowing mass assignment to arbitrary non-column attributes) is not present in the target code.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel framework version 6.20.45-p6+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability (mass assignment bypass via non-existent column names) was fixed in upstream Laravel v6.18.35 (commit 897d107775 by Taylor Otwell). The target version 6.20.45 already contains this fix, which validates that attribute keys exist as actual database columns via the isGuardableColumn() method. The fix was shipped in the upstream release and onboarded to TuxCare via snapshot commit abbc62d18a. The vulnerable pattern (allowing mass assignment to arbitrary non-column attributes) is not present in the target code." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 6.20.45-p6+tuxcare of laravel/framework. CVE-2021-21263 affects Laravel versions <6.20.12. The target is version 6.20.45, which includes the upstream fix that prevents query binding exploitation. The vulnerability allowed array values to be passed to query builder methods where scalar values were expected, causing incorrect binding counts and corrupted query results. The target contains comprehensive protections using a `flattenValue()` helper method across all affected methods (where, having, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, whereBetween). The fix was present in the upstream v6.20.45 release and was imported via TuxCare's snapshot commit abbc62d18a, with no subsequent modifications to the query builder.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "CVE-2021-21263 affects Laravel versions <6.20.12. The target is version 6.20.45, which includes the upstream fix that prevents query binding exploitation. The vulnerability allowed array values to be passed to query builder methods where scalar values were expected, causing incorrect binding counts and corrupted query results. The target contains comprehensive protections using a `flattenValue()` helper method across all affected methods (where, having, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, whereBetween). The fix was present in the upstream v6.20.45 release and was imported via TuxCare's snapshot commit abbc62d18a, with no subsequent modifications to the query builder." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T13:22:39.175896+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 6.20.45-p6+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T21:30:41.069534+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 6.20.45-p6+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 6.20.45-p6+tuxcare of laravel/framework. The target repository (Laravel framework 6.20.45-p6+tuxcare) is not affected by CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled, allowing attackers to control environment detection through $_SERVER['argv']. The fix adds a runningInConsole() check before using argv values. This fix was already present in the upstream Laravel v6.20.45 release (authored by Taylor Otwell, taylor@laravel.com, Nov 2024) before TuxCare created their snapshot. The TuxCare branch started from a snapshot of v6.20.45 (commit abbc62d18a) which already contained the fixed code. No TuxCare backport was necessary as the vulnerable code pattern never existed in this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target repository (Laravel framework 6.20.45-p6+tuxcare) is not affected by CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled, allowing attackers to control environment detection through $_SERVER['argv']. The fix adds a runningInConsole() check before using argv values. This fix was already present in the upstream Laravel v6.20.45 release (authored by Taylor Otwell, taylor@laravel.com, Nov 2024) before TuxCare created their snapshot. The TuxCare branch started from a snapshot of v6.20.45 (commit abbc62d18a) which already contained the fixed code. No TuxCare backport was necessary as the vulnerable code pattern never existed in this branch." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T13:22:39.175896+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 6.20.45-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T13:22:39.175896+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 6.20.45-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 6.20.45-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:46:15.891205+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 6.20.45-p6+tuxcare of laravel/framework, and is fixed in 6.20.45-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 6.20.45-p6+tuxcare of laravel/framework, and is fixed in 6.20.45-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T20:50:01.681995+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 6.20.45-p6+tuxcare of laravel/framework. not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T13:22:39.175896+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 6.20.45-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T21:05:58.501817+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 6.20.45-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 6.20.45-p6+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T13:22:39.175896+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 6.20.45-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 6.20.45-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:19:00.105438+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 6.20.45-p6+tuxcare of laravel/framework. Laravel Framework 6.20.45 is not affected by GHSA-qm5c-m76r-2hfr (encryption oracle RCE via cookie session driver). The vulnerability was fixed by upstream Laravel in version 6.18.31 on July 27, 2020, by replacing predictable SHA1 hash prefixes with keyed HMAC values in cookie encryption. Version 6.20.45 was released after this fix and already includes the CookieValuePrefix class with hash_hmac() implementation. The target contains the secure code pattern, not the vulnerable one.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel Framework 6.20.45 is not affected by GHSA-qm5c-m76r-2hfr (encryption oracle RCE via cookie session driver). The vulnerability was fixed by upstream Laravel in version 6.18.31 on July 27, 2020, by replacing predictable SHA1 hash prefixes with keyed HMAC values in cookie encryption. Version 6.20.45 was released after this fix and already includes the CookieValuePrefix class with hash_hmac() implementation. The target contains the secure code pattern, not the vulnerable one." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 6.20.45-p6+tuxcare of laravel/framework. not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:42:21.835037+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 6.20.45-p6+tuxcare of laravel/framework. The target repository (Laravel 6.20.45) is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involving unexpected query bindings from array values has already been fixed in the upstream Laravel release v6.20.11 (Jan 13, 2021) and v6.20.14 (Jan 21, 2021), which were released well before v6.20.45. All query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the `flattenValue()` helper method to extract scalar values from array inputs, preventing the SQL binding mismatch vulnerability. The fix was authored by Taylor Otwell for the upstream Laravel framework and was included in the v6.20.45 release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "The target repository (Laravel 6.20.45) is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involving unexpected query bindings from array values has already been fixed in the upstream Laravel release v6.20.11 (Jan 13, 2021) and v6.20.14 (Jan 21, 2021), which were released well before v6.20.45. All query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the `flattenValue()` helper method to extract scalar values from array inputs, preventing the SQL binding mismatch vulnerability. The fix was authored by Taylor Otwell for the upstream Laravel framework and was included in the v6.20.45 release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.2-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.2 (released December 2020) inherited the fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time compa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.2 (released December 2020) inherited the fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time compa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.2-p4+tuxcare of laravel/framework. CVE-2018-15133 describes a PHP deserialization vulnerability in Laravel's cookie decryption, allowing remote code execution via crafted X-XSRF-TOKEN values when the attacker knows the application key. The target version 8.12.2 already contains the upstream fix that disables automatic unserialization of decrypted cookie data. The fix sets static $serialize = false by default and passes this flag through the entire encryption/decryption chain (EncryptCookies::serialized() \u2192 VerifyCsrfToken::decrypt() \u2192 Encrypter::decrypt()), preventing unserialize() from being called on attacker-controlled data. The vulnerability was patched by Laravel in August 2018; version 8.12.2 (released 2020) included the fix when onboarded via snapshot commit 58ccc3bfb7 by contact@bikramlama.com.np, prior to any TuxCare involvement.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 describes a PHP deserialization vulnerability in Laravel's cookie decryption, allowing remote code execution via crafted X-XSRF-TOKEN values when the attacker knows the application key. The target version 8.12.2 already contains the upstream fix that disables automatic unserialization of decrypted cookie data. The fix sets static $serialize = false by default and passes this flag through the entire encryption/decryption chain (EncryptCookies::serialized() \u2192 VerifyCsrfToken::decrypt() \u2192 Encrypter::decrypt()), preventing unserialize() from being called on attacker-controlled data. The vulnerability was patched by Laravel in August 2018; version 8.12.2 (released 2020) included the fix when onboarded via snapshot commit 58ccc3bfb7 by contact@bikramlama.com.np, prior to any TuxCare involvement." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 8.12.2-p4+tuxcare of laravel/framework. Laravel Framework 8.12.2-p5+tuxcare contains the PendingCommand deserialization gadget (__destruct method at line 340-347) that CVE-2019-9081 describes. However, this version is not exploitable in default configuration because: (1) File-based sessions store data server-side in storage/framework/sessions/ which attackers cannot directly modify; (2) Cookie-based sessions use JSON encoding (CookieSessionHandler lines 71, 85), not PHP serialization; (3) Cache data is server-side; (4) No code path exists for attacker-controlled serialized data to reach unserialize() calls in Session\\Store (line 98) or Cache stores (FileStore line 223) without a separate vulnerability. The CVE states the vulnerability exists \"if the content is controllable\" - in default Laravel 8.12.2, serialized content is NOT attacker-controllable. While the gadget chain exists and could be exploited in combination with file upload vulnerabilities, shared hosting scenarios, or custom code that unserializes user input, these require non-default configurations or separate vulnerabilities beyond CVE-2019-9081's scope.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "Laravel Framework 8.12.2-p5+tuxcare contains the PendingCommand deserialization gadget (__destruct method at line 340-347) that CVE-2019-9081 describes. However, this version is not exploitable in default configuration because: (1) File-based sessions store data server-side in storage/framework/sessions/ which attackers cannot directly modify; (2) Cookie-based sessions use JSON encoding (CookieSessionHandler lines 71, 85), not PHP serialization; (3) Cache data is server-side; (4) No code path exists for attacker-controlled serialized data to reach unserialize() calls in Session\\Store (line 98) or Cache stores (FileStore line 223) without a separate vulnerability. The CVE states the vulnerability exists \"if the content is controllable\" - in default Laravel 8.12.2, serialized content is NOT attacker-controllable. While the gadget chain exists and could be exploited in combination with file upload vulnerabilities, shared hosting scenarios, or custom code that unserializes user input, these require non-default configurations or separate vulnerabilities beyond CVE-2019-9081's scope." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.2-p4+tuxcare of laravel/framework. The target laravel/framework version 8.12.2 is not affected by CVE-2020-19316. The vulnerability (OS command injection in the Filesystem::link() method) was fixed upstream by Taylor Otwell in May 2019 (commit 44c3feb6) for Laravel 5.8.17. The fix adds escapeshellarg() to both the $link and $target parameters before passing them to the exec() call. Since the target version 8.12.2 (released in 2020) is significantly newer than 5.8.17, the fix was already present in the upstream release that TuxCare onboarded via snapshot commit 58ccc3bfb7. The vulnerable code pattern does not exist in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target laravel/framework version 8.12.2 is not affected by CVE-2020-19316. The vulnerability (OS command injection in the Filesystem::link() method) was fixed upstream by Taylor Otwell in May 2019 (commit 44c3feb6) for Laravel 5.8.17. The fix adds escapeshellarg() to both the $link and $target parameters before passing them to the exec() call. Since the target version 8.12.2 (released in 2020) is significantly newer than 5.8.17, the fix was already present in the upstream release that TuxCare onboarded via snapshot commit 58ccc3bfb7. The vulnerable code pattern does not exist in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:41:18.186955+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.2-p4+tuxcare of laravel/framework. CVE-2020-24941 is NOT present in Laravel 8.12.2-p5+tuxcare. The vulnerability affects Laravel before 6.18.35 and 7.x before 7.24.0. The fix was committed to Laravel 6.x on August 7, 2020 (commit 897d107775), before Laravel 8.0.0 was released (September 8, 2020). Laravel 8.12.2 shipped with the fix already included. The target repository's snapshot commit (58ccc3bfb7) by contact@bikramlama.com.np brought in Laravel 8.12.2 with the complete fix: the isGuardableColumn() method validates that attribute keys correspond to actual database columns, preventing mass assignment bypass via non-existent column names.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 is NOT present in Laravel 8.12.2-p5+tuxcare. The vulnerability affects Laravel before 6.18.35 and 7.x before 7.24.0. The fix was committed to Laravel 6.x on August 7, 2020 (commit 897d107775), before Laravel 8.0.0 was released (September 8, 2020). Laravel 8.12.2 shipped with the fix already included. The target repository's snapshot commit (58ccc3bfb7) by contact@bikramlama.com.np brought in Laravel 8.12.2 with the complete fix: the isGuardableColumn() method validates that attribute keys correspond to actual database columns, preventing mass assignment bypass via non-existent column names." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.2-p4+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.2-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer which uses Tippy.js tooltips with allowHTML: true. Laravel 8.12.2 uses a completely different exception rendering system (Whoops/filp/whoops) that does not include Tippy.js or any JavaScript tooltip functionality. The vulnerable component was introduced in Laravel 11.x+, sever...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer which uses Tippy.js tooltips with allowHTML: true. Laravel 8.12.2 uses a completely different exception rendering system (Whoops/filp/whoops) that does not include Tippy.js or any JavaScript tooltip functionality. The vulnerable component was introduced in Laravel 11.x+, sever..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.2-p4+tuxcare of laravel/framework. not_affected \u2014 Target version 8.12.2 predates the introduction of Laravel's JSON:API resource feature by approximately 5 years. The vulnerable code (ResolvesJsonApiElements trait with loadMissing() call) does not exist in this version. JSON:API resources were first introduced in Laravel v12.45.0 (December 2025) via commit 2f309363, while the target is from the 8.x series released around 2020. Exhaustive searc...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Target version 8.12.2 predates the introduction of Laravel's JSON:API resource feature by approximately 5 years. The vulnerable code (ResolvesJsonApiElements trait with loadMissing() call) does not exist in this version. JSON:API resources were first introduced in Laravel v12.45.0 (December 2025) via commit 2f309363, while the target is from the 8.x series released around 2020. Exhaustive searc..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-11-04T11:42:00.096965+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.2-p4+tuxcare of laravel/framework, and is fixed in 8.12.2-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.2-p4+tuxcare of laravel/framework, and is fixed in 8.12.2-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:53:45.635911+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.2-p4+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 8.12.2 is not affected by GHSA-6jvx-8ch9-j2jr (Laravel 5.6.30 cookie deserialization vulnerability). The fix disabling automatic cookie serialization was already present in the upstream Laravel 8.12.2 release, which predates TuxCare's onboarding of this repository. The vulnerable pattern (unsafe cookie deserialization enabling PHP object injection) is absent: EncryptCookies middl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target Laravel 8.12.2 is not affected by GHSA-6jvx-8ch9-j2jr (Laravel 5.6.30 cookie deserialization vulnerability). The fix disabling automatic cookie serialization was already present in the upstream Laravel 8.12.2 release, which predates TuxCare's onboarding of this repository. The vulnerable pattern (unsafe cookie deserialization enabling PHP object injection) is absent: EncryptCookies middl..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.2-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false when IV length is manipulated) was already fixed in the upstream Laravel 8.12.2 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 contains the required IV length validation that matches the vendor ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false when IV length is manipulated) was already fixed in the upstream Laravel 8.12.2 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 contains the required IV length validation that matches the vendor ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.2-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.2 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in Laravel 12.x's LocalFilesystemAdapter class which provides signed URL functionality for local filesystem storage. This feature does not exist in Laravel 8.12.2, which uses a different architecture where local filesystem adapters cannot generate temporary signed URLs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.2 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in Laravel 12.x's LocalFilesystemAdapter class which provides signed URL functionality for local filesystem storage. This feature does not exist in Laravel 8.12.2, which uses a different architecture where local filesystem adapters cannot generate temporary signed URLs." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:14:55.406911+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.2-p4+tuxcare of laravel/framework. Laravel framework 8.12.2 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability involved using plain SHA1 hashes for cookie value prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The fix (using HMAC with the encryption key instead of plain SHA1) was released in Laravel 6.18.31 on July 27, 2020. Laravel 8.0.0 was released on September 8, 2020, after the security fix, so all Laravel 8.x versions including 8.12.2 shipped with the fix from their original upstream release. The target contains CookieValuePrefix class using hash_hmac() at line 16, confirming the fixed pattern is present. The vulnerable pattern (plain sha1) is absent from the codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel framework 8.12.2 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability involved using plain SHA1 hashes for cookie value prefixes, allowing attackers with access to an encryption oracle to forge valid session cookies. The fix (using HMAC with the encryption key instead of plain SHA1) was released in Laravel 6.18.31 on July 27, 2020. Laravel 8.0.0 was released on September 8, 2020, after the security fix, so all Laravel 8.x versions including 8.12.2 shipped with the fix from their original upstream release. The target contains CookieValuePrefix class using hash_hmac() at line 16, confirming the fixed pattern is present. The vulnerable pattern (plain sha1) is absent from the codebase." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.2-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.2-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.7.29-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 due to non-constant-time token comparison in remember_me authentication. Version 5.7.29 was released after the fix (5.5.10) and contains the upstream security patch that replaced database-level string comparison with hash_equals() constant-time comparison in both DatabaseUserProvider and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 due to non-constant-time token comparison in remember_me authentication. Version 5.7.29 was released after the fix (5.5.10) and contains the upstream security patch that replaced database-level string comparison with hash_equals() constant-time comparison in both DatabaseUserProvider and ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.7.29-p3+tuxcare of laravel/framework. CVE-2018-15133 (RCE via unserialize on X-XSRF-TOKEN) is NOT present in Laravel 5.7.29-p4+tuxcare. The vulnerability required automatic deserialization of decrypted cookie data. The upstream fix (commit c0eb9073eb by Taylor Otwell, Aug 2018) disabled serialization by setting `static $serialize = false` and passing it to all encrypt/decrypt operations. Laravel 5.7.29 was released AFTER the fix and already includes it. The TuxCare onboarding (ba2c65e51a) imported the fixed upstream release. All decrypt operations now pass `static::serialized()` which returns `false`, preventing unserialize() from being called on user-controlled data. The vulnerable pattern is absent because the upstream fix shipped in the release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 (RCE via unserialize on X-XSRF-TOKEN) is NOT present in Laravel 5.7.29-p4+tuxcare. The vulnerability required automatic deserialization of decrypted cookie data. The upstream fix (commit c0eb9073eb by Taylor Otwell, Aug 2018) disabled serialization by setting `static $serialize = false` and passing it to all encrypt/decrypt operations. Laravel 5.7.29 was released AFTER the fix and already includes it. The TuxCare onboarding (ba2c65e51a) imported the fixed upstream release. All decrypt operations now pass `static::serialized()` which returns `false`, preventing unserialize() from being called on user-controlled data. The vulnerable pattern is absent because the upstream fix shipped in the release." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-19T13:13:00.129934+00:00", "status_notes": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.7.29-p3+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19).", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.7.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.7.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.7.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.7.29-p3+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.7.29-p3+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.7.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.7.29-p3+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.7.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.7.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.7.29-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework version 5.7.29 is not affected by CVE-2026-102279. This version uses the Whoops library for debug exception rendering, not Laravel's custom exception renderer with Tippy.js tooltips. The vulnerable code path (Tippy.js initialization with `allowHTML: true` for `data-tippy-content` elements) does not exist in version 5.7.29. The custom Laravel exception renderer was introduced i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel Framework version 5.7.29 is not affected by CVE-2026-102279. This version uses the Whoops library for debug exception rendering, not Laravel's custom exception renderer with Tippy.js tooltips. The vulnerable code path (Tippy.js initialization with `allowHTML: true` for `data-tippy-content` elements) does not exist in version 5.7.29. The custom Laravel exception renderer was introduced i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.7.29-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources feature, which was introduced in Laravel 12.x (December 2025). Laravel 5.7.29 predates this feature by approximately 6 years and 5+ major versions. The target version contains only the older Json resources (not JsonApi) which do not process relationship inclusion parameters from URLs, making th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources feature, which was introduced in Laravel 12.x (December 2025). Laravel 5.7.29 predates this feature by approximately 6 years and 5+ major versions. The target version contains only the older Json resources (not JsonApi) which do not process relationship inclusion parameters from URLs, making th..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:45:00.074275+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.7.29-p3+tuxcare of laravel/framework, and is fixed in 5.7.29-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.7.29-p3+tuxcare of laravel/framework, and is fixed in 5.7.29-p5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.7.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.7.29-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 uses SwiftMailer, not Symfony Mailer. The GHSA-5vg9-5847-vvmq vulnerability specifically requires Symfony Mailer's handling of CRLF sequences. SwiftMailer employs EmailValidator which rejects CRLF in email addresses, breaking the attack chain.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 uses SwiftMailer, not Symfony Mailer. The GHSA-5vg9-5847-vvmq vulnerability specifically requires Symfony Mailer's handling of CRLF sequences. SwiftMailer employs EmailValidator which rejects CRLF in email addresses, breaking the attack chain." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:52:18.183384+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.7.29-p3+tuxcare of laravel/framework. not_affected \u2014 Target repository Laravel 5.7.29-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The fix for this vulnerability was already present in the upstream Laravel 5.7.29 release (September 2018), which shipped after the vulnerability was fixed in Laravel 5.6.30 (August 2018). The target's cookie encryption middleware disables serialization for all cookies via ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target repository Laravel 5.7.29-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The fix for this vulnerability was already present in the upstream Laravel 5.7.29 release (September 2018), which shipped after the vulnerability was fixed in Laravel 5.6.30 (August 2018). The target's cookie encryption middleware disables serialization for all cookies via ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.7.29-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 5.7.29 code is not affected by GHSA-7852-w36x-6mf6. The IV length validation fix (checking that base64-decoded IV length matches openssl_cipher_iv_length) is already present in the Encrypter.php validPayload() method at line 210. This fix was included in the upstream Laravel 5.7.29 release (authored by Taylor Otwell in March 2018, before Laravel 5.7 was released in September ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel 5.7.29 code is not affected by GHSA-7852-w36x-6mf6. The IV length validation fix (checking that base64-decoded IV length matches openssl_cipher_iv_length) is already present in the Encrypter.php validPayload() method at line 210. This fix was included in the upstream Laravel 5.7.29 release (authored by Taylor Otwell in March 2018, before Laravel 5.7 was released in September ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.7.29-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 does not support temporary signed URLs for local filesystem storage. The vulnerable feature (LocalFilesystemAdapter with temporaryUrl/temporaryUploadUrl methods) does not exist in this version. The FilesystemAdapter::temporaryUrl() method explicitly throws RuntimeException when used with LocalAdapter.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 does not support temporary signed URLs for local filesystem storage. The vulnerable feature (LocalFilesystemAdapter with temporaryUrl/temporaryUploadUrl methods) does not exist in this version. The FilesystemAdapter::temporaryUrl() method explicitly throws RuntimeException when used with LocalAdapter." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.7.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.7.29-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.7.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.7.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.7.29-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.7.29-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-7809 does not affect version v2.15.6-p1+tuxcare of twig/twig. already_fixed \u2014 CVE-2015-7809 affects Twig before version 1.20.0. The target repository is running Twig 2.15.6, which is significantly newer than the vulnerable versions. The security fix that prevents arbitrary code execution via the _self variable in Sandbox mode is present in the target code at src/Template.php lines 175-178, with explicit documentation ('avoid RCEs when sandbox is enabled') and test coverage.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-7809" }, "impact_statement": "already_fixed \u2014 CVE-2015-7809 affects Twig before version 1.20.0. The target repository is running Twig 2.15.6, which is significantly newer than the vulnerable versions. The security fix that prevents arbitrary code execution via the _self variable in Sandbox mode is present in the target code at src/Template.php lines 175-178, with explicit documentation ('avoid RCEs when sandbox is enabled') and test coverage." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2019-9942 does not affect version v2.15.6-p1+tuxcare of twig/twig. already_fixed \u2014 CVE-2019-9942 was fixed in Twig version 2.7.0 (released 2019-03-12). The target version 2.15.6 (released 2023-11-21) already contains the complete fix. The vulnerability allowed calling __toString() on objects in sandbox mode even when not allowed by the security policy. The fix introduces ensureToStringAllowed() method and CheckToStringNode wrapping mechanism that validates all implicit __toSt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-9942" }, "impact_statement": "already_fixed \u2014 CVE-2019-9942 was fixed in Twig version 2.7.0 (released 2019-03-12). The target version 2.15.6 (released 2023-11-21) already contains the complete fix. The vulnerability allowed calling __toString() on objects in sandbox mode even when not allowed by the security policy. The fix introduces ensureToStringAllowed() method and CheckToStringNode wrapping mechanism that validates all implicit __toSt..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2022-23614 does not affect version v2.15.6-p1+tuxcare of twig/twig. CVE-2022-23614 fix is already present in target v2.15.6-p2+tuxcare. The vulnerability allowed arbitrary PHP function execution via non-Closure callables in the sort filter's arrow parameter when sandbox mode is enabled. The fix adds validation (twig_check_arrow_in_sandbox) to enforce Closure-only callables in sandbox mode. This fix was authored by Fabien Potencier in upstream Twig v2.14.11 (2022-02-04) and was already present in upstream v2.15.6 when TuxCare onboarded it via snapshot commit 24b89969d.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-23614" }, "impact_statement": "CVE-2022-23614 fix is already present in target v2.15.6-p2+tuxcare. The vulnerability allowed arbitrary PHP function execution via non-Closure callables in the sort filter's arrow parameter when sandbox mode is enabled. The fix adds validation (twig_check_arrow_in_sandbox) to enforce Closure-only callables in sandbox mode. This fix was authored by Fabien Potencier in upstream Twig v2.14.11 (2022-02-04) and was already present in upstream v2.15.6 when TuxCare onboarded it via snapshot commit 24b89969d." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2022-39261 does not affect version v2.15.6-p1+tuxcare of twig/twig. Target version v2.15.6 is NOT AFFECTED by CVE-2022-39261. The path traversal vulnerability in Twig's FilesystemLoader was fixed in upstream Twig v2.15.3 (released 2022-09-28). The target is based on upstream v2.15.6, which already contains the fix. The vulnerable code pattern (validating template name before parsing namespace) is not present; instead, the fixed pattern (validating after parsing) is present at src/Loader/FilesystemLoader.php lines 209-211.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-39261" }, "impact_statement": "Target version v2.15.6 is NOT AFFECTED by CVE-2022-39261. The path traversal vulnerability in Twig's FilesystemLoader was fixed in upstream Twig v2.15.3 (released 2022-09-28). The target is based on upstream v2.15.6, which already contains the fix. The vulnerable code pattern (validating template name before parsing namespace) is not present; instead, the fixed pattern (validating after parsing) is present at src/Loader/FilesystemLoader.php lines 209-211." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45411 is fixed in version v2.15.6-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-45411" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51754 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2024-51754" }, "action_statement": "Vulnerability CVE-2024-51754 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-51755 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2024-51755" }, "action_statement": "Vulnerability CVE-2024-51755 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2026-24425 does not affect version v2.15.6-p1+tuxcare of twig/twig. CVE-2026-24425 requires SourcePolicyInterface for exploitation, which does not exist in v2.15.6-p2+tuxcare. The vulnerable code pattern (calling isSandboxed() without Source parameter at CoreExtension.php:1714) exists but only becomes exploitable with SourcePolicyInterface. In v2.15.6, the existing sandbox mechanisms (global sandboxing and {% sandbox %} tag) work correctly with the current code. SourcePolicyInterface was added to Twig 2.x in December 2023 (commit a4974b29a, first in v2.16.0), after v2.15.6 was released (November 2023). The fix commits c8dfd6206 and d0579eded are not ancestors of HEAD.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24425" }, "impact_statement": "CVE-2026-24425 requires SourcePolicyInterface for exploitation, which does not exist in v2.15.6-p2+tuxcare. The vulnerable code pattern (calling isSandboxed() without Source parameter at CoreExtension.php:1714) exists but only becomes exploitable with SourcePolicyInterface. In v2.15.6, the existing sandbox mechanisms (global sandboxing and {% sandbox %} tag) work correctly with the current code. SourcePolicyInterface was added to Twig 2.x in December 2023 (commit a4974b29a, first in v2.16.0), after v2.15.6 was released (November 2023). The fix commits c8dfd6206 and d0579eded are not ancestors of HEAD." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46628 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-46628" }, "action_statement": "Vulnerability CVE-2026-46628 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46633 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-46633" }, "action_statement": "Vulnerability CVE-2026-46633 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:19:23.616509+00:00", "status_notes": "Vulnerability CVE-2026-46634 does not affect version v2.15.6-p1+tuxcare of twig/twig. CVE-2026-46634 describes a sandbox bypass specific to Twig 3.x when using SourcePolicyInterface for per-template sandboxing. The vulnerability occurs because templates created via template_from_string() get synthesized names (__string_template__) that SourcePolicyInterface doesn't recognize, causing sandbox checks to be skipped.\n\nTarget version 2.15.6 does NOT have SourcePolicyInterface (introduced in Twig 3.x). In v2.15.6, sandboxing is controlled by runtime state (SandboxExtension::isSandboxed()) via global configuration or {% sandbox %} tags, NOT by template names/paths. The synthesized template name has no effect on sandbox enforcement.\n\nTests in the target (SandboxTest.php lines 130-154) confirm that templates from template_from_string ARE properly sandboxed in v2.15.6. The attack chain described in the CVE cannot manifest in this architecture.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-46634" }, "impact_statement": "CVE-2026-46634 describes a sandbox bypass specific to Twig 3.x when using SourcePolicyInterface for per-template sandboxing. The vulnerability occurs because templates created via template_from_string() get synthesized names (__string_template__) that SourcePolicyInterface doesn't recognize, causing sandbox checks to be skipped.\n\nTarget version 2.15.6 does NOT have SourcePolicyInterface (introduced in Twig 3.x). In v2.15.6, sandboxing is controlled by runtime state (SandboxExtension::isSandboxed()) via global configuration or {% sandbox %} tags, NOT by template names/paths. The synthesized template name has no effect on sandbox enforcement.\n\nTests in the target (SandboxTest.php lines 130-154) confirm that templates from template_from_string ARE properly sandboxed in v2.15.6. The attack chain described in the CVE cannot manifest in this architecture." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46635 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-46635" }, "action_statement": "Vulnerability CVE-2026-46635 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46638 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-46638" }, "action_statement": "Vulnerability CVE-2026-46638 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:19:23.616509+00:00", "status_notes": "Vulnerability CVE-2026-46640 does not affect version v2.15.6-p1+tuxcare of twig/twig. CVE-2026-46640 affects Twig 3.15.0+ where the obj.(expr) parenthesized dynamic-attribute syntax was introduced. This syntax allows arbitrary expressions after a dot operator, enabling PHP code injection when used with _self or import aliases due to unchecked string concatenation in MacroReferenceExpression. Twig v2.15.6 does not support this syntax\u2014the parser (ExpressionParser.php:490-492) explicitly rejects parentheses after dots, throwing \"Expected name or number, got value '(' of type punctuation.\" The vulnerable MacroReferenceExpression class does not exist in 2.x. While 2.x handles macro calls via MethodCallExpression, it properly escapes method names through repr()->string() using addcslashes(), preventing code injection. The target predates the vulnerable feature by multiple major versions.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-46640" }, "impact_statement": "CVE-2026-46640 affects Twig 3.15.0+ where the obj.(expr) parenthesized dynamic-attribute syntax was introduced. This syntax allows arbitrary expressions after a dot operator, enabling PHP code injection when used with _self or import aliases due to unchecked string concatenation in MacroReferenceExpression. Twig v2.15.6 does not support this syntax\u2014the parser (ExpressionParser.php:490-492) explicitly rejects parentheses after dots, throwing \"Expected name or number, got value '(' of type punctuation.\" The vulnerable MacroReferenceExpression class does not exist in 2.x. While 2.x handles macro calls via MethodCallExpression, it properly escapes method names through repr()->string() using addcslashes(), preventing code injection. The target predates the vulnerable feature by multiple major versions." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-11-04T11:48:00.196671+00:00", "status_notes": "Vulnerability CVE-2026-47730 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-47730" }, "action_statement": "Vulnerability CVE-2026-47730 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47732 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-47732" }, "action_statement": "Vulnerability CVE-2026-47732 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48805 does not affect version v2.15.6-p1+tuxcare of twig/twig. not_affected \u2014 Twig v2.15.6 is not affected by CVE-2026-48805. The vulnerability exists only in Twig 3.26.0+ where architectural changes introduced deprecated wrapper functions in src/Resources/core.php that fail to forward sandbox state to CoreExtension methods. This architectural pattern does not exist in v2.15.6, which uses a different implementation where sandbox enforcement is correctly handled.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48805" }, "impact_statement": "not_affected \u2014 Twig v2.15.6 is not affected by CVE-2026-48805. The vulnerability exists only in Twig 3.26.0+ where architectural changes introduced deprecated wrapper functions in src/Resources/core.php that fail to forward sandbox state to CoreExtension methods. This architectural pattern does not exist in v2.15.6, which uses a different implementation where sandbox enforcement is correctly handled." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48806 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-48806" }, "action_statement": "Vulnerability CVE-2026-48806 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48807 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-48807" }, "action_statement": "Vulnerability CVE-2026-48807 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48808 does not affect version v2.15.6-p1+tuxcare of twig/twig. not_affected \u2014 CVE-2026-48808 does not affect Twig 2.15.6 because it specifically targets a vulnerability in sandboxing enabled through SourcePolicyInterface, which does not exist in this version. The target uses a fundamentally different architecture predating the SourcePolicyInterface feature.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48808" }, "impact_statement": "not_affected \u2014 CVE-2026-48808 does not affect Twig 2.15.6 because it specifically targets a vulnerability in sandboxing enabled through SourcePolicyInterface, which does not exist in this version. The target uses a fundamentally different architecture predating the SourcePolicyInterface feature." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49981 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-49981" }, "action_statement": "Vulnerability CVE-2026-49981 affects version v2.15.6-p1+tuxcare of twig/twig, and is fixed in v2.15.6-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:43:59.818765+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.7.29-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 due to non-constant-time token comparison in remember_me authentication. Version 5.7.29 was released after the fix (5.5.10) and contains the upstream security patch that replaced database-level string comparison with hash_equals() constant-time comparison in both DatabaseUserProvider and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 due to non-constant-time token comparison in remember_me authentication. Version 5.7.29 was released after the fix (5.5.10) and contains the upstream security patch that replaced database-level string comparison with hash_equals() constant-time comparison in both DatabaseUserProvider and ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:43:59.818765+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.7.29-p5+tuxcare of laravel/framework. CVE-2018-15133 (RCE via unserialize on X-XSRF-TOKEN) is NOT present in Laravel 5.7.29-p4+tuxcare. The vulnerability required automatic deserialization of decrypted cookie data. The upstream fix (commit c0eb9073eb by Taylor Otwell, Aug 2018) disabled serialization by setting `static $serialize = false` and passing it to all encrypt/decrypt operations. Laravel 5.7.29 was released AFTER the fix and already includes it. The TuxCare onboarding (ba2c65e51a) imported the fixed upstream release. All decrypt operations now pass `static::serialized()` which returns `false`, preventing unserialize() from being called on user-controlled data. The vulnerable pattern is absent because the upstream fix shipped in the release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 (RCE via unserialize on X-XSRF-TOKEN) is NOT present in Laravel 5.7.29-p4+tuxcare. The vulnerability required automatic deserialization of decrypted cookie data. The upstream fix (commit c0eb9073eb by Taylor Otwell, Aug 2018) disabled serialization by setting `static $serialize = false` and passing it to all encrypt/decrypt operations. Laravel 5.7.29 was released AFTER the fix and already includes it. The TuxCare onboarding (ba2c65e51a) imported the fixed upstream release. All decrypt operations now pass `static::serialized()` which returns `false`, preventing unserialize() from being called on user-controlled data. The vulnerable pattern is absent because the upstream fix shipped in the release." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:43:59.818765+00:00", "status_notes": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.7.29-p5+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19).", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:43:59.818765+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.7.29-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:43:59.818765+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.7.29-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:43:59.818765+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.7.29-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:43:59.818765+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.7.29-p5+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:43:59.818765+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.7.29-p5+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:43:59.818765+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.7.29-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:43:59.818765+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.7.29-p5+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:43:59.818765+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.7.29-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:43:59.818765+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.7.29-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:43:59.818765+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.7.29-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework version 5.7.29 is not affected by CVE-2026-102279. This version uses the Whoops library for debug exception rendering, not Laravel's custom exception renderer with Tippy.js tooltips. The vulnerable code path (Tippy.js initialization with `allowHTML: true` for `data-tippy-content` elements) does not exist in version 5.7.29. The custom Laravel exception renderer was introduced i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel Framework version 5.7.29 is not affected by CVE-2026-102279. This version uses the Whoops library for debug exception rendering, not Laravel's custom exception renderer with Tippy.js tooltips. The vulnerable code path (Tippy.js initialization with `allowHTML: true` for `data-tippy-content` elements) does not exist in version 5.7.29. The custom Laravel exception renderer was introduced i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:43:59.818765+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.7.29-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources feature, which was introduced in Laravel 12.x (December 2025). Laravel 5.7.29 predates this feature by approximately 6 years and 5+ major versions. The target version contains only the older Json resources (not JsonApi) which do not process relationship inclusion parameters from URLs, making th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources feature, which was introduced in Laravel 12.x (December 2025). Laravel 5.7.29 predates this feature by approximately 6 years and 5+ major versions. The target version contains only the older Json resources (not JsonApi) which do not process relationship inclusion parameters from URLs, making th..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:45:00.074275+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 5.7.29-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:43:59.818765+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.7.29-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:43:59.818765+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.7.29-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 uses SwiftMailer, not Symfony Mailer. The GHSA-5vg9-5847-vvmq vulnerability specifically requires Symfony Mailer's handling of CRLF sequences. SwiftMailer employs EmailValidator which rejects CRLF in email addresses, breaking the attack chain.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 uses SwiftMailer, not Symfony Mailer. The GHSA-5vg9-5847-vvmq vulnerability specifically requires Symfony Mailer's handling of CRLF sequences. SwiftMailer employs EmailValidator which rejects CRLF in email addresses, breaking the attack chain." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:43:59.818765+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.7.29-p5+tuxcare of laravel/framework. not_affected \u2014 Target repository Laravel 5.7.29-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The fix for this vulnerability was already present in the upstream Laravel 5.7.29 release (September 2018), which shipped after the vulnerability was fixed in Laravel 5.6.30 (August 2018). The target's cookie encryption middleware disables serialization for all cookies via ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target repository Laravel 5.7.29-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The fix for this vulnerability was already present in the upstream Laravel 5.7.29 release (September 2018), which shipped after the vulnerability was fixed in Laravel 5.6.30 (August 2018). The target's cookie encryption middleware disables serialization for all cookies via ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:43:59.818765+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.7.29-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 5.7.29 code is not affected by GHSA-7852-w36x-6mf6. The IV length validation fix (checking that base64-decoded IV length matches openssl_cipher_iv_length) is already present in the Encrypter.php validPayload() method at line 210. This fix was included in the upstream Laravel 5.7.29 release (authored by Taylor Otwell in March 2018, before Laravel 5.7 was released in September ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel 5.7.29 code is not affected by GHSA-7852-w36x-6mf6. The IV length validation fix (checking that base64-decoded IV length matches openssl_cipher_iv_length) is already present in the Encrypter.php validPayload() method at line 210. This fix was included in the upstream Laravel 5.7.29 release (authored by Taylor Otwell in March 2018, before Laravel 5.7 was released in September ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:43:59.818765+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.7.29-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 does not support temporary signed URLs for local filesystem storage. The vulnerable feature (LocalFilesystemAdapter with temporaryUrl/temporaryUploadUrl methods) does not exist in this version. The FilesystemAdapter::temporaryUrl() method explicitly throws RuntimeException when used with LocalAdapter.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 does not support temporary signed URLs for local filesystem storage. The vulnerable feature (LocalFilesystemAdapter with temporaryUrl/temporaryUploadUrl methods) does not exist in this version. The FilesystemAdapter::temporaryUrl() method explicitly throws RuntimeException when used with LocalAdapter." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:43:59.818765+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.7.29-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.7.29-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:43:59.818765+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.7.29-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:43:59.818765+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.7.29-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.7.29-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:43:59.818765+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.7.29-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.0-p5+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 8.12.0 is NOT AFFECTED by CVE-2017-14775. The vulnerability (timing attack on remember_me token verification via database string comparison) is not present. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison. The fix was shipped in upstream Laravel 5.5.10 (September 2017) and is present in Laravel 8.12.0, which TuxCare onboarde...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Target Laravel 8.12.0 is NOT AFFECTED by CVE-2017-14775. The vulnerability (timing attack on remember_me token verification via database string comparison) is not present. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison. The fix was shipped in upstream Laravel 5.5.10 (September 2017) and is present in Laravel 8.12.0, which TuxCare onboarde..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.0-p5+tuxcare of laravel/framework. Laravel Framework v8.12.0 is not affected by CVE-2018-15133. The vulnerability involved unserialize being called on untrusted X-XSRF-TOKEN cookie values, enabling remote code execution. The upstream fix (disabling serialization for cookie encryption/decryption) was already present in Laravel v8.12.0 when TuxCare onboarded this version. The fix was originally applied by Taylor Otwell in August 2018 (commits c0eb9073, 7c90d413, 97467e3c, 240d9046), well before the v8.x release line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "Laravel Framework v8.12.0 is not affected by CVE-2018-15133. The vulnerability involved unserialize being called on untrusted X-XSRF-TOKEN cookie values, enabling remote code execution. The upstream fix (disabling serialization for cookie encryption/decryption) was already present in Laravel v8.12.0 when TuxCare onboarded this version. The fix was originally applied by Taylor Otwell in August 2018 (commits c0eb9073, 7c90d413, 97467e3c, 240d9046), well before the v8.x release line." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.0-p5+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.0-p5+tuxcare of laravel/framework. CVE-2020-19316 command injection vulnerability is NOT present in Laravel Framework 8.12.0-p7+tuxcare. The vulnerable pattern (unescaped shell parameters in exec() call) does not exist. The fix (escapeshellarg() wrapping) was already present in upstream Laravel v8.12.0 when TuxCare onboarded it. File src/Illuminate/Filesystem/Filesystem.php line 320 correctly applies escapeshellarg() to both $link and $target parameters before passing them to exec(). Original upstream fix by Taylor Otwell (May 2019, commit 44c3feb604) shipped in Laravel 8.12.0 release (~Nov 2020), 18 months before TuxCare onboarding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 command injection vulnerability is NOT present in Laravel Framework 8.12.0-p7+tuxcare. The vulnerable pattern (unescaped shell parameters in exec() call) does not exist. The fix (escapeshellarg() wrapping) was already present in upstream Laravel v8.12.0 when TuxCare onboarded it. File src/Illuminate/Filesystem/Filesystem.php line 320 correctly applies escapeshellarg() to both $link and $target parameters before passing them to exec(). Original upstream fix by Taylor Otwell (May 2019, commit 44c3feb604) shipped in Laravel 8.12.0 release (~Nov 2020), 18 months before TuxCare onboarding." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:40:50.094173+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.0-p5+tuxcare of laravel/framework. The target Laravel 8.12.0-p7+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability fix was already present in the upstream Laravel 8.12.0 release. The affected code (GuardsAttributes.php) contains the complete patched version with isGuardableColumn() validation that blocks mass assignment to non-existent columns. The TuxCare snapshot commit (9014f5a2) simply onboarded the already-fixed upstream release; no backport was needed. CVE affected versions before 6.18.35 and 7.x before 7.24.0; Laravel 8.12.0 is post-fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel 8.12.0-p7+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability fix was already present in the upstream Laravel 8.12.0 release. The affected code (GuardsAttributes.php) contains the complete patched version with isGuardableColumn() validation that blocks mass assignment to non-existent columns. The TuxCare snapshot commit (9014f5a2) simply onboarded the already-fixed upstream release; no backport was needed. CVE affected versions before 6.18.35 and 7.x before 7.24.0; Laravel 8.12.0 is post-fix." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.0-p5+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.0-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.0-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resource feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, Dec 2025), approximately 5 years after version 8.12.0 (Dec 2020). The target version lacks the entire JSON:API resource system, including the vulnerabl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resource feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, Dec 2025), approximately 5 years after version 8.12.0 (Dec 2020). The target version lacks the entire JSON:API resource system, including the vulnerabl..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:40:03.913990+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.0-p5+tuxcare of laravel/framework, and is fixed in 8.12.0-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.0-p5+tuxcare of laravel/framework, and is fixed in 8.12.0-p8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T20:52:55.704640+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.0-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization via cookies). The upstream Laravel 8.12.0 release already contained the fix with `protected static $serialize = false`, which disables cookie serialization globally. This defense was present in the snapshot commit 9014f5a213 that imported upstream Laravel 8.12.0 into the TuxCare repository, preventing the exploita...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization via cookies). The upstream Laravel 8.12.0 release already contained the fix with `protected static $serialize = false`, which disables cookie serialization globally. This defense was present in the snapshot commit 9014f5a213 that imported upstream Laravel 8.12.0 into the TuxCare repository, preventing the exploita..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.0-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework v8.12.0 is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false instead of throwing exception when IV length is invalid) is not present because the IV length validation fix was already included in the upstream Laravel v8.12.0 release. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the defensive che...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel Framework v8.12.0 is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false instead of throwing exception when IV length is invalid) is not present because the IV length validation fix was already included in the upstream Laravel v8.12.0 release. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the defensive che..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.0-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:13:26.008802+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.0-p5+tuxcare of laravel/framework. The target Laravel framework 8.12.0-p7+tuxcare is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (encryption oracle vulnerability). The vulnerable pattern (keyless SHA1 cookie prefix) is not present because the fix was already included in the upstream Laravel 8.12.0 release. The target uses HMAC-based cookie prefixes that incorporate the encryption key, preventing attackers from crafting valid prefixes via encryption oracles.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework 8.12.0-p7+tuxcare is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (encryption oracle vulnerability). The vulnerable pattern (keyless SHA1 cookie prefix) is not present because the fix was already included in the upstream Laravel 8.12.0 release. The target uses HMAC-based cookie prefixes that incorporate the encryption key, preventing attackers from crafting valid prefixes via encryption oracles." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:46:53.244273+00:00", "status_notes": "Vulnerability CVE-2015-7809 does not affect version v2.15.6-p3+tuxcare of twig/twig. already_fixed \u2014 CVE-2015-7809 affects Twig before version 1.20.0. The target repository is running Twig 2.15.6, which is significantly newer than the vulnerable versions. The security fix that prevents arbitrary code execution via the _self variable in Sandbox mode is present in the target code at src/Template.php lines 175-178, with explicit documentation ('avoid RCEs when sandbox is enabled') and test coverage.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-7809" }, "impact_statement": "already_fixed \u2014 CVE-2015-7809 affects Twig before version 1.20.0. The target repository is running Twig 2.15.6, which is significantly newer than the vulnerable versions. The security fix that prevents arbitrary code execution via the _self variable in Sandbox mode is present in the target code at src/Template.php lines 175-178, with explicit documentation ('avoid RCEs when sandbox is enabled') and test coverage." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:46:53.244273+00:00", "status_notes": "Vulnerability CVE-2019-9942 does not affect version v2.15.6-p3+tuxcare of twig/twig. already_fixed \u2014 CVE-2019-9942 was fixed in Twig version 2.7.0 (released 2019-03-12). The target version 2.15.6 (released 2023-11-21) already contains the complete fix. The vulnerability allowed calling __toString() on objects in sandbox mode even when not allowed by the security policy. The fix introduces ensureToStringAllowed() method and CheckToStringNode wrapping mechanism that validates all implicit __toSt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-9942" }, "impact_statement": "already_fixed \u2014 CVE-2019-9942 was fixed in Twig version 2.7.0 (released 2019-03-12). The target version 2.15.6 (released 2023-11-21) already contains the complete fix. The vulnerability allowed calling __toString() on objects in sandbox mode even when not allowed by the security policy. The fix introduces ensureToStringAllowed() method and CheckToStringNode wrapping mechanism that validates all implicit __toSt..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:46:53.244273+00:00", "status_notes": "Vulnerability CVE-2022-23614 does not affect version v2.15.6-p3+tuxcare of twig/twig. CVE-2022-23614 fix is already present in target v2.15.6-p2+tuxcare. The vulnerability allowed arbitrary PHP function execution via non-Closure callables in the sort filter's arrow parameter when sandbox mode is enabled. The fix adds validation (twig_check_arrow_in_sandbox) to enforce Closure-only callables in sandbox mode. This fix was authored by Fabien Potencier in upstream Twig v2.14.11 (2022-02-04) and was already present in upstream v2.15.6 when TuxCare onboarded it via snapshot commit 24b89969d.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-23614" }, "impact_statement": "CVE-2022-23614 fix is already present in target v2.15.6-p2+tuxcare. The vulnerability allowed arbitrary PHP function execution via non-Closure callables in the sort filter's arrow parameter when sandbox mode is enabled. The fix adds validation (twig_check_arrow_in_sandbox) to enforce Closure-only callables in sandbox mode. This fix was authored by Fabien Potencier in upstream Twig v2.14.11 (2022-02-04) and was already present in upstream v2.15.6 when TuxCare onboarded it via snapshot commit 24b89969d." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:46:53.244273+00:00", "status_notes": "Vulnerability CVE-2022-39261 does not affect version v2.15.6-p3+tuxcare of twig/twig. Target version v2.15.6 is NOT AFFECTED by CVE-2022-39261. The path traversal vulnerability in Twig's FilesystemLoader was fixed in upstream Twig v2.15.3 (released 2022-09-28). The target is based on upstream v2.15.6, which already contains the fix. The vulnerable code pattern (validating template name before parsing namespace) is not present; instead, the fixed pattern (validating after parsing) is present at src/Loader/FilesystemLoader.php lines 209-211.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-39261" }, "impact_statement": "Target version v2.15.6 is NOT AFFECTED by CVE-2022-39261. The path traversal vulnerability in Twig's FilesystemLoader was fixed in upstream Twig v2.15.3 (released 2022-09-28). The target is based on upstream v2.15.6, which already contains the fix. The vulnerable code pattern (validating template name before parsing namespace) is not present; instead, the fixed pattern (validating after parsing) is present at src/Loader/FilesystemLoader.php lines 209-211." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:46:53.244273+00:00", "status_notes": "Vulnerability CVE-2024-45411 is fixed in version v2.15.6-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-45411" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:46:53.244273+00:00", "status_notes": "Vulnerability CVE-2024-51754 is fixed in version v2.15.6-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-51754" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:46:53.244273+00:00", "status_notes": "Vulnerability CVE-2024-51755 is fixed in version v2.15.6-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-51755" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:46:53.244273+00:00", "status_notes": "Vulnerability CVE-2026-24425 does not affect version v2.15.6-p3+tuxcare of twig/twig. CVE-2026-24425 requires SourcePolicyInterface for exploitation, which does not exist in v2.15.6-p2+tuxcare. The vulnerable code pattern (calling isSandboxed() without Source parameter at CoreExtension.php:1714) exists but only becomes exploitable with SourcePolicyInterface. In v2.15.6, the existing sandbox mechanisms (global sandboxing and {% sandbox %} tag) work correctly with the current code. SourcePolicyInterface was added to Twig 2.x in December 2023 (commit a4974b29a, first in v2.16.0), after v2.15.6 was released (November 2023). The fix commits c8dfd6206 and d0579eded are not ancestors of HEAD.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24425" }, "impact_statement": "CVE-2026-24425 requires SourcePolicyInterface for exploitation, which does not exist in v2.15.6-p2+tuxcare. The vulnerable code pattern (calling isSandboxed() without Source parameter at CoreExtension.php:1714) exists but only becomes exploitable with SourcePolicyInterface. In v2.15.6, the existing sandbox mechanisms (global sandboxing and {% sandbox %} tag) work correctly with the current code. SourcePolicyInterface was added to Twig 2.x in December 2023 (commit a4974b29a, first in v2.16.0), after v2.15.6 was released (November 2023). The fix commits c8dfd6206 and d0579eded are not ancestors of HEAD." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:46:53.244273+00:00", "status_notes": "Vulnerability CVE-2026-46628 is fixed in version v2.15.6-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46628" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:46:53.244273+00:00", "status_notes": "Vulnerability CVE-2026-46633 is fixed in version v2.15.6-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46633" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:46:53.244273+00:00", "status_notes": "Vulnerability CVE-2026-46634 does not affect version v2.15.6-p3+tuxcare of twig/twig. CVE-2026-46634 describes a sandbox bypass specific to Twig 3.x when using SourcePolicyInterface for per-template sandboxing. The vulnerability occurs because templates created via template_from_string() get synthesized names (__string_template__) that SourcePolicyInterface doesn't recognize, causing sandbox checks to be skipped.\n\nTarget version 2.15.6 does NOT have SourcePolicyInterface (introduced in Twig 3.x). In v2.15.6, sandboxing is controlled by runtime state (SandboxExtension::isSandboxed()) via global configuration or {% sandbox %} tags, NOT by template names/paths. The synthesized template name has no effect on sandbox enforcement.\n\nTests in the target (SandboxTest.php lines 130-154) confirm that templates from template_from_string ARE properly sandboxed in v2.15.6. The attack chain described in the CVE cannot manifest in this architecture.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-46634" }, "impact_statement": "CVE-2026-46634 describes a sandbox bypass specific to Twig 3.x when using SourcePolicyInterface for per-template sandboxing. The vulnerability occurs because templates created via template_from_string() get synthesized names (__string_template__) that SourcePolicyInterface doesn't recognize, causing sandbox checks to be skipped.\n\nTarget version 2.15.6 does NOT have SourcePolicyInterface (introduced in Twig 3.x). In v2.15.6, sandboxing is controlled by runtime state (SandboxExtension::isSandboxed()) via global configuration or {% sandbox %} tags, NOT by template names/paths. The synthesized template name has no effect on sandbox enforcement.\n\nTests in the target (SandboxTest.php lines 130-154) confirm that templates from template_from_string ARE properly sandboxed in v2.15.6. The attack chain described in the CVE cannot manifest in this architecture." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:46:53.244273+00:00", "status_notes": "Vulnerability CVE-2026-46635 is fixed in version v2.15.6-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46635" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:46:53.244273+00:00", "status_notes": "Vulnerability CVE-2026-46638 is fixed in version v2.15.6-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46638" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:46:53.244273+00:00", "status_notes": "Vulnerability CVE-2026-46640 does not affect version v2.15.6-p3+tuxcare of twig/twig. CVE-2026-46640 affects Twig 3.15.0+ where the obj.(expr) parenthesized dynamic-attribute syntax was introduced. This syntax allows arbitrary expressions after a dot operator, enabling PHP code injection when used with _self or import aliases due to unchecked string concatenation in MacroReferenceExpression. Twig v2.15.6 does not support this syntax\u2014the parser (ExpressionParser.php:490-492) explicitly rejects parentheses after dots, throwing \"Expected name or number, got value '(' of type punctuation.\" The vulnerable MacroReferenceExpression class does not exist in 2.x. While 2.x handles macro calls via MethodCallExpression, it properly escapes method names through repr()->string() using addcslashes(), preventing code injection. The target predates the vulnerable feature by multiple major versions.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-46640" }, "impact_statement": "CVE-2026-46640 affects Twig 3.15.0+ where the obj.(expr) parenthesized dynamic-attribute syntax was introduced. This syntax allows arbitrary expressions after a dot operator, enabling PHP code injection when used with _self or import aliases due to unchecked string concatenation in MacroReferenceExpression. Twig v2.15.6 does not support this syntax\u2014the parser (ExpressionParser.php:490-492) explicitly rejects parentheses after dots, throwing \"Expected name or number, got value '(' of type punctuation.\" The vulnerable MacroReferenceExpression class does not exist in 2.x. While 2.x handles macro calls via MethodCallExpression, it properly escapes method names through repr()->string() using addcslashes(), preventing code injection. The target predates the vulnerable feature by multiple major versions." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:48:00.196671+00:00", "status_notes": "Vulnerability CVE-2026-47730 is fixed in version v2.15.6-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-47730" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:46:53.244273+00:00", "status_notes": "Vulnerability CVE-2026-47732 is fixed in version v2.15.6-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-47732" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:46:53.244273+00:00", "status_notes": "Vulnerability CVE-2026-48805 does not affect version v2.15.6-p3+tuxcare of twig/twig. not_affected \u2014 Twig v2.15.6 is not affected by CVE-2026-48805. The vulnerability exists only in Twig 3.26.0+ where architectural changes introduced deprecated wrapper functions in src/Resources/core.php that fail to forward sandbox state to CoreExtension methods. This architectural pattern does not exist in v2.15.6, which uses a different implementation where sandbox enforcement is correctly handled.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48805" }, "impact_statement": "not_affected \u2014 Twig v2.15.6 is not affected by CVE-2026-48805. The vulnerability exists only in Twig 3.26.0+ where architectural changes introduced deprecated wrapper functions in src/Resources/core.php that fail to forward sandbox state to CoreExtension methods. This architectural pattern does not exist in v2.15.6, which uses a different implementation where sandbox enforcement is correctly handled." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:46:53.244273+00:00", "status_notes": "Vulnerability CVE-2026-48806 is fixed in version v2.15.6-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48806" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:46:53.244273+00:00", "status_notes": "Vulnerability CVE-2026-48807 is fixed in version v2.15.6-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48807" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:46:53.244273+00:00", "status_notes": "Vulnerability CVE-2026-48808 does not affect version v2.15.6-p3+tuxcare of twig/twig. not_affected \u2014 CVE-2026-48808 does not affect Twig 2.15.6 because it specifically targets a vulnerability in sandboxing enabled through SourcePolicyInterface, which does not exist in this version. The target uses a fundamentally different architecture predating the SourcePolicyInterface feature.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48808" }, "impact_statement": "not_affected \u2014 CVE-2026-48808 does not affect Twig 2.15.6 because it specifically targets a vulnerability in sandboxing enabled through SourcePolicyInterface, which does not exist in this version. The target uses a fundamentally different architecture predating the SourcePolicyInterface feature." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v2.15.6-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:46:53.244273+00:00", "status_notes": "Vulnerability CVE-2026-49981 is fixed in version v2.15.6-p3+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-49981" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-14T14:47:00.246701+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 7.30.7-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 7.30.7-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 7.30.7-p6+tuxcare is not affected by CVE-2017-14775. Both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() comparison for remember_me tokens, preventing timing attacks. This fix was already present in the upstream Laravel 7.30.7 release (originally fixed in Laravel 5.5.10 by commit 576cba749f), which TuxCare imported via snapshot commit 5082773b92.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 The target Laravel 7.30.7-p6+tuxcare is not affected by CVE-2017-14775. Both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() comparison for remember_me tokens, preventing timing attacks. This fix was already present in the upstream Laravel 7.30.7 release (originally fixed in Laravel 5.5.10 by commit 576cba749f), which TuxCare imported via snapshot commit 5082773b92." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 7.30.7-p6+tuxcare of laravel/framework. CVE-2018-15133 is NOT present in laravel/framework v7.30.7. The vulnerability affected versions through 5.5.40 and 5.6.x through 5.6.29. The target version (7.30.7, released in 2020) includes upstream fixes from August 2018 that disable PHP serialization for all encrypted cookies, preventing unsafe unserialize() calls on attacker-controlled cookie data. The fix was shipped in the upstream Laravel release, not applied by TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 is NOT present in laravel/framework v7.30.7. The vulnerability affected versions through 5.5.40 and 5.6.x through 5.6.29. The target version (7.30.7, released in 2020) includes upstream fixes from August 2018 that disable PHP serialization for all encrypted cookies, preventing unsafe unserialize() calls on attacker-controlled cookie data. The fix was shipped in the upstream Laravel release, not applied by TuxCare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 7.30.7-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 7.30.7-p6+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 7.30.7-p6+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before version 5.8.17. The target version 7.30.7-p6+tuxcare already contains the upstream fix. The vulnerability was an OS command injection in the `link()` function in Filesystem.php, where user-controlled `$link` and `$target` parameters were passed to `exec(\"mklink ...\")` without proper escaping. The fix, applied by Laravel upstream in May 2019 (commit 44c3feb6), wraps both parameters with `escapeshellarg()` to prevent shell metacharacter injection. This fix was already present in Laravel 7.30.7 when TuxCare onboarded it in the snapshot commit 5082773b92.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before version 5.8.17. The target version 7.30.7-p6+tuxcare already contains the upstream fix. The vulnerability was an OS command injection in the `link()` function in Filesystem.php, where user-controlled `$link` and `$target` parameters were passed to `exec(\"mklink ...\")` without proper escaping. The fix, applied by Laravel upstream in May 2019 (commit 44c3feb6), wraps both parameters with `escapeshellarg()` to prevent shell metacharacter injection. This fix was already present in Laravel 7.30.7 when TuxCare onboarded it in the snapshot commit 5082773b92." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:42:21.835037+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 7.30.7-p6+tuxcare of laravel/framework. The target repository (laravel/framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2020-24941. The vulnerability affected Laravel versions before 6.18.35 and 7.x before 7.24.0. The target version 7.30.7 is greater than 7.24.0, and the fix was already present in the upstream v7.30.7 release that was onboarded into the TuxCare branch via snapshot commit 5082773b92. The fix adds validation to ensure mass-assigned attributes are actual database columns, preventing attackers from bypassing the $guarded property protection using fake column names with JSON-like syntax. The vulnerable code pattern (missing isGuardableColumn validation) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target repository (laravel/framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2020-24941. The vulnerability affected Laravel versions before 6.18.35 and 7.x before 7.24.0. The target version 7.30.7 is greater than 7.24.0, and the fix was already present in the upstream v7.30.7 release that was onboarded into the TuxCare branch via snapshot commit 5082773b92. The fix adds validation to ensure mass-assigned attributes are actual database columns, preventing attackers from bypassing the $guarded property protection using fake column names with JSON-like syntax. The vulnerable code pattern (missing isGuardableColumn validation) is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 7.30.7-p6+tuxcare of laravel/framework. CVE-2021-21263 affects Laravel versions <6.20.12, <7.30.3, and <8.22.1. The target is Laravel v7.30.7-p6+tuxcare, which is >7.30.3. The upstream Laravel v7.30.7 release already included the fix via the flattenValue() method and array_slice() limiting, which was snapshotted into the TuxCare branch. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) now properly limit array inputs to prevent query binding exploitation. The vulnerable pattern is not present in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "CVE-2021-21263 affects Laravel versions <6.20.12, <7.30.3, and <8.22.1. The target is Laravel v7.30.7-p6+tuxcare, which is >7.30.3. The upstream Laravel v7.30.7 release already included the fix via the flattenValue() method and array_slice() limiting, which was snapshotted into the TuxCare branch. All affected query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) now properly limit array inputs to prevent query binding exploitation. The vulnerable pattern is not present in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 7.30.7-p6+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 7.30.7-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2021-43808 (Blade XSS via predictable parent placeholder). The upstream fix was already present in v7.30.7 when TuxCare onboarded it. The fix implements random per-request salt for parent placeholders, making them unguessable and preventing XSS exploitation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2021-43808 (Blade XSS via predictable parent placeholder). The upstream fix was already present in v7.30.7 when TuxCare onboarded it. The fix implements random per-request salt for parent placeholders, making them unguessable and preventing XSS exploitation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 7.30.7-p6+tuxcare of laravel/framework. The target repository (Laravel framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled. The fix\u2014checking runningInConsole() before using $_SERVER['argv']\u2014was already present in the upstream Laravel v7.30.7 release that TuxCare imported via snapshot on 2026-05-05. The upstream fix was authored by Taylor Otwell on 2024-11-12. The target code at Application.php:560-562 correctly guards $_SERVER['argv'] access, preventing web requests from manipulating the framework's environment detection.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target repository (Laravel framework v7.30.7-p6+tuxcare) is NOT vulnerable to CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled. The fix\u2014checking runningInConsole() before using $_SERVER['argv']\u2014was already present in the upstream Laravel v7.30.7 release that TuxCare imported via snapshot on 2026-05-05. The upstream fix was authored by Taylor Otwell on 2024-11-12. The target code at Application.php:560-562 correctly guards $_SERVER['argv'] access, preventing web requests from manipulating the framework's environment detection." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-14T14:47:00.246701+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 7.30.7-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-14T14:47:00.246701+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 7.30.7-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is NOT affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's exception renderer system which uses Tippy.js tooltips with `allowHTML: true` on user-controlled data. Laravel 7.30.7 predates this feature entirely and uses the Whoops library for debug mode exception handling - a completely different architecture with no Tippy.js tooltips, no `data-tippy-content` att...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is NOT affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's exception renderer system which uses Tippy.js tooltips with `allowHTML: true` on user-controlled data. Laravel 7.30.7 predates this feature entirely and uses the Whoops library for debug mode exception handling - a completely different architecture with no Tippy.js tooltips, no `data-tippy-content` att..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 7.30.7-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource system, which was introduced in version 12.x, five major versions after the target. The vulnerable pattern requires: (1) JsonApi resources processing user-supplied `include` query parameters, (2) passing unsanitized nested relationship names to `loadMissing()`, and (3) potential invocation ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource system, which was introduced in version 12.x, five major versions after the target. The vulnerable pattern requires: (1) JsonApi resources processing user-supplied `include` query parameters, (2) passing unsanitized nested relationship names to `loadMissing()`, and (3) potential invocation ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-11-04T11:50:18.837974+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 7.30.7-p6+tuxcare of laravel/framework, and is fixed in 7.30.7-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 7.30.7-p6+tuxcare of laravel/framework, and is fixed in 7.30.7-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-28T20:52:18.183384+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 7.30.7-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework v7.30.7-p6+tuxcare is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is absent because the upstream Laravel v7.30.5 release already included the fix, which adds integer casting to limit() and offset() methods in Builder.php. This version (7.30.7) inherits that upstream fix via the snapshot commit that imported the v7.30.7...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Laravel Framework v7.30.7-p6+tuxcare is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is absent because the upstream Laravel v7.30.5 release already included the fix, which adds integer casting to limit() and offset() methods in Builder.php. This version (7.30.7) inherits that upstream fix via the snapshot commit that imported the v7.30.7..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-14T14:47:00.246701+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 7.30.7-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-28T21:03:57.153420+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 7.30.7-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 7.30.7-p6+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling PHP object serialization in cookies. Laravel 7.30.7 (released September 2020) already contains this fix. The target was onboarded from the upstream Laravel 7.30.7 release, which shipped wit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 7.30.7-p6+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling PHP object serialization in cookies. Laravel 7.30.7 (released September 2020) already contains this fix. The target was onboarded from the upstream Laravel 7.30.7 release, which shipped wit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 7.30.7-p6+tuxcare of laravel/framework. not_affected \u2014 Target Laravel v7.30.7 already contains the upstream IV length validation fix. The vulnerability (GHSA-7852-w36x-6mf6) allows decryption to return false instead of throwing an exception when processing payloads with manipulated IV length. The fix validates that decoded IV length matches expected cipher IV length (Encrypter.php:214). This was authored by Taylor Otwell on March 30, 2018, and ship...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 Target Laravel v7.30.7 already contains the upstream IV length validation fix. The vulnerability (GHSA-7852-w36x-6mf6) allows decryption to return false instead of throwing an exception when processing payloads with manipulated IV length. The fix validates that decoded IV length matches expected cipher IV length (Encrypter.php:214). This was authored by Taylor Otwell on March 30, 2018, and ship..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-14T14:47:00.246701+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 7.30.7-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7-p1+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in the LocalFilesystemAdapter class which provides temporary signed URL generation for local filesystems. This class and the associated local file serving feature were introduced in Laravel 9.x and do not exist in Laravel 7.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 7.30.7-p1+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in the LocalFilesystemAdapter class which provides temporary signed URL generation for local filesystems. This class and the associated local file serving feature were introduced in Laravel 9.x and do not exist in Laravel 7.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-28T21:20:09.538096+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 7.30.7-p6+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 7.30.7 is NOT AFFECTED. All security fixes for GHSA-jwvj-pwww-3mj5 (preventing unexpected query bindings from array-valued parameters) were already present in the upstream Laravel 7.30.7 release before TuxCare created the snapshot. The target contains the `flattenValue()` method and uses it in all affected query builder methods (where, having, whereDate, whereTime, whereDay, wher...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 Target Laravel 7.30.7 is NOT AFFECTED. All security fixes for GHSA-jwvj-pwww-3mj5 (preventing unexpected query bindings from array-valued parameters) were already present in the upstream Laravel 7.30.7 release before TuxCare created the snapshot. The target contains the `flattenValue()` method and uses it in all affected query builder methods (where, having, whereDate, whereTime, whereDay, wher..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:19:00.105438+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 7.30.7-p6+tuxcare of laravel/framework. Laravel framework 7.30.7 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (RCE via cookie session driver + encryption oracle). The vulnerability was fixed in upstream Laravel 7.22.2 (July 27, 2020) by replacing the publicly-computable SHA1 hash cookie prefix with an HMAC requiring the secret encryption key. Laravel 7.30.7 (released October 22, 2020) already contains this fix. The TuxCare snapshot merely imported the already-patched upstream version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel framework 7.30.7 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (RCE via cookie session driver + encryption oracle). The vulnerability was fixed in upstream Laravel 7.22.2 (July 27, 2020) by replacing the publicly-computable SHA1 hash cookie prefix with an HMAC requiring the secret encryption key. Laravel 7.30.7 (released October 22, 2020) already contains this fix. The TuxCare snapshot merely imported the already-patched upstream version." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 7.30.7-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 7.30.7-p6+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:42:21.835037+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 7.30.7-p6+tuxcare of laravel/framework. Laravel framework 7.30.7-p6+tuxcare is NOT affected by GHSA-x7p5-p2c9-phvg (unexpected query binding vulnerability). The fix was already present in the upstream Laravel v7.30.7 release, which was onboarded by TuxCare. All vulnerable query builder methods (where, having, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, havingBetween) correctly use flattenValue() to extract scalar values from arrays and limit bindings appropriately.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "Laravel framework 7.30.7-p6+tuxcare is NOT affected by GHSA-x7p5-p2c9-phvg (unexpected query binding vulnerability). The fix was already present in the upstream Laravel v7.30.7 release, which was onboarded by TuxCare. All vulnerable query builder methods (where, having, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, havingBetween) correctly use flattenValue() to extract scalar values from arrays and limit bindings appropriately." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.1-p4+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 does not affect Laravel 8.12.1-p5+tuxcare. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017), and the fix was already present in the upstream Laravel 8.12.1 release (December 2020) that TuxCare onboarded. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison, preventing...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 does not affect Laravel 8.12.1-p5+tuxcare. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017), and the fix was already present in the upstream Laravel 8.12.1 release (December 2020) that TuxCare onboarded. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison, preventing..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.1-p4+tuxcare of laravel/framework. The target Laravel v8.12.1 is NOT affected by CVE-2018-15133. The vulnerability (uncontrolled deserialization of encrypted cookie data) has been mitigated by the upstream Laravel framework prior to v8.12.1. The target code passes `false` to `decrypt()` for all cookie operations, preventing automatic unserialization and blocking PHP object injection attacks. This fix was authored by Taylor Otwell in August 2018 and was included in the upstream v8.12.1 release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "The target Laravel v8.12.1 is NOT affected by CVE-2018-15133. The vulnerability (uncontrolled deserialization of encrypted cookie data) has been mitigated by the upstream Laravel framework prior to v8.12.1. The target code passes `false` to `decrypt()` for all cookie operations, preventing automatic unserialization and blocking PHP object injection attacks. This fix was authored by Taylor Otwell in August 2018 and was included in the upstream v8.12.1 release that TuxCare onboarded." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.1-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.1-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.1-p4+tuxcare of laravel/framework. The target Laravel Framework 8.12.1 is NOT AFFECTED by CVE-2020-19316. The vulnerable code pattern (unescaped shell parameters in the link() method's mklink exec call) is not present. The target has the proper fix with escapeshellarg() sanitization on both $link and $target parameters (line 320 of Filesystem.php). This fix was authored by upstream Laravel maintainer Taylor Otwell in May 2019 (commit 44c3feb604944599ad1c782a9942981c3991fa31) and was already present in the upstream Laravel 8.12.1 release when TuxCare onboarded it via snapshot commit 4993dfe2ac. CVE affected versions \"before 5.8.17\"; target is 8.12.1, which naturally includes the fix from the 5.8.17 era.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target Laravel Framework 8.12.1 is NOT AFFECTED by CVE-2020-19316. The vulnerable code pattern (unescaped shell parameters in the link() method's mklink exec call) is not present. The target has the proper fix with escapeshellarg() sanitization on both $link and $target parameters (line 320 of Filesystem.php). This fix was authored by upstream Laravel maintainer Taylor Otwell in May 2019 (commit 44c3feb604944599ad1c782a9942981c3991fa31) and was already present in the upstream Laravel 8.12.1 release when TuxCare onboarded it via snapshot commit 4993dfe2ac. CVE affected versions \"before 5.8.17\"; target is 8.12.1, which naturally includes the fix from the 5.8.17 era." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:41:10.796701+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.1-p4+tuxcare of laravel/framework. Laravel 8.12.1 was released after CVE-2020-24941 was fixed upstream. The vulnerability affected Laravel <6.18.35 and 7.x <7.24.0. The fix (commit 897d107) was applied on August 7, 2020, before Laravel 8.0's September 2020 release. Version 8.12.1 shipped with the fix already present: the isGuardableColumn() method validates attribute keys against actual database columns, preventing the JSON column nesting bypass. The vulnerable pattern (stripping '->' before guard checks) is not present. This is an upstream fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "Laravel 8.12.1 was released after CVE-2020-24941 was fixed upstream. The vulnerability affected Laravel <6.18.35 and 7.x <7.24.0. The fix (commit 897d107) was applied on August 7, 2020, before Laravel 8.0's September 2020 release. Version 8.12.1 shipped with the fix already present: the isGuardableColumn() method validates attribute keys against actual database columns, preventing the JSON column nesting bypass. The vulnerable pattern (stripping '->' before guard checks) is not present. This is an upstream fix, not a TuxCare backport." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.1-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.1-p4+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.1-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.1-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.1-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.1-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer that uses Tippy.js tooltips with allowHTML enabled. Laravel 8.x uses a completely different exception rendering system (Whoops library from filp/whoops) and does not contain the vulnerable code. The Tippy.js-based exception renderer infrastructure does not exist in this versio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer that uses Tippy.js tooltips with allowHTML enabled. Laravel 8.x uses a completely different exception rendering system (Whoops library from filp/whoops) and does not contain the vulnerable code. The Tippy.js-based exception renderer infrastructure does not exist in this versio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.1-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 11/12. Version 8.12.1 predates this feature entirely - it only has basic JsonResource with no include parameter processing or relationship compilation logic. The entire vulnerable code path is absent f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 11/12. Version 8.12.1 predates this feature entirely - it only has basic JsonResource with no include parameter processing or relationship compilation logic. The entire vulnerable code path is absent f..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-11-04T11:38:00.180821+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.1-p4+tuxcare of laravel/framework, and is fixed in 8.12.1-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.1-p4+tuxcare of laravel/framework, and is fixed in 8.12.1-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.1-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.1-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:53:45.635911+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.1-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via unsafe cookie deserialization). The vulnerability affected Laravel 5.6.x prior to 5.6.30 and was fixed in August 2018 by disabling cookie serialization. Laravel 8.12.1 (released December 2020) already contains the fix in its upstream release: `protected static $serialize = false` in EncryptCookies.php globally disab...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via unsafe cookie deserialization). The vulnerability affected Laravel 5.6.x prior to 5.6.30 and was fixed in August 2018 by disabling cookie serialization. Laravel 8.12.1 (released December 2020) already contains the fix in its upstream release: `protected static $serialize = false` in EncryptCookies.php globally disab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.1-p4+tuxcare of laravel/framework. not_affected \u2014 The Laravel Encrypter IV length validation vulnerability (GHSA-7852-w36x-6mf6) is NOT present in this target. The fix was included in upstream Laravel 8.12.1 (released December 2020) and imported via snapshot commit 4993dfe2ac. The validPayload method at lines 211-215 of src/Illuminate/Encryption/Encrypter.php contains the exact IV length validation (line 214: strlen(base64_decode($payload['iv'...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The Laravel Encrypter IV length validation vulnerability (GHSA-7852-w36x-6mf6) is NOT present in this target. The fix was included in upstream Laravel 8.12.1 (released December 2020) and imported via snapshot commit 4993dfe2ac. The validPayload method at lines 211-215 of src/Illuminate/Encryption/Encrypter.php contains the exact IV length validation (line 214: strlen(base64_decode($payload['iv'..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.1-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns ambiguous URL parsing in local filesystem temporary signed URLs, but Laravel 8.x does not have the local filesystem signed URL feature. The temporaryUrl() method throws RuntimeException for local storage adapters. This feature was introduced in Laravel 11+/12.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns ambiguous URL parsing in local filesystem temporary signed URLs, but Laravel 8.x does not have the local filesystem signed URL feature. The temporaryUrl() method throws RuntimeException for local storage adapters. This feature was introduced in Laravel 11+/12.x." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.1-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:14:30.754022+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.1-p4+tuxcare of laravel/framework. Target version 8.12.1-p5+tuxcare is NOT AFFECTED. The encryption oracle vulnerability (GHSA-qm5c-m76r-2hfr) was fixed in upstream Laravel framework on July 27, 2020, when Taylor Otwell replaced the unkeyed sha1() cookie prefix with a keyed HMAC via the CookieValuePrefix class. Laravel 8.12.1 was released November 5, 2020, four months AFTER the fix, so the vulnerable pattern is not present in the onboarded upstream release. The target uses CookieValuePrefix::create() with hash_hmac('sha1', $cookieName.'v2', $key), making cookie prefixes unforgeable without the encryption key.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Target version 8.12.1-p5+tuxcare is NOT AFFECTED. The encryption oracle vulnerability (GHSA-qm5c-m76r-2hfr) was fixed in upstream Laravel framework on July 27, 2020, when Taylor Otwell replaced the unkeyed sha1() cookie prefix with a keyed HMAC via the CookieValuePrefix class. Laravel 8.12.1 was released November 5, 2020, four months AFTER the fix, so the vulnerable pattern is not present in the onboarded upstream release. The target uses CookieValuePrefix::create() with hash_hmac('sha1', $cookieName.'v2', $key), making cookie prefixes unforgeable without the encryption key." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.1-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.1-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.1-p2+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 does not affect Laravel 8.12.1-p5+tuxcare. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017), and the fix was already present in the upstream Laravel 8.12.1 release (December 2020) that TuxCare onboarded. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison, preventing...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 does not affect Laravel 8.12.1-p5+tuxcare. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017), and the fix was already present in the upstream Laravel 8.12.1 release (December 2020) that TuxCare onboarded. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison, preventing..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.1-p2+tuxcare of laravel/framework. The target Laravel v8.12.1 is NOT affected by CVE-2018-15133. The vulnerability (uncontrolled deserialization of encrypted cookie data) has been mitigated by the upstream Laravel framework prior to v8.12.1. The target code passes `false` to `decrypt()` for all cookie operations, preventing automatic unserialization and blocking PHP object injection attacks. This fix was authored by Taylor Otwell in August 2018 and was included in the upstream v8.12.1 release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "The target Laravel v8.12.1 is NOT affected by CVE-2018-15133. The vulnerability (uncontrolled deserialization of encrypted cookie data) has been mitigated by the upstream Laravel framework prior to v8.12.1. The target code passes `false` to `decrypt()` for all cookie operations, preventing automatic unserialization and blocking PHP object injection attacks. This fix was authored by Taylor Otwell in August 2018 and was included in the upstream v8.12.1 release that TuxCare onboarded." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.1-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.1-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.1-p2+tuxcare of laravel/framework. The target Laravel Framework 8.12.1 is NOT AFFECTED by CVE-2020-19316. The vulnerable code pattern (unescaped shell parameters in the link() method's mklink exec call) is not present. The target has the proper fix with escapeshellarg() sanitization on both $link and $target parameters (line 320 of Filesystem.php). This fix was authored by upstream Laravel maintainer Taylor Otwell in May 2019 (commit 44c3feb604944599ad1c782a9942981c3991fa31) and was already present in the upstream Laravel 8.12.1 release when TuxCare onboarded it via snapshot commit 4993dfe2ac. CVE affected versions \"before 5.8.17\"; target is 8.12.1, which naturally includes the fix from the 5.8.17 era.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target Laravel Framework 8.12.1 is NOT AFFECTED by CVE-2020-19316. The vulnerable code pattern (unescaped shell parameters in the link() method's mklink exec call) is not present. The target has the proper fix with escapeshellarg() sanitization on both $link and $target parameters (line 320 of Filesystem.php). This fix was authored by upstream Laravel maintainer Taylor Otwell in May 2019 (commit 44c3feb604944599ad1c782a9942981c3991fa31) and was already present in the upstream Laravel 8.12.1 release when TuxCare onboarded it via snapshot commit 4993dfe2ac. CVE affected versions \"before 5.8.17\"; target is 8.12.1, which naturally includes the fix from the 5.8.17 era." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:41:10.796701+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.1-p2+tuxcare of laravel/framework. Laravel 8.12.1 was released after CVE-2020-24941 was fixed upstream. The vulnerability affected Laravel <6.18.35 and 7.x <7.24.0. The fix (commit 897d107) was applied on August 7, 2020, before Laravel 8.0's September 2020 release. Version 8.12.1 shipped with the fix already present: the isGuardableColumn() method validates attribute keys against actual database columns, preventing the JSON column nesting bypass. The vulnerable pattern (stripping '->' before guard checks) is not present. This is an upstream fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "Laravel 8.12.1 was released after CVE-2020-24941 was fixed upstream. The vulnerability affected Laravel <6.18.35 and 7.x <7.24.0. The fix (commit 897d107) was applied on August 7, 2020, before Laravel 8.0's September 2020 release. Version 8.12.1 shipped with the fix already present: the isGuardableColumn() method validates attribute keys against actual database columns, preventing the JSON column nesting bypass. The vulnerable pattern (stripping '->' before guard checks) is not present. This is an upstream fix, not a TuxCare backport." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.1-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.1-p2+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.1-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.1-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.1-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.1-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer that uses Tippy.js tooltips with allowHTML enabled. Laravel 8.x uses a completely different exception rendering system (Whoops library from filp/whoops) and does not contain the vulnerable code. The Tippy.js-based exception renderer infrastructure does not exist in this versio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer that uses Tippy.js tooltips with allowHTML enabled. Laravel 8.x uses a completely different exception rendering system (Whoops library from filp/whoops) and does not contain the vulnerable code. The Tippy.js-based exception renderer infrastructure does not exist in this versio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.1-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 11/12. Version 8.12.1 predates this feature entirely - it only has basic JsonResource with no include parameter processing or relationship compilation logic. The entire vulnerable code path is absent f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 11/12. Version 8.12.1 predates this feature entirely - it only has basic JsonResource with no include parameter processing or relationship compilation logic. The entire vulnerable code path is absent f..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-11-04T11:38:00.180821+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.1-p2+tuxcare of laravel/framework, and is fixed in 8.12.1-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.1-p2+tuxcare of laravel/framework, and is fixed in 8.12.1-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.1-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.1-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:53:45.635911+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.1-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via unsafe cookie deserialization). The vulnerability affected Laravel 5.6.x prior to 5.6.30 and was fixed in August 2018 by disabling cookie serialization. Laravel 8.12.1 (released December 2020) already contains the fix in its upstream release: `protected static $serialize = false` in EncryptCookies.php globally disab...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via unsafe cookie deserialization). The vulnerability affected Laravel 5.6.x prior to 5.6.30 and was fixed in August 2018 by disabling cookie serialization. Laravel 8.12.1 (released December 2020) already contains the fix in its upstream release: `protected static $serialize = false` in EncryptCookies.php globally disab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.1-p2+tuxcare of laravel/framework. not_affected \u2014 The Laravel Encrypter IV length validation vulnerability (GHSA-7852-w36x-6mf6) is NOT present in this target. The fix was included in upstream Laravel 8.12.1 (released December 2020) and imported via snapshot commit 4993dfe2ac. The validPayload method at lines 211-215 of src/Illuminate/Encryption/Encrypter.php contains the exact IV length validation (line 214: strlen(base64_decode($payload['iv'...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The Laravel Encrypter IV length validation vulnerability (GHSA-7852-w36x-6mf6) is NOT present in this target. The fix was included in upstream Laravel 8.12.1 (released December 2020) and imported via snapshot commit 4993dfe2ac. The validPayload method at lines 211-215 of src/Illuminate/Encryption/Encrypter.php contains the exact IV length validation (line 214: strlen(base64_decode($payload['iv'..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.1-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns ambiguous URL parsing in local filesystem temporary signed URLs, but Laravel 8.x does not have the local filesystem signed URL feature. The temporaryUrl() method throws RuntimeException for local storage adapters. This feature was introduced in Laravel 11+/12.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns ambiguous URL parsing in local filesystem temporary signed URLs, but Laravel 8.x does not have the local filesystem signed URL feature. The temporaryUrl() method throws RuntimeException for local storage adapters. This feature was introduced in Laravel 11+/12.x." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.1-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:14:30.754022+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.1-p2+tuxcare of laravel/framework. Target version 8.12.1-p5+tuxcare is NOT AFFECTED. The encryption oracle vulnerability (GHSA-qm5c-m76r-2hfr) was fixed in upstream Laravel framework on July 27, 2020, when Taylor Otwell replaced the unkeyed sha1() cookie prefix with a keyed HMAC via the CookieValuePrefix class. Laravel 8.12.1 was released November 5, 2020, four months AFTER the fix, so the vulnerable pattern is not present in the onboarded upstream release. The target uses CookieValuePrefix::create() with hash_hmac('sha1', $cookieName.'v2', $key), making cookie prefixes unforgeable without the encryption key.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Target version 8.12.1-p5+tuxcare is NOT AFFECTED. The encryption oracle vulnerability (GHSA-qm5c-m76r-2hfr) was fixed in upstream Laravel framework on July 27, 2020, when Taylor Otwell replaced the unkeyed sha1() cookie prefix with a keyed HMAC via the CookieValuePrefix class. Laravel 8.12.1 was released November 5, 2020, four months AFTER the fix, so the vulnerable pattern is not present in the onboarded upstream release. The target uses CookieValuePrefix::create() with hash_hmac('sha1', $cookieName.'v2', $key), making cookie prefixes unforgeable without the encryption key." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.1-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.1-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.1-p5+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 does not affect Laravel 8.12.1-p5+tuxcare. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017), and the fix was already present in the upstream Laravel 8.12.1 release (December 2020) that TuxCare onboarded. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison, preventing...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 does not affect Laravel 8.12.1-p5+tuxcare. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017), and the fix was already present in the upstream Laravel 8.12.1 release (December 2020) that TuxCare onboarded. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison, preventing..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.1-p5+tuxcare of laravel/framework. The target Laravel v8.12.1 is NOT affected by CVE-2018-15133. The vulnerability (uncontrolled deserialization of encrypted cookie data) has been mitigated by the upstream Laravel framework prior to v8.12.1. The target code passes `false` to `decrypt()` for all cookie operations, preventing automatic unserialization and blocking PHP object injection attacks. This fix was authored by Taylor Otwell in August 2018 and was included in the upstream v8.12.1 release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "The target Laravel v8.12.1 is NOT affected by CVE-2018-15133. The vulnerability (uncontrolled deserialization of encrypted cookie data) has been mitigated by the upstream Laravel framework prior to v8.12.1. The target code passes `false` to `decrypt()` for all cookie operations, preventing automatic unserialization and blocking PHP object injection attacks. This fix was authored by Taylor Otwell in August 2018 and was included in the upstream v8.12.1 release that TuxCare onboarded." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.1-p5+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.1-p5+tuxcare of laravel/framework. The target Laravel Framework 8.12.1 is NOT AFFECTED by CVE-2020-19316. The vulnerable code pattern (unescaped shell parameters in the link() method's mklink exec call) is not present. The target has the proper fix with escapeshellarg() sanitization on both $link and $target parameters (line 320 of Filesystem.php). This fix was authored by upstream Laravel maintainer Taylor Otwell in May 2019 (commit 44c3feb604944599ad1c782a9942981c3991fa31) and was already present in the upstream Laravel 8.12.1 release when TuxCare onboarded it via snapshot commit 4993dfe2ac. CVE affected versions \"before 5.8.17\"; target is 8.12.1, which naturally includes the fix from the 5.8.17 era.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target Laravel Framework 8.12.1 is NOT AFFECTED by CVE-2020-19316. The vulnerable code pattern (unescaped shell parameters in the link() method's mklink exec call) is not present. The target has the proper fix with escapeshellarg() sanitization on both $link and $target parameters (line 320 of Filesystem.php). This fix was authored by upstream Laravel maintainer Taylor Otwell in May 2019 (commit 44c3feb604944599ad1c782a9942981c3991fa31) and was already present in the upstream Laravel 8.12.1 release when TuxCare onboarded it via snapshot commit 4993dfe2ac. CVE affected versions \"before 5.8.17\"; target is 8.12.1, which naturally includes the fix from the 5.8.17 era." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:41:10.796701+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.1-p5+tuxcare of laravel/framework. Laravel 8.12.1 was released after CVE-2020-24941 was fixed upstream. The vulnerability affected Laravel <6.18.35 and 7.x <7.24.0. The fix (commit 897d107) was applied on August 7, 2020, before Laravel 8.0's September 2020 release. Version 8.12.1 shipped with the fix already present: the isGuardableColumn() method validates attribute keys against actual database columns, preventing the JSON column nesting bypass. The vulnerable pattern (stripping '->' before guard checks) is not present. This is an upstream fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "Laravel 8.12.1 was released after CVE-2020-24941 was fixed upstream. The vulnerability affected Laravel <6.18.35 and 7.x <7.24.0. The fix (commit 897d107) was applied on August 7, 2020, before Laravel 8.0's September 2020 release. Version 8.12.1 shipped with the fix already present: the isGuardableColumn() method validates attribute keys against actual database columns, preventing the JSON column nesting bypass. The vulnerable pattern (stripping '->' before guard checks) is not present. This is an upstream fix, not a TuxCare backport." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.1-p5+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.1-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer that uses Tippy.js tooltips with allowHTML enabled. Laravel 8.x uses a completely different exception rendering system (Whoops library from filp/whoops) and does not contain the vulnerable code. The Tippy.js-based exception renderer infrastructure does not exist in this versio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer that uses Tippy.js tooltips with allowHTML enabled. Laravel 8.x uses a completely different exception rendering system (Whoops library from filp/whoops) and does not contain the vulnerable code. The Tippy.js-based exception renderer infrastructure does not exist in this versio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.1-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 11/12. Version 8.12.1 predates this feature entirely - it only has basic JsonResource with no include parameter processing or relationship compilation logic. The entire vulnerable code path is absent f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 11/12. Version 8.12.1 predates this feature entirely - it only has basic JsonResource with no include parameter processing or relationship compilation logic. The entire vulnerable code path is absent f..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:38:00.180821+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.1-p5+tuxcare of laravel/framework, and is fixed in 8.12.1-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.1-p5+tuxcare of laravel/framework, and is fixed in 8.12.1-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-28T20:53:45.635911+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.1-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via unsafe cookie deserialization). The vulnerability affected Laravel 5.6.x prior to 5.6.30 and was fixed in August 2018 by disabling cookie serialization. Laravel 8.12.1 (released December 2020) already contains the fix in its upstream release: `protected static $serialize = false` in EncryptCookies.php globally disab...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via unsafe cookie deserialization). The vulnerability affected Laravel 5.6.x prior to 5.6.30 and was fixed in August 2018 by disabling cookie serialization. Laravel 8.12.1 (released December 2020) already contains the fix in its upstream release: `protected static $serialize = false` in EncryptCookies.php globally disab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.1-p5+tuxcare of laravel/framework. not_affected \u2014 The Laravel Encrypter IV length validation vulnerability (GHSA-7852-w36x-6mf6) is NOT present in this target. The fix was included in upstream Laravel 8.12.1 (released December 2020) and imported via snapshot commit 4993dfe2ac. The validPayload method at lines 211-215 of src/Illuminate/Encryption/Encrypter.php contains the exact IV length validation (line 214: strlen(base64_decode($payload['iv'...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The Laravel Encrypter IV length validation vulnerability (GHSA-7852-w36x-6mf6) is NOT present in this target. The fix was included in upstream Laravel 8.12.1 (released December 2020) and imported via snapshot commit 4993dfe2ac. The validPayload method at lines 211-215 of src/Illuminate/Encryption/Encrypter.php contains the exact IV length validation (line 214: strlen(base64_decode($payload['iv'..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.1-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns ambiguous URL parsing in local filesystem temporary signed URLs, but Laravel 8.x does not have the local filesystem signed URL feature. The temporaryUrl() method throws RuntimeException for local storage adapters. This feature was introduced in Laravel 11+/12.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns ambiguous URL parsing in local filesystem temporary signed URLs, but Laravel 8.x does not have the local filesystem signed URL feature. The temporaryUrl() method throws RuntimeException for local storage adapters. This feature was introduced in Laravel 11+/12.x." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:14:30.754022+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.1-p5+tuxcare of laravel/framework. Target version 8.12.1-p5+tuxcare is NOT AFFECTED. The encryption oracle vulnerability (GHSA-qm5c-m76r-2hfr) was fixed in upstream Laravel framework on July 27, 2020, when Taylor Otwell replaced the unkeyed sha1() cookie prefix with a keyed HMAC via the CookieValuePrefix class. Laravel 8.12.1 was released November 5, 2020, four months AFTER the fix, so the vulnerable pattern is not present in the onboarded upstream release. The target uses CookieValuePrefix::create() with hash_hmac('sha1', $cookieName.'v2', $key), making cookie prefixes unforgeable without the encryption key.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Target version 8.12.1-p5+tuxcare is NOT AFFECTED. The encryption oracle vulnerability (GHSA-qm5c-m76r-2hfr) was fixed in upstream Laravel framework on July 27, 2020, when Taylor Otwell replaced the unkeyed sha1() cookie prefix with a keyed HMAC via the CookieValuePrefix class. Laravel 8.12.1 was released November 5, 2020, four months AFTER the fix, so the vulnerable pattern is not present in the onboarded upstream release. The target uses CookieValuePrefix::create() with hash_hmac('sha1', $cookieName.'v2', $key), making cookie prefixes unforgeable without the encryption key." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 6.20.45-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:45:39.779746+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 6.20.45-p3+tuxcare of laravel/framework. CVE-2018-15133 is NOT present in Laravel 6.20.45-p6+tuxcare. The vulnerability (RCE via unserialize on X-XSRF-TOKEN) was fixed in upstream Laravel 5.6.30/5.5.41 (August 2018) by disabling cookie serialization. The fix (protected static $serialize = false; using static::serialized() in decrypt calls) was already present when Laravel 6.20.45 was released and onboarded by TuxCare. The vulnerable code pattern does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 is NOT present in Laravel 6.20.45-p6+tuxcare. The vulnerability (RCE via unserialize on X-XSRF-TOKEN) was fixed in upstream Laravel 5.6.30/5.5.41 (August 2018) by disabling cookie serialization. The fix (protected static $serialize = false; using static::serialized() in decrypt calls) was already present when Laravel 6.20.45 was released and onboarded by TuxCare. The vulnerable code pattern does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 6.20.45-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 6.20.45-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 6.20.45-p3+tuxcare of laravel/framework. The target Laravel Framework 6.20.45 is NOT vulnerable to CVE-2020-19316. The vulnerable code pattern (unescaped parameters in Windows mklink exec call) is not present. The fix using escapeshellarg() was already included in the upstream Laravel v6.20.45 release that TuxCare onboarded. The vulnerability affected Laravel before 5.8.17 (patched May 2019), and version 6.20.45 already contains the upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target Laravel Framework 6.20.45 is NOT vulnerable to CVE-2020-19316. The vulnerable code pattern (unescaped parameters in Windows mklink exec call) is not present. The fix using escapeshellarg() was already included in the upstream Laravel v6.20.45 release that TuxCare onboarded. The vulnerability affected Laravel before 5.8.17 (patched May 2019), and version 6.20.45 already contains the upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:42:21.835037+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 6.20.45-p3+tuxcare of laravel/framework. The target Laravel framework version 6.20.45-p6+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability (mass assignment bypass via non-existent column names) was fixed in upstream Laravel v6.18.35 (commit 897d107775 by Taylor Otwell). The target version 6.20.45 already contains this fix, which validates that attribute keys exist as actual database columns via the isGuardableColumn() method. The fix was shipped in the upstream release and onboarded to TuxCare via snapshot commit abbc62d18a. The vulnerable pattern (allowing mass assignment to arbitrary non-column attributes) is not present in the target code.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel framework version 6.20.45-p6+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability (mass assignment bypass via non-existent column names) was fixed in upstream Laravel v6.18.35 (commit 897d107775 by Taylor Otwell). The target version 6.20.45 already contains this fix, which validates that attribute keys exist as actual database columns via the isGuardableColumn() method. The fix was shipped in the upstream release and onboarded to TuxCare via snapshot commit abbc62d18a. The vulnerable pattern (allowing mass assignment to arbitrary non-column attributes) is not present in the target code." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 6.20.45-p3+tuxcare of laravel/framework. CVE-2021-21263 affects Laravel versions <6.20.12. The target is version 6.20.45, which includes the upstream fix that prevents query binding exploitation. The vulnerability allowed array values to be passed to query builder methods where scalar values were expected, causing incorrect binding counts and corrupted query results. The target contains comprehensive protections using a `flattenValue()` helper method across all affected methods (where, having, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, whereBetween). The fix was present in the upstream v6.20.45 release and was imported via TuxCare's snapshot commit abbc62d18a, with no subsequent modifications to the query builder.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "CVE-2021-21263 affects Laravel versions <6.20.12. The target is version 6.20.45, which includes the upstream fix that prevents query binding exploitation. The vulnerability allowed array values to be passed to query builder methods where scalar values were expected, causing incorrect binding counts and corrupted query results. The target contains comprehensive protections using a `flattenValue()` helper method across all affected methods (where, having, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, whereBetween). The fix was present in the upstream v6.20.45 release and was imported via TuxCare's snapshot commit abbc62d18a, with no subsequent modifications to the query builder." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 6.20.45-p3+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:30:41.069534+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 6.20.45-p3+tuxcare of laravel/framework. The target repository (Laravel framework 6.20.45-p6+tuxcare) is not affected by CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled, allowing attackers to control environment detection through $_SERVER['argv']. The fix adds a runningInConsole() check before using argv values. This fix was already present in the upstream Laravel v6.20.45 release (authored by Taylor Otwell, taylor@laravel.com, Nov 2024) before TuxCare created their snapshot. The TuxCare branch started from a snapshot of v6.20.45 (commit abbc62d18a) which already contained the fixed code. No TuxCare backport was necessary as the vulnerable code pattern never existed in this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target repository (Laravel framework 6.20.45-p6+tuxcare) is not affected by CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled, allowing attackers to control environment detection through $_SERVER['argv']. The fix adds a runningInConsole() check before using argv values. This fix was already present in the upstream Laravel v6.20.45 release (authored by Taylor Otwell, taylor@laravel.com, Nov 2024) before TuxCare created their snapshot. The TuxCare branch started from a snapshot of v6.20.45 (commit abbc62d18a) which already contained the fixed code. No TuxCare backport was necessary as the vulnerable code pattern never existed in this branch." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-09-29T20:36:58.499788+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:46:15.891205+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 6.20.45-p3+tuxcare of laravel/framework, and is fixed in 6.20.45-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 6.20.45-p3+tuxcare of laravel/framework, and is fixed in 6.20.45-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:50:01.681995+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 6.20.45-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:05:58.501817+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:19:00.105438+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 6.20.45-p3+tuxcare of laravel/framework. Laravel Framework 6.20.45 is not affected by GHSA-qm5c-m76r-2hfr (encryption oracle RCE via cookie session driver). The vulnerability was fixed by upstream Laravel in version 6.18.31 on July 27, 2020, by replacing predictable SHA1 hash prefixes with keyed HMAC values in cookie encryption. Version 6.20.45 was released after this fix and already includes the CookieValuePrefix class with hash_hmac() implementation. The target contains the secure code pattern, not the vulnerable one.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel Framework 6.20.45 is not affected by GHSA-qm5c-m76r-2hfr (encryption oracle RCE via cookie session driver). The vulnerability was fixed by upstream Laravel in version 6.18.31 on July 27, 2020, by replacing predictable SHA1 hash prefixes with keyed HMAC values in cookie encryption. Version 6.20.45 was released after this fix and already includes the CookieValuePrefix class with hash_hmac() implementation. The target contains the secure code pattern, not the vulnerable one." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:42:21.835037+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 6.20.45-p3+tuxcare of laravel/framework. The target repository (Laravel 6.20.45) is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involving unexpected query bindings from array values has already been fixed in the upstream Laravel release v6.20.11 (Jan 13, 2021) and v6.20.14 (Jan 21, 2021), which were released well before v6.20.45. All query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the `flattenValue()` helper method to extract scalar values from array inputs, preventing the SQL binding mismatch vulnerability. The fix was authored by Taylor Otwell for the upstream Laravel framework and was included in the v6.20.45 release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "The target repository (Laravel 6.20.45) is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involving unexpected query bindings from array values has already been fixed in the upstream Laravel release v6.20.11 (Jan 13, 2021) and v6.20.14 (Jan 21, 2021), which were released well before v6.20.45. All query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the `flattenValue()` helper method to extract scalar values from array inputs, preventing the SQL binding mismatch vulnerability. The fix was authored by Taylor Otwell for the upstream Laravel framework and was included in the v6.20.45 release that TuxCare onboarded." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 5.8.38-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.8.38-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.8.38-p5+tuxcare of laravel/framework. The target (Laravel 5.8.38) is not affected by CVE-2018-15133. The vulnerability was fixed upstream by Taylor Otwell in August 2018 by disabling PHP serialization for cookies and the X-XSRF-TOKEN header. Laravel 5.8.38 shipped with this fix already applied. The fix prevents PHP object injection by passing `false` to encrypt()/decrypt() methods, which disables automatic unserialize() calls on decrypted data. The vulnerable code pattern (automatic unserialization enabling RCE via crafted XSRF tokens) is not present in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "The target (Laravel 5.8.38) is not affected by CVE-2018-15133. The vulnerability was fixed upstream by Taylor Otwell in August 2018 by disabling PHP serialization for cookies and the X-XSRF-TOKEN header. Laravel 5.8.38 shipped with this fix already applied. The fix prevents PHP object injection by passing `false` to encrypt()/decrypt() methods, which disables automatic unserialize() calls on decrypted data. The vulnerable code pattern (automatic unserialization enabling RCE via crafted XSRF tokens) is not present in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-10-19T13:14:00.236705+00:00", "status_notes": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.8.38-p5+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19).", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 5.8.38-p5+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before 5.8.17. The target is version 5.8.38-p8+tuxcare, which already contains the upstream fix. The vulnerability was an OS command injection in the link() function where unescaped $link and $target parameters were interpolated into an exec() call. The fix wraps both parameters with escapeshellarg() before shell execution. This fix was already present in the upstream Laravel 5.8.38 release and was imported via the Initial commit when TuxCare onboarded this version. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before 5.8.17. The target is version 5.8.38-p8+tuxcare, which already contains the upstream fix. The vulnerability was an OS command injection in the link() function where unescaped $link and $target parameters were interpolated into an exec() call. The fix wraps both parameters with escapeshellarg() before shell execution. This fix was already present in the upstream Laravel 5.8.38 release and was imported via the Initial commit when TuxCare onboarded this version. The vulnerable code pattern is not present in the target." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.8.38-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 5.8.38-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 5.8.38-p5+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.8.38-p5+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.8.38-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.8.38-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.8.38-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-09-29T20:33:09.068963+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.8.38-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.8.38-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-11-04T12:52:00.536685+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.8.38-p5+tuxcare of laravel/framework, and is fixed in 5.8.38-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.8.38-p5+tuxcare of laravel/framework, and is fixed in 5.8.38-p9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.8.38-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 5.8.38-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.8.38-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.8.38-p5+tuxcare of laravel/framework. not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.8.38-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.8.38-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.8.38-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare" } } ], "timestamp": "2026-11-04T12:51:46.244247+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 5.8.38-p9+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare" } } ], "timestamp": "2026-11-04T12:51:46.244247+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.8.38-p9+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare" } } ], "timestamp": "2026-11-04T12:51:46.244247+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.8.38-p9+tuxcare of laravel/framework. The target (Laravel 5.8.38) is not affected by CVE-2018-15133. The vulnerability was fixed upstream by Taylor Otwell in August 2018 by disabling PHP serialization for cookies and the X-XSRF-TOKEN header. Laravel 5.8.38 shipped with this fix already applied. The fix prevents PHP object injection by passing `false` to encrypt()/decrypt() methods, which disables automatic unserialize() calls on decrypted data. The vulnerable code pattern (automatic unserialization enabling RCE via crafted XSRF tokens) is not present in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "The target (Laravel 5.8.38) is not affected by CVE-2018-15133. The vulnerability was fixed upstream by Taylor Otwell in August 2018 by disabling PHP serialization for cookies and the X-XSRF-TOKEN header. Laravel 5.8.38 shipped with this fix already applied. The fix prevents PHP object injection by passing `false` to encrypt()/decrypt() methods, which disables automatic unserialize() calls on decrypted data. The vulnerable code pattern (automatic unserialization enabling RCE via crafted XSRF tokens) is not present in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare" } } ], "timestamp": "2026-11-04T12:51:46.244247+00:00", "status_notes": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.8.38-p9+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19).", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare" } } ], "timestamp": "2026-11-04T12:51:46.244247+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 5.8.38-p9+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before 5.8.17. The target is version 5.8.38-p8+tuxcare, which already contains the upstream fix. The vulnerability was an OS command injection in the link() function where unescaped $link and $target parameters were interpolated into an exec() call. The fix wraps both parameters with escapeshellarg() before shell execution. This fix was already present in the upstream Laravel 5.8.38 release and was imported via the Initial commit when TuxCare onboarded this version. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before 5.8.17. The target is version 5.8.38-p8+tuxcare, which already contains the upstream fix. The vulnerability was an OS command injection in the link() function where unescaped $link and $target parameters were interpolated into an exec() call. The fix wraps both parameters with escapeshellarg() before shell execution. This fix was already present in the upstream Laravel 5.8.38 release and was imported via the Initial commit when TuxCare onboarded this version. The vulnerable code pattern is not present in the target." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare" } } ], "timestamp": "2026-11-04T12:51:46.244247+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.8.38-p9+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare" } } ], "timestamp": "2026-11-04T12:51:46.244247+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 5.8.38-p9+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 5.8.38-p9+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare" } } ], "timestamp": "2026-11-04T12:51:46.244247+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.8.38-p9+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare" } } ], "timestamp": "2026-11-04T12:51:46.244247+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.8.38-p9+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare" } } ], "timestamp": "2026-11-04T12:51:46.244247+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.8.38-p9+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare" } } ], "timestamp": "2026-11-04T12:51:46.244247+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.8.38-p9+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare" } } ], "timestamp": "2026-11-04T12:51:46.244247+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.8.38-p9+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare" } } ], "timestamp": "2026-11-04T12:51:46.244247+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.8.38-p9+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare" } } ], "timestamp": "2026-11-04T12:52:00.536685+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 5.8.38-p9+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare" } } ], "timestamp": "2026-11-04T12:51:46.244247+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.8.38-p9+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare" } } ], "timestamp": "2026-11-04T12:51:46.244247+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 5.8.38-p9+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare" } } ], "timestamp": "2026-11-04T12:51:46.244247+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.8.38-p9+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare" } } ], "timestamp": "2026-11-04T12:51:46.244247+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.8.38-p9+tuxcare of laravel/framework. not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare" } } ], "timestamp": "2026-11-04T12:51:46.244247+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.8.38-p9+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare" } } ], "timestamp": "2026-11-04T12:51:46.244247+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p9+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p9+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare" } } ], "timestamp": "2026-11-04T12:51:46.244247+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.8.38-p9+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare" } } ], "timestamp": "2026-11-04T12:51:46.244247+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p9+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p9+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p9+tuxcare" } } ], "timestamp": "2026-11-04T12:51:46.244247+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.8.38-p9+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare" } } ], "timestamp": "2026-10-29T11:03:15.587736+00:00", "status_notes": "Vulnerability CVE-2015-8379 does not affect version 5.0.11-p1+tuxcare of cakephp/cakephp. CVE-2015-8379 affects CakePHP 2.x and 3.x before 3.1.5, where CsrfComponent validated CSRF tokens only for PATCH/PUT/POST/DELETE. CakePHP 5.0.11 does not contain that code: CSRF protection is provided by CsrfProtectionMiddleware, and the upstream 3.1.5 fix has never been applied to it upstream (unchanged on the 5.x branch). The version is outside the NVD affected range.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-8379" }, "impact_statement": "CVE-2015-8379 affects CakePHP 2.x and 3.x before 3.1.5, where CsrfComponent validated CSRF tokens only for PATCH/PUT/POST/DELETE. CakePHP 5.0.11 does not contain that code: CSRF protection is provided by CsrfProtectionMiddleware, and the upstream 3.1.5 fix has never been applied to it upstream (unchanged on the 5.x branch). The version is outside the NVD affected range." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:37:14.382670+00:00", "status_notes": "Vulnerability CVE-2020-15400 does not affect version 5.0.11-p1+tuxcare of cakephp/cakephp. not_affected \u2014 CVE-2020-15400 (CSRF token fixation vulnerability) is not present in CakePHP 5.0.11. The HMAC-based token generation and verification fix was already included in the upstream CakePHP 5.0.11 release before TuxCare onboarded this version. The vulnerable code pattern (accepting any matching token pair without cryptographic proof of origin) does not exist in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-15400" }, "impact_statement": "not_affected \u2014 CVE-2020-15400 (CSRF token fixation vulnerability) is not present in CakePHP 5.0.11. The HMAC-based token generation and verification fix was already included in the upstream CakePHP 5.0.11 release before TuxCare onboarded this version. The vulnerable code pattern (accepting any matching token pair without cryptographic proof of origin) does not exist in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare" } } ], "timestamp": "2026-11-04T15:47:28.949866+00:00", "status_notes": "Vulnerability CVE-2026-119415 affects version 5.0.11-p1+tuxcare of cakephp/cakephp, and is fixed in 5.0.11-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-119415" }, "action_statement": "Vulnerability CVE-2026-119415 affects version 5.0.11-p1+tuxcare of cakephp/cakephp, and is fixed in 5.0.11-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare" } } ], "timestamp": "2026-11-04T15:47:28.949866+00:00", "status_notes": "Vulnerability CVE-2026-119416 affects version 5.0.11-p1+tuxcare of cakephp/cakephp, and is fixed in 5.0.11-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-119416" }, "action_statement": "Vulnerability CVE-2026-119416 affects version 5.0.11-p1+tuxcare of cakephp/cakephp, and is fixed in 5.0.11-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare" } } ], "timestamp": "2026-11-04T15:47:28.949866+00:00", "status_notes": "Vulnerability CVE-2026-119417 affects version 5.0.11-p1+tuxcare of cakephp/cakephp, and is fixed in 5.0.11-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-119417" }, "action_statement": "Vulnerability CVE-2026-119417 affects version 5.0.11-p1+tuxcare of cakephp/cakephp, and is fixed in 5.0.11-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare" } } ], "timestamp": "2026-11-04T15:47:28.949866+00:00", "status_notes": "Vulnerability CVE-2026-119418 affects version 5.0.11-p1+tuxcare of cakephp/cakephp, and is fixed in 5.0.11-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-119418" }, "action_statement": "Vulnerability CVE-2026-119418 affects version 5.0.11-p1+tuxcare of cakephp/cakephp, and is fixed in 5.0.11-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare" } } ], "timestamp": "2026-11-04T15:47:28.949866+00:00", "status_notes": "Vulnerability CVE-2026-119419 affects version 5.0.11-p1+tuxcare of cakephp/cakephp, and is fixed in 5.0.11-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-119419" }, "action_statement": "Vulnerability CVE-2026-119419 affects version 5.0.11-p1+tuxcare of cakephp/cakephp, and is fixed in 5.0.11-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:20:02.367849+00:00", "status_notes": "Vulnerability CVE-2026-48820 is fixed in version 5.0.11-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-48820" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:20:02.367849+00:00", "status_notes": "Vulnerability CVE-2026-77634 is fixed in version 5.0.11-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-77634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:20:02.367849+00:00", "status_notes": "Vulnerability CVE-2026-79752 is fixed in version 5.0.11-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-79752" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.5.50-p2+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 is NOT present in Laravel 5.5.50-p4+tuxcare. The vulnerability affected Laravel before 5.5.10 due to non-constant-time token comparison in DatabaseUserProvider and EloquentUserProvider. The target version (5.5.50) already contains the upstream fix that was applied in Laravel 5.5.10, which replaced database-level string comparison with hash_equals() for constant-time comparison. T...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 is NOT present in Laravel 5.5.50-p4+tuxcare. The vulnerability affected Laravel before 5.5.10 due to non-constant-time token comparison in DatabaseUserProvider and EloquentUserProvider. The target version (5.5.50) already contains the upstream fix that was applied in Laravel 5.5.10, which replaced database-level string comparison with hash_equals() for constant-time comparison. T..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.5.50-p2+tuxcare of laravel/framework. Version 5.5.50 is not vulnerable. Summary: The target Laravel Framework v5.5.50-p2+tuxcare is NOT vulnerable to CVE-2018-15133. While the X-XSRF-TOKEN decryption feature exists, the vulnerable code pattern does not. The fix has been properly applied: the decrypt() method is called with false as the second parameter (via static::serialized()), preventing unsafe deserialization of the X-XSRF-TOKEN header value.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "Version 5.5.50 is not vulnerable. Summary: The target Laravel Framework v5.5.50-p2+tuxcare is NOT vulnerable to CVE-2018-15133. While the X-XSRF-TOKEN decryption feature exists, the vulnerable code pattern does not. The fix has been properly applied: the decrypt() method is called with false as the second parameter (via static::serialized()), preventing unsafe deserialization of the X-XSRF-TOKEN header value." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 5.5.50-p2+tuxcare of laravel/framework. CVE-2019-9081 was officially REJECTED by MITRE in 2022 as \"not a security issue\" after further investigation. Additionally, the target Laravel 5.5.50 does not contain the PendingCommand class mentioned in the CVE description. The CVE specifically references Laravel Framework 5.7.x and the PendingCommand class in PendingCommand.php, neither of which exist in version 5.5.50. Since the CVE itself is not a valid security vulnerability and the referenced code is absent, the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 was officially REJECTED by MITRE in 2022 as \"not a security issue\" after further investigation. Additionally, the target Laravel 5.5.50 does not contain the PendingCommand class mentioned in the CVE description. The CVE specifically references Laravel Framework 5.7.x and the PendingCommand class in PendingCommand.php, neither of which exist in version 5.5.50. Since the CVE itself is not a valid security vulnerability and the referenced code is absent, the target is not affected." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.5.50-p2+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43617" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.5.50-p2+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:17:00.109653+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.5.50-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in later versions (present in Laravel 12.x). Laravel 5.5.50 uses a completely different exception rendering architecture based on Whoops or Symfony ExceptionHandler, and does not contain the vulnerable component. The entire `src/Illumina...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in later versions (present in Laravel 12.x). Laravel 5.5.50 uses a completely different exception rendering architecture based on Whoops or Symfony ExceptionHandler, and does not contain the vulnerable component. The entire `src/Illumina..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:40:33.053070+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.5.50-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-114508. The vulnerability requires JsonAPI Resources support (Illuminate\\Http\\Resources\\JsonApi\\*), which was introduced in much later versions of Laravel (10+). Laravel 5.5 only has basic JSON Resources (Illuminate\\Http\\Resources\\Json\\*) that do not parse ?include= query parameters for relationship loading. While the underlying Eloquent ORM could theo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-114508. The vulnerability requires JsonAPI Resources support (Illuminate\\Http\\Resources\\JsonApi\\*), which was introduced in much later versions of Laravel (10+). Laravel 5.5 only has basic JSON Resources (Illuminate\\Http\\Resources\\Json\\*) that do not parse ?include= query parameters for relationship loading. While the underlying Eloquent ORM could theo..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-11-04T16:58:23.008576+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.5.50-p2+tuxcare of laravel/framework, and is fixed in 5.5.50-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.5.50-p2+tuxcare of laravel/framework, and is fixed in 5.5.50-p5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.5.50-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 uses SwiftMailer v6.3.0, not Symfony Mailer. The CVE explicitly describes a combination vulnerability requiring both Laravel's missing CRLF validation AND Symfony Mailer/Mime's specific handling of CRLF characters. Since the target uses a different mail library (SwiftMailer), the specific attack chain described in the CVE cannot be completed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 uses SwiftMailer v6.3.0, not Symfony Mailer. The CVE explicitly describes a combination vulnerability requiring both Laravel's missing CRLF validation AND Symfony Mailer/Mime's specific handling of CRLF characters. Since the target uses a different mail library (SwiftMailer), the specific attack chain described in the CVE cannot be completed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.5.50-p2+tuxcare of laravel/framework. Version 5.5.50 is not vulnerable. Summary: The target repository (Laravel 5.5.50-p2+tuxcare) is NOT VULNERABLE to GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie serialization). The repository has been patched with a global serialization disable mechanism that is more secure than the vendor's original selective fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "Version 5.5.50 is not vulnerable. Summary: The target repository (Laravel 5.5.50-p2+tuxcare) is NOT VULNERABLE to GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie serialization). The repository has been patched with a global serialization disable mechanism that is more secure than the vendor's original selective fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.5.50-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework 5.5.50-p4+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The IV length validation fix is present in the code (src/Illuminate/Encryption/Encrypter.php lines 209-210), preventing manipulated payloads with wrong-length IVs from causing decryption to return false. This fix was already included in the upstream Laravel 5.5.50 release (committed by Taylor Otwell in March ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel Framework 5.5.50-p4+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The IV length validation fix is present in the code (src/Illuminate/Encryption/Encrypter.php lines 209-210), preventing manipulated payloads with wrong-length IVs from causing decryption to return false. This fix was already included in the upstream Laravel 5.5.50 release (committed by Taylor Otwell in March ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.5.50-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 5.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 5.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.5.50-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.5.50-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.5.50-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.5.50-p4+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 is NOT present in Laravel 5.5.50-p4+tuxcare. The vulnerability affected Laravel before 5.5.10 due to non-constant-time token comparison in DatabaseUserProvider and EloquentUserProvider. The target version (5.5.50) already contains the upstream fix that was applied in Laravel 5.5.10, which replaced database-level string comparison with hash_equals() for constant-time comparison. T...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 is NOT present in Laravel 5.5.50-p4+tuxcare. The vulnerability affected Laravel before 5.5.10 due to non-constant-time token comparison in DatabaseUserProvider and EloquentUserProvider. The target version (5.5.50) already contains the upstream fix that was applied in Laravel 5.5.10, which replaced database-level string comparison with hash_equals() for constant-time comparison. T..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.5.50-p4+tuxcare of laravel/framework. Version 5.5.50 is not vulnerable. Summary: The target Laravel Framework v5.5.50-p2+tuxcare is NOT vulnerable to CVE-2018-15133. While the X-XSRF-TOKEN decryption feature exists, the vulnerable code pattern does not. The fix has been properly applied: the decrypt() method is called with false as the second parameter (via static::serialized()), preventing unsafe deserialization of the X-XSRF-TOKEN header value.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "Version 5.5.50 is not vulnerable. Summary: The target Laravel Framework v5.5.50-p2+tuxcare is NOT vulnerable to CVE-2018-15133. While the X-XSRF-TOKEN decryption feature exists, the vulnerable code pattern does not. The fix has been properly applied: the decrypt() method is called with false as the second parameter (via static::serialized()), preventing unsafe deserialization of the X-XSRF-TOKEN header value." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 5.5.50-p4+tuxcare of laravel/framework. CVE-2019-9081 was officially REJECTED by MITRE in 2022 as \"not a security issue\" after further investigation. Additionally, the target Laravel 5.5.50 does not contain the PendingCommand class mentioned in the CVE description. The CVE specifically references Laravel Framework 5.7.x and the PendingCommand class in PendingCommand.php, neither of which exist in version 5.5.50. Since the CVE itself is not a valid security vulnerability and the referenced code is absent, the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 was officially REJECTED by MITRE in 2022 as \"not a security issue\" after further investigation. Additionally, the target Laravel 5.5.50 does not contain the PendingCommand class mentioned in the CVE description. The CVE specifically references Laravel Framework 5.7.x and the PendingCommand class in PendingCommand.php, neither of which exist in version 5.5.50. Since the CVE itself is not a valid security vulnerability and the referenced code is absent, the target is not affected." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.5.50-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.5.50-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.5.50-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.5.50-p4+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability CVE-2021-43617 is fixed in version 5.5.50-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43617" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.5.50-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.5.50-p4+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.5.50-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.5.50-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.5.50-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in later versions (present in Laravel 12.x). Laravel 5.5.50 uses a completely different exception rendering architecture based on Whoops or Symfony ExceptionHandler, and does not contain the vulnerable component. The entire `src/Illumina...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in later versions (present in Laravel 12.x). Laravel 5.5.50 uses a completely different exception rendering architecture based on Whoops or Symfony ExceptionHandler, and does not contain the vulnerable component. The entire `src/Illumina..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:40:33.053070+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.5.50-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-114508. The vulnerability requires JsonAPI Resources support (Illuminate\\Http\\Resources\\JsonApi\\*), which was introduced in much later versions of Laravel (10+). Laravel 5.5 only has basic JSON Resources (Illuminate\\Http\\Resources\\Json\\*) that do not parse ?include= query parameters for relationship loading. While the underlying Eloquent ORM could theo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-114508. The vulnerability requires JsonAPI Resources support (Illuminate\\Http\\Resources\\JsonApi\\*), which was introduced in much later versions of Laravel (10+). Laravel 5.5 only has basic JSON Resources (Illuminate\\Http\\Resources\\Json\\*) that do not parse ?include= query parameters for relationship loading. While the underlying Eloquent ORM could theo..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-11-04T16:58:23.008576+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.5.50-p4+tuxcare of laravel/framework, and is fixed in 5.5.50-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.5.50-p4+tuxcare of laravel/framework, and is fixed in 5.5.50-p5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.5.50-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.5.50-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 uses SwiftMailer v6.3.0, not Symfony Mailer. The CVE explicitly describes a combination vulnerability requiring both Laravel's missing CRLF validation AND Symfony Mailer/Mime's specific handling of CRLF characters. Since the target uses a different mail library (SwiftMailer), the specific attack chain described in the CVE cannot be completed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 uses SwiftMailer v6.3.0, not Symfony Mailer. The CVE explicitly describes a combination vulnerability requiring both Laravel's missing CRLF validation AND Symfony Mailer/Mime's specific handling of CRLF characters. Since the target uses a different mail library (SwiftMailer), the specific attack chain described in the CVE cannot be completed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.5.50-p4+tuxcare of laravel/framework. Version 5.5.50 is not vulnerable. Summary: The target repository (Laravel 5.5.50-p2+tuxcare) is NOT VULNERABLE to GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie serialization). The repository has been patched with a global serialization disable mechanism that is more secure than the vendor's original selective fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "Version 5.5.50 is not vulnerable. Summary: The target repository (Laravel 5.5.50-p2+tuxcare) is NOT VULNERABLE to GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie serialization). The repository has been patched with a global serialization disable mechanism that is more secure than the vendor's original selective fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.5.50-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework 5.5.50-p4+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The IV length validation fix is present in the code (src/Illuminate/Encryption/Encrypter.php lines 209-210), preventing manipulated payloads with wrong-length IVs from causing decryption to return false. This fix was already included in the upstream Laravel 5.5.50 release (committed by Taylor Otwell in March ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel Framework 5.5.50-p4+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The IV length validation fix is present in the code (src/Illuminate/Encryption/Encrypter.php lines 209-210), preventing manipulated payloads with wrong-length IVs from causing decryption to return false. This fix was already included in the upstream Laravel 5.5.50 release (committed by Taylor Otwell in March ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.5.50-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 5.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 5.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.5.50-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.5.50-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.5.50-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.5.50-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.5.50-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } } ], "timestamp": "2026-10-12T06:59:00.094048+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.5.50-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 5.8.38-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.8.38-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.8.38-p2+tuxcare of laravel/framework. The target (Laravel 5.8.38) is not affected by CVE-2018-15133. The vulnerability was fixed upstream by Taylor Otwell in August 2018 by disabling PHP serialization for cookies and the X-XSRF-TOKEN header. Laravel 5.8.38 shipped with this fix already applied. The fix prevents PHP object injection by passing `false` to encrypt()/decrypt() methods, which disables automatic unserialize() calls on decrypted data. The vulnerable code pattern (automatic unserialization enabling RCE via crafted XSRF tokens) is not present in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "The target (Laravel 5.8.38) is not affected by CVE-2018-15133. The vulnerability was fixed upstream by Taylor Otwell in August 2018 by disabling PHP serialization for cookies and the X-XSRF-TOKEN header. Laravel 5.8.38 shipped with this fix already applied. The fix prevents PHP object injection by passing `false` to encrypt()/decrypt() methods, which disables automatic unserialize() calls on decrypted data. The vulnerable code pattern (automatic unserialization enabling RCE via crafted XSRF tokens) is not present in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-10-19T13:14:00.236705+00:00", "status_notes": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.8.38-p2+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19).", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 5.8.38-p2+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before 5.8.17. The target is version 5.8.38-p8+tuxcare, which already contains the upstream fix. The vulnerability was an OS command injection in the link() function where unescaped $link and $target parameters were interpolated into an exec() call. The fix wraps both parameters with escapeshellarg() before shell execution. This fix was already present in the upstream Laravel 5.8.38 release and was imported via the Initial commit when TuxCare onboarded this version. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before 5.8.17. The target is version 5.8.38-p8+tuxcare, which already contains the upstream fix. The vulnerability was an OS command injection in the link() function where unescaped $link and $target parameters were interpolated into an exec() call. The fix wraps both parameters with escapeshellarg() before shell execution. This fix was already present in the upstream Laravel 5.8.38 release and was imported via the Initial commit when TuxCare onboarded this version. The vulnerable code pattern is not present in the target." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.8.38-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 5.8.38-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 5.8.38-p2+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.8.38-p2+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.8.38-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 5.8.38-p2+tuxcare of laravel/framework, and is fixed in 5.8.38-p4+tuxcare.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 5.8.38-p2+tuxcare of laravel/framework, and is fixed in 5.8.38-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 affects version 5.8.38-p2+tuxcare of laravel/framework, and is fixed in 5.8.38-p4+tuxcare.", "vulnerability": { "name": "CVE-2025-27515" }, "action_statement": "Vulnerability CVE-2025-27515 affects version 5.8.38-p2+tuxcare of laravel/framework, and is fixed in 5.8.38-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:33:09.068963+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.8.38-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.8.38-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-11-04T12:52:00.536685+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.8.38-p2+tuxcare of laravel/framework, and is fixed in 5.8.38-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.8.38-p2+tuxcare of laravel/framework, and is fixed in 5.8.38-p9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.8.38-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 5.8.38-p2+tuxcare of laravel/framework, and is fixed in 5.8.38-p5+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 5.8.38-p2+tuxcare of laravel/framework, and is fixed in 5.8.38-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.8.38-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.8.38-p2+tuxcare of laravel/framework. not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.8.38-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.8.38-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.8.38-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 5.8.38-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.8.38-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.8.38-p3+tuxcare of laravel/framework. The target (Laravel 5.8.38) is not affected by CVE-2018-15133. The vulnerability was fixed upstream by Taylor Otwell in August 2018 by disabling PHP serialization for cookies and the X-XSRF-TOKEN header. Laravel 5.8.38 shipped with this fix already applied. The fix prevents PHP object injection by passing `false` to encrypt()/decrypt() methods, which disables automatic unserialize() calls on decrypted data. The vulnerable code pattern (automatic unserialization enabling RCE via crafted XSRF tokens) is not present in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "The target (Laravel 5.8.38) is not affected by CVE-2018-15133. The vulnerability was fixed upstream by Taylor Otwell in August 2018 by disabling PHP serialization for cookies and the X-XSRF-TOKEN header. Laravel 5.8.38 shipped with this fix already applied. The fix prevents PHP object injection by passing `false` to encrypt()/decrypt() methods, which disables automatic unserialize() calls on decrypted data. The vulnerable code pattern (automatic unserialization enabling RCE via crafted XSRF tokens) is not present in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-10-19T13:14:00.236705+00:00", "status_notes": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.8.38-p3+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19).", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 5.8.38-p3+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before 5.8.17. The target is version 5.8.38-p8+tuxcare, which already contains the upstream fix. The vulnerability was an OS command injection in the link() function where unescaped $link and $target parameters were interpolated into an exec() call. The fix wraps both parameters with escapeshellarg() before shell execution. This fix was already present in the upstream Laravel 5.8.38 release and was imported via the Initial commit when TuxCare onboarded this version. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before 5.8.17. The target is version 5.8.38-p8+tuxcare, which already contains the upstream fix. The vulnerability was an OS command injection in the link() function where unescaped $link and $target parameters were interpolated into an exec() call. The fix wraps both parameters with escapeshellarg() before shell execution. This fix was already present in the upstream Laravel 5.8.38 release and was imported via the Initial commit when TuxCare onboarded this version. The vulnerable code pattern is not present in the target." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.8.38-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 5.8.38-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 5.8.38-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.8.38-p3+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.8.38-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 5.8.38-p3+tuxcare of laravel/framework, and is fixed in 5.8.38-p4+tuxcare.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 5.8.38-p3+tuxcare of laravel/framework, and is fixed in 5.8.38-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 affects version 5.8.38-p3+tuxcare of laravel/framework, and is fixed in 5.8.38-p4+tuxcare.", "vulnerability": { "name": "CVE-2025-27515" }, "action_statement": "Vulnerability CVE-2025-27515 affects version 5.8.38-p3+tuxcare of laravel/framework, and is fixed in 5.8.38-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-09-29T20:33:09.068963+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.8.38-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.8.38-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-11-04T12:52:00.536685+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.8.38-p3+tuxcare of laravel/framework, and is fixed in 5.8.38-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.8.38-p3+tuxcare of laravel/framework, and is fixed in 5.8.38-p9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.8.38-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 5.8.38-p3+tuxcare of laravel/framework, and is fixed in 5.8.38-p5+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 5.8.38-p3+tuxcare of laravel/framework, and is fixed in 5.8.38-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.8.38-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.8.38-p3+tuxcare of laravel/framework. not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.8.38-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.8.38-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.8.38-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 5.8.38-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.8.38-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.8.38-p4+tuxcare of laravel/framework. The target (Laravel 5.8.38) is not affected by CVE-2018-15133. The vulnerability was fixed upstream by Taylor Otwell in August 2018 by disabling PHP serialization for cookies and the X-XSRF-TOKEN header. Laravel 5.8.38 shipped with this fix already applied. The fix prevents PHP object injection by passing `false` to encrypt()/decrypt() methods, which disables automatic unserialize() calls on decrypted data. The vulnerable code pattern (automatic unserialization enabling RCE via crafted XSRF tokens) is not present in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "The target (Laravel 5.8.38) is not affected by CVE-2018-15133. The vulnerability was fixed upstream by Taylor Otwell in August 2018 by disabling PHP serialization for cookies and the X-XSRF-TOKEN header. Laravel 5.8.38 shipped with this fix already applied. The fix prevents PHP object injection by passing `false` to encrypt()/decrypt() methods, which disables automatic unserialize() calls on decrypted data. The vulnerable code pattern (automatic unserialization enabling RCE via crafted XSRF tokens) is not present in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-10-19T13:14:00.236705+00:00", "status_notes": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.8.38-p4+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19).", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 5.8.38-p4+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before 5.8.17. The target is version 5.8.38-p8+tuxcare, which already contains the upstream fix. The vulnerability was an OS command injection in the link() function where unescaped $link and $target parameters were interpolated into an exec() call. The fix wraps both parameters with escapeshellarg() before shell execution. This fix was already present in the upstream Laravel 5.8.38 release and was imported via the Initial commit when TuxCare onboarded this version. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before 5.8.17. The target is version 5.8.38-p8+tuxcare, which already contains the upstream fix. The vulnerability was an OS command injection in the link() function where unescaped $link and $target parameters were interpolated into an exec() call. The fix wraps both parameters with escapeshellarg() before shell execution. This fix was already present in the upstream Laravel 5.8.38 release and was imported via the Initial commit when TuxCare onboarded this version. The vulnerable code pattern is not present in the target." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.8.38-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 5.8.38-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 5.8.38-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.8.38-p4+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.8.38-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.8.38-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.8.38-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-09-29T20:33:09.068963+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.8.38-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.8.38-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-11-04T12:52:00.536685+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.8.38-p4+tuxcare of laravel/framework, and is fixed in 5.8.38-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.8.38-p4+tuxcare of laravel/framework, and is fixed in 5.8.38-p9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.8.38-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 5.8.38-p4+tuxcare of laravel/framework, and is fixed in 5.8.38-p5+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 5.8.38-p4+tuxcare of laravel/framework, and is fixed in 5.8.38-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.8.38-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.8.38-p4+tuxcare of laravel/framework. not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.8.38-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.8.38-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.8.38-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.6.40-p4+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time remember_me token comparison in DatabaseUserProvider and EloquentUserProvider. The target Laravel 5.6.40-p4+tuxcare already contains the upstream fix: both providers use hash_equals() for constant-time comparison with proper null checks. The fix was introduced in Laravel 5.5.10 (Sept 2017) and inherited by all subsequent rele...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time remember_me token comparison in DatabaseUserProvider and EloquentUserProvider. The target Laravel 5.6.40-p4+tuxcare already contains the upstream fix: both providers use hash_equals() for constant-time comparison with proper null checks. The fix was introduced in Laravel 5.5.10 (Sept 2017) and inherited by all subsequent rele..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.6.40-p4+tuxcare of laravel/framework. CVE-2018-15133 affects Laravel 5.6.x through 5.6.29 (RCE via unserialized XSRF-TOKEN). Target repository is Laravel 5.6.40, onboarded to TuxCare on 2025-08-23 with the upstream fix already present. The vulnerable pattern (decrypt with serialization=true on untrusted XSRF-TOKEN) never existed in this repository's history. Upstream Laravel fixed the vulnerability in version 5.6.30 (August 2018) by disabling cookie serialization. The onboarding commit brought in the already-fixed version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 affects Laravel 5.6.x through 5.6.29 (RCE via unserialized XSRF-TOKEN). Target repository is Laravel 5.6.40, onboarded to TuxCare on 2025-08-23 with the upstream fix already present. The vulnerable pattern (decrypt with serialization=true on untrusted XSRF-TOKEN) never existed in this repository's history. Upstream Laravel fixed the vulnerability in version 5.6.30 (August 2018) by disabling cookie serialization. The onboarding commit brought in the already-fixed version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 5.6.40-p4+tuxcare of laravel/framework. CVE-2019-9081 affects Laravel Framework 5.7.x, specifically the __destruct method of the PendingCommand class in src/Illuminate/Foundation/Testing/PendingCommand.php. This class enables deserialization attacks where an attacker can execute arbitrary console commands. However, the target version 5.6.40 does not contain the PendingCommand class at all - it was introduced in version 5.7.0. Exhaustive searches confirmed no PendingCommand file or class definition exists at target SHA 3012d3fbc4a1e56a5d5db1d469bb4d4cf306a032. While other Pending* classes with __destruct methods exist in 5.6.40 (PendingBroadcast, PendingDispatch, PendingResourceRegistration), none execute console commands. The vulnerability pattern specific to CVE-2019-9081 cannot exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 affects Laravel Framework 5.7.x, specifically the __destruct method of the PendingCommand class in src/Illuminate/Foundation/Testing/PendingCommand.php. This class enables deserialization attacks where an attacker can execute arbitrary console commands. However, the target version 5.6.40 does not contain the PendingCommand class at all - it was introduced in version 5.7.0. Exhaustive searches confirmed no PendingCommand file or class definition exists at target SHA 3012d3fbc4a1e56a5d5db1d469bb4d4cf306a032. While other Pending* classes with __destruct methods exist in 5.6.40 (PendingBroadcast, PendingDispatch, PendingResourceRegistration), none execute console commands. The vulnerability pattern specific to CVE-2019-9081 cannot exist in this version." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.6.40-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.6.40-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.6.40-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.6.40-p4+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.6.40-p4+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.6.40-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.6.40-p4+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.6.40-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.6.40-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.6.40-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer (introduced in Laravel 8+) which uses Tippy.js tooltips with allowHTML: true for displaying user-controlled data. Laravel 5.6.40 uses the Whoops library and Symfony's ExceptionHandler for exception rendering, not Laravel's custom renderer. The vulnerable code path (Tippy.js with al...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer (introduced in Laravel 8+) which uses Tippy.js tooltips with allowHTML: true for displaying user-controlled data. Laravel 5.6.40 uses the Whoops library and Symfony's ExceptionHandler for exception rendering, not Laravel's custom renderer. The vulnerable code path (Tippy.js with al..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.6.40-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 does not contain the JSON:API resources feature that is affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API implementation (specifically in ResolvesJsonApiElements trait) which was introduced in Laravel 10+, approximately 4-5 major versions after 5.6. The target repository contains only basic JSON resources (Json\\JsonResource) but not JSON:API spec-complia...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 does not contain the JSON:API resources feature that is affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API implementation (specifically in ResolvesJsonApiElements trait) which was introduced in Laravel 10+, approximately 4-5 major versions after 5.6. The target repository contains only basic JSON resources (Json\\JsonResource) but not JSON:API spec-complia..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-11-04T12:55:04.611483+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.6.40-p4+tuxcare of laravel/framework, and is fixed in 5.6.40-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.6.40-p4+tuxcare of laravel/framework, and is fixed in 5.6.40-p5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.6.40-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.6.40-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40-p1+tuxcare uses SwiftMailer 6.3.0, not the Symfony Mailer targeted by GHSA-5vg9-5847-vvmq. SwiftMailer's Egulias EmailValidator provides CRLF validation that prevents the vulnerability pattern from manifesting.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40-p1+tuxcare uses SwiftMailer 6.3.0, not the Symfony Mailer targeted by GHSA-5vg9-5847-vvmq. SwiftMailer's Egulias EmailValidator provides CRLF validation that prevents the vulnerability pattern from manifesting." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:54:01.721135+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.6.40-p4+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization vulnerability in cookies). The fix was included in upstream Laravel 5.6.30 and is present in 5.6.40. The EncryptCookies middleware enforces static::$serialize = false for all cookie encryption/decryption operations, preventing PHP object serialization attacks. Additional hardening in Recaller cla...", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization vulnerability in cookies). The fix was included in upstream Laravel 5.6.30 and is present in 5.6.40. The EncryptCookies middleware enforces static::$serialize = false for all cookie encryption/decryption operations, preventing PHP object serialization attacks. Additional hardening in Recaller cla..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.6.40-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-7852-w36x-6mf6. The fix for the IV length validation vulnerability was shipped in the upstream Laravel 5.6.40 release, which TuxCare imported. The vulnerable code pattern (missing IV length check in the Encrypter's validPayload method) is not present; the fix validating that `strlen(base64_decode($payload['iv'], true)) === openssl_cip...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-7852-w36x-6mf6. The fix for the IV length validation vulnerability was shipped in the upstream Laravel 5.6.40 release, which TuxCare imported. The vulnerable code pattern (missing IV length check in the Encrypter's validPayload method) is not present; the fix validating that `strlen(base64_decode($payload['iv'], true)) === openssl_cip..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.6.40-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 does not have the vulnerable LocalFilesystemAdapter class or signed URL generation for local filesystem. The feature was introduced in Laravel 11+ (September 2024), years after this version. The FilesystemAdapter.temporaryUrl() method explicitly throws RuntimeException for local adapters - the feature is unsupported.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 does not have the vulnerable LocalFilesystemAdapter class or signed URL generation for local filesystem. The feature was introduced in Laravel 11+ (September 2024), years after this version. The FilesystemAdapter.temporaryUrl() method explicitly throws RuntimeException for local adapters - the feature is unsupported." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.6.40-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.6.40-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.6.40-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.6.40-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.6.40-p4+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p4+tuxcare" } } ], "timestamp": "2026-10-26T16:18:32.544950+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.6.40-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T12:25:14.970763+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 5.8.38-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.8.38-p8+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.8.38-p8+tuxcare of laravel/framework. The target (Laravel 5.8.38) is not affected by CVE-2018-15133. The vulnerability was fixed upstream by Taylor Otwell in August 2018 by disabling PHP serialization for cookies and the X-XSRF-TOKEN header. Laravel 5.8.38 shipped with this fix already applied. The fix prevents PHP object injection by passing `false` to encrypt()/decrypt() methods, which disables automatic unserialize() calls on decrypted data. The vulnerable code pattern (automatic unserialization enabling RCE via crafted XSRF tokens) is not present in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "The target (Laravel 5.8.38) is not affected by CVE-2018-15133. The vulnerability was fixed upstream by Taylor Otwell in August 2018 by disabling PHP serialization for cookies and the X-XSRF-TOKEN header. Laravel 5.8.38 shipped with this fix already applied. The fix prevents PHP object injection by passing `false` to encrypt()/decrypt() methods, which disables automatic unserialize() calls on decrypted data. The vulnerable code pattern (automatic unserialization enabling RCE via crafted XSRF tokens) is not present in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T12:25:14.970763+00:00", "status_notes": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.8.38-p8+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19).", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 5.8.38-p8+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before 5.8.17. The target is version 5.8.38-p8+tuxcare, which already contains the upstream fix. The vulnerability was an OS command injection in the link() function where unescaped $link and $target parameters were interpolated into an exec() call. The fix wraps both parameters with escapeshellarg() before shell execution. This fix was already present in the upstream Laravel 5.8.38 release and was imported via the Initial commit when TuxCare onboarded this version. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before 5.8.17. The target is version 5.8.38-p8+tuxcare, which already contains the upstream fix. The vulnerability was an OS command injection in the link() function where unescaped $link and $target parameters were interpolated into an exec() call. The fix wraps both parameters with escapeshellarg() before shell execution. This fix was already present in the upstream Laravel 5.8.38 release and was imported via the Initial commit when TuxCare onboarded this version. The vulnerable code pattern is not present in the target." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T12:25:14.970763+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.8.38-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 5.8.38-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 5.8.38-p8+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T12:25:14.970763+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.8.38-p8+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T12:25:14.970763+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.8.38-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T12:25:14.970763+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.8.38-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T12:25:14.970763+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.8.38-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T12:25:14.970763+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.8.38-p8+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.8.38-p8+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-11-04T12:52:00.536685+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.8.38-p8+tuxcare of laravel/framework, and is fixed in 5.8.38-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.8.38-p8+tuxcare of laravel/framework, and is fixed in 5.8.38-p9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T12:25:14.970763+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.8.38-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T12:25:14.970763+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 5.8.38-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.8.38-p8+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.8.38-p8+tuxcare of laravel/framework. not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T12:25:14.970763+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.8.38-p8+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p8+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T12:25:14.970763+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.8.38-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p8+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } } ], "timestamp": "2026-10-28T12:25:14.970763+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.8.38-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.5.50-p3+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 is NOT present in Laravel 5.5.50-p4+tuxcare. The vulnerability affected Laravel before 5.5.10 due to non-constant-time token comparison in DatabaseUserProvider and EloquentUserProvider. The target version (5.5.50) already contains the upstream fix that was applied in Laravel 5.5.10, which replaced database-level string comparison with hash_equals() for constant-time comparison. T...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 is NOT present in Laravel 5.5.50-p4+tuxcare. The vulnerability affected Laravel before 5.5.10 due to non-constant-time token comparison in DatabaseUserProvider and EloquentUserProvider. The target version (5.5.50) already contains the upstream fix that was applied in Laravel 5.5.10, which replaced database-level string comparison with hash_equals() for constant-time comparison. T..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.5.50-p3+tuxcare of laravel/framework. Version 5.5.50 is not vulnerable. Summary: The target Laravel Framework v5.5.50-p2+tuxcare is NOT vulnerable to CVE-2018-15133. While the X-XSRF-TOKEN decryption feature exists, the vulnerable code pattern does not. The fix has been properly applied: the decrypt() method is called with false as the second parameter (via static::serialized()), preventing unsafe deserialization of the X-XSRF-TOKEN header value.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "Version 5.5.50 is not vulnerable. Summary: The target Laravel Framework v5.5.50-p2+tuxcare is NOT vulnerable to CVE-2018-15133. While the X-XSRF-TOKEN decryption feature exists, the vulnerable code pattern does not. The fix has been properly applied: the decrypt() method is called with false as the second parameter (via static::serialized()), preventing unsafe deserialization of the X-XSRF-TOKEN header value." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 5.5.50-p3+tuxcare of laravel/framework. CVE-2019-9081 was officially REJECTED by MITRE in 2022 as \"not a security issue\" after further investigation. Additionally, the target Laravel 5.5.50 does not contain the PendingCommand class mentioned in the CVE description. The CVE specifically references Laravel Framework 5.7.x and the PendingCommand class in PendingCommand.php, neither of which exist in version 5.5.50. Since the CVE itself is not a valid security vulnerability and the referenced code is absent, the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 was officially REJECTED by MITRE in 2022 as \"not a security issue\" after further investigation. Additionally, the target Laravel 5.5.50 does not contain the PendingCommand class mentioned in the CVE description. The CVE specifically references Laravel Framework 5.7.x and the PendingCommand class in PendingCommand.php, neither of which exist in version 5.5.50. Since the CVE itself is not a valid security vulnerability and the referenced code is absent, the target is not affected." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.5.50-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.5.50-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.5.50-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.5.50-p3+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is fixed in version 5.5.50-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43617" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.5.50-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.5.50-p3+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.5.50-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.5.50-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-29T20:17:00.109653+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.5.50-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in later versions (present in Laravel 12.x). Laravel 5.5.50 uses a completely different exception rendering architecture based on Whoops or Symfony ExceptionHandler, and does not contain the vulnerable component. The entire `src/Illumina...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in later versions (present in Laravel 12.x). Laravel 5.5.50 uses a completely different exception rendering architecture based on Whoops or Symfony ExceptionHandler, and does not contain the vulnerable component. The entire `src/Illumina..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:40:33.053070+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.5.50-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-114508. The vulnerability requires JsonAPI Resources support (Illuminate\\Http\\Resources\\JsonApi\\*), which was introduced in much later versions of Laravel (10+). Laravel 5.5 only has basic JSON Resources (Illuminate\\Http\\Resources\\Json\\*) that do not parse ?include= query parameters for relationship loading. While the underlying Eloquent ORM could theo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-114508. The vulnerability requires JsonAPI Resources support (Illuminate\\Http\\Resources\\JsonApi\\*), which was introduced in much later versions of Laravel (10+). Laravel 5.5 only has basic JSON Resources (Illuminate\\Http\\Resources\\Json\\*) that do not parse ?include= query parameters for relationship loading. While the underlying Eloquent ORM could theo..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-11-04T16:58:23.008576+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.5.50-p3+tuxcare of laravel/framework, and is fixed in 5.5.50-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.5.50-p3+tuxcare of laravel/framework, and is fixed in 5.5.50-p5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.5.50-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.5.50-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 uses SwiftMailer v6.3.0, not Symfony Mailer. The CVE explicitly describes a combination vulnerability requiring both Laravel's missing CRLF validation AND Symfony Mailer/Mime's specific handling of CRLF characters. Since the target uses a different mail library (SwiftMailer), the specific attack chain described in the CVE cannot be completed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 uses SwiftMailer v6.3.0, not Symfony Mailer. The CVE explicitly describes a combination vulnerability requiring both Laravel's missing CRLF validation AND Symfony Mailer/Mime's specific handling of CRLF characters. Since the target uses a different mail library (SwiftMailer), the specific attack chain described in the CVE cannot be completed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.5.50-p3+tuxcare of laravel/framework. Version 5.5.50 is not vulnerable. Summary: The target repository (Laravel 5.5.50-p2+tuxcare) is NOT VULNERABLE to GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie serialization). The repository has been patched with a global serialization disable mechanism that is more secure than the vendor's original selective fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "Version 5.5.50 is not vulnerable. Summary: The target repository (Laravel 5.5.50-p2+tuxcare) is NOT VULNERABLE to GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie serialization). The repository has been patched with a global serialization disable mechanism that is more secure than the vendor's original selective fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.5.50-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework 5.5.50-p4+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The IV length validation fix is present in the code (src/Illuminate/Encryption/Encrypter.php lines 209-210), preventing manipulated payloads with wrong-length IVs from causing decryption to return false. This fix was already included in the upstream Laravel 5.5.50 release (committed by Taylor Otwell in March ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel Framework 5.5.50-p4+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The IV length validation fix is present in the code (src/Illuminate/Encryption/Encrypter.php lines 209-210), preventing manipulated payloads with wrong-length IVs from causing decryption to return false. This fix was already included in the upstream Laravel 5.5.50 release (committed by Taylor Otwell in March ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.5.50-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 5.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 5.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.5.50-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.5.50-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.5.50-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.5.50-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.5.50-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.5.50-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare" } } ], "timestamp": "2026-11-04T16:58:23.008576+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.5.50-p5+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 is NOT present in Laravel 5.5.50-p4+tuxcare. The vulnerability affected Laravel before 5.5.10 due to non-constant-time token comparison in DatabaseUserProvider and EloquentUserProvider. The target version (5.5.50) already contains the upstream fix that was applied in Laravel 5.5.10, which replaced database-level string comparison with hash_equals() for constant-time comparison. T...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 is NOT present in Laravel 5.5.50-p4+tuxcare. The vulnerability affected Laravel before 5.5.10 due to non-constant-time token comparison in DatabaseUserProvider and EloquentUserProvider. The target version (5.5.50) already contains the upstream fix that was applied in Laravel 5.5.10, which replaced database-level string comparison with hash_equals() for constant-time comparison. T..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare" } } ], "timestamp": "2026-11-04T16:58:23.008576+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.5.50-p5+tuxcare of laravel/framework. Version 5.5.50 is not vulnerable. Summary: The target Laravel Framework v5.5.50-p2+tuxcare is NOT vulnerable to CVE-2018-15133. While the X-XSRF-TOKEN decryption feature exists, the vulnerable code pattern does not. The fix has been properly applied: the decrypt() method is called with false as the second parameter (via static::serialized()), preventing unsafe deserialization of the X-XSRF-TOKEN header value.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "Version 5.5.50 is not vulnerable. Summary: The target Laravel Framework v5.5.50-p2+tuxcare is NOT vulnerable to CVE-2018-15133. While the X-XSRF-TOKEN decryption feature exists, the vulnerable code pattern does not. The fix has been properly applied: the decrypt() method is called with false as the second parameter (via static::serialized()), preventing unsafe deserialization of the X-XSRF-TOKEN header value." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare" } } ], "timestamp": "2026-11-04T16:58:23.008576+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 5.5.50-p5+tuxcare of laravel/framework. CVE-2019-9081 was officially REJECTED by MITRE in 2022 as \"not a security issue\" after further investigation. Additionally, the target Laravel 5.5.50 does not contain the PendingCommand class mentioned in the CVE description. The CVE specifically references Laravel Framework 5.7.x and the PendingCommand class in PendingCommand.php, neither of which exist in version 5.5.50. Since the CVE itself is not a valid security vulnerability and the referenced code is absent, the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 was officially REJECTED by MITRE in 2022 as \"not a security issue\" after further investigation. Additionally, the target Laravel 5.5.50 does not contain the PendingCommand class mentioned in the CVE description. The CVE specifically references Laravel Framework 5.7.x and the PendingCommand class in PendingCommand.php, neither of which exist in version 5.5.50. Since the CVE itself is not a valid security vulnerability and the referenced code is absent, the target is not affected." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare" } } ], "timestamp": "2026-11-04T16:58:23.008576+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.5.50-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare" } } ], "timestamp": "2026-11-04T16:58:23.008576+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.5.50-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare" } } ], "timestamp": "2026-11-04T16:58:23.008576+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.5.50-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare" } } ], "timestamp": "2026-11-04T16:58:23.008576+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.5.50-p5+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare" } } ], "timestamp": "2026-11-04T16:58:23.008576+00:00", "status_notes": "Vulnerability CVE-2021-43617 is fixed in version 5.5.50-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43617" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare" } } ], "timestamp": "2026-11-04T16:58:23.008576+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.5.50-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare" } } ], "timestamp": "2026-11-04T16:58:23.008576+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.5.50-p5+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare" } } ], "timestamp": "2026-11-04T16:58:23.008576+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.5.50-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare" } } ], "timestamp": "2026-11-04T16:58:23.008576+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.5.50-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare" } } ], "timestamp": "2026-11-04T16:58:23.008576+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.5.50-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in later versions (present in Laravel 12.x). Laravel 5.5.50 uses a completely different exception rendering architecture based on Whoops or Symfony ExceptionHandler, and does not contain the vulnerable component. The entire `src/Illumina...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in later versions (present in Laravel 12.x). Laravel 5.5.50 uses a completely different exception rendering architecture based on Whoops or Symfony ExceptionHandler, and does not contain the vulnerable component. The entire `src/Illumina..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare" } } ], "timestamp": "2026-11-04T16:58:23.008576+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.5.50-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-114508. The vulnerability requires JsonAPI Resources support (Illuminate\\Http\\Resources\\JsonApi\\*), which was introduced in much later versions of Laravel (10+). Laravel 5.5 only has basic JSON Resources (Illuminate\\Http\\Resources\\Json\\*) that do not parse ?include= query parameters for relationship loading. While the underlying Eloquent ORM could theo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-114508. The vulnerability requires JsonAPI Resources support (Illuminate\\Http\\Resources\\JsonApi\\*), which was introduced in much later versions of Laravel (10+). Laravel 5.5 only has basic JSON Resources (Illuminate\\Http\\Resources\\Json\\*) that do not parse ?include= query parameters for relationship loading. While the underlying Eloquent ORM could theo..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare" } } ], "timestamp": "2026-11-04T16:58:23.008576+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 5.5.50-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare" } } ], "timestamp": "2026-11-04T16:58:23.008576+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.5.50-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare" } } ], "timestamp": "2026-11-04T16:58:23.008576+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.5.50-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 uses SwiftMailer v6.3.0, not Symfony Mailer. The CVE explicitly describes a combination vulnerability requiring both Laravel's missing CRLF validation AND Symfony Mailer/Mime's specific handling of CRLF characters. Since the target uses a different mail library (SwiftMailer), the specific attack chain described in the CVE cannot be completed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 uses SwiftMailer v6.3.0, not Symfony Mailer. The CVE explicitly describes a combination vulnerability requiring both Laravel's missing CRLF validation AND Symfony Mailer/Mime's specific handling of CRLF characters. Since the target uses a different mail library (SwiftMailer), the specific attack chain described in the CVE cannot be completed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare" } } ], "timestamp": "2026-11-04T16:58:23.008576+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.5.50-p5+tuxcare of laravel/framework. Version 5.5.50 is not vulnerable. Summary: The target repository (Laravel 5.5.50-p2+tuxcare) is NOT VULNERABLE to GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie serialization). The repository has been patched with a global serialization disable mechanism that is more secure than the vendor's original selective fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "Version 5.5.50 is not vulnerable. Summary: The target repository (Laravel 5.5.50-p2+tuxcare) is NOT VULNERABLE to GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie serialization). The repository has been patched with a global serialization disable mechanism that is more secure than the vendor's original selective fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare" } } ], "timestamp": "2026-11-04T16:58:23.008576+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.5.50-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework 5.5.50-p4+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The IV length validation fix is present in the code (src/Illuminate/Encryption/Encrypter.php lines 209-210), preventing manipulated payloads with wrong-length IVs from causing decryption to return false. This fix was already included in the upstream Laravel 5.5.50 release (committed by Taylor Otwell in March ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel Framework 5.5.50-p4+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The IV length validation fix is present in the code (src/Illuminate/Encryption/Encrypter.php lines 209-210), preventing manipulated payloads with wrong-length IVs from causing decryption to return false. This fix was already included in the upstream Laravel 5.5.50 release (committed by Taylor Otwell in March ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare" } } ], "timestamp": "2026-11-04T16:58:23.008576+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.5.50-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 5.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 5.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare" } } ], "timestamp": "2026-11-04T16:58:23.008576+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.5.50-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.5.50-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare" } } ], "timestamp": "2026-11-04T16:58:23.008576+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.5.50-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare" } } ], "timestamp": "2026-11-04T16:58:23.008576+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.5.50-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.5.50-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p5+tuxcare" } } ], "timestamp": "2026-11-04T16:58:23.008576+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.5.50-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.6.40-p1+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time remember_me token comparison in DatabaseUserProvider and EloquentUserProvider. The target Laravel 5.6.40-p4+tuxcare already contains the upstream fix: both providers use hash_equals() for constant-time comparison with proper null checks. The fix was introduced in Laravel 5.5.10 (Sept 2017) and inherited by all subsequent rele...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time remember_me token comparison in DatabaseUserProvider and EloquentUserProvider. The target Laravel 5.6.40-p4+tuxcare already contains the upstream fix: both providers use hash_equals() for constant-time comparison with proper null checks. The fix was introduced in Laravel 5.5.10 (Sept 2017) and inherited by all subsequent rele..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.6.40-p1+tuxcare of laravel/framework. CVE-2018-15133 affects Laravel 5.6.x through 5.6.29 (RCE via unserialized XSRF-TOKEN). Target repository is Laravel 5.6.40, onboarded to TuxCare on 2025-08-23 with the upstream fix already present. The vulnerable pattern (decrypt with serialization=true on untrusted XSRF-TOKEN) never existed in this repository's history. Upstream Laravel fixed the vulnerability in version 5.6.30 (August 2018) by disabling cookie serialization. The onboarding commit brought in the already-fixed version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 affects Laravel 5.6.x through 5.6.29 (RCE via unserialized XSRF-TOKEN). Target repository is Laravel 5.6.40, onboarded to TuxCare on 2025-08-23 with the upstream fix already present. The vulnerable pattern (decrypt with serialization=true on untrusted XSRF-TOKEN) never existed in this repository's history. Upstream Laravel fixed the vulnerability in version 5.6.30 (August 2018) by disabling cookie serialization. The onboarding commit brought in the already-fixed version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 5.6.40-p1+tuxcare of laravel/framework. CVE-2019-9081 affects Laravel Framework 5.7.x, specifically the __destruct method of the PendingCommand class in src/Illuminate/Foundation/Testing/PendingCommand.php. This class enables deserialization attacks where an attacker can execute arbitrary console commands. However, the target version 5.6.40 does not contain the PendingCommand class at all - it was introduced in version 5.7.0. Exhaustive searches confirmed no PendingCommand file or class definition exists at target SHA 3012d3fbc4a1e56a5d5db1d469bb4d4cf306a032. While other Pending* classes with __destruct methods exist in 5.6.40 (PendingBroadcast, PendingDispatch, PendingResourceRegistration), none execute console commands. The vulnerability pattern specific to CVE-2019-9081 cannot exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 affects Laravel Framework 5.7.x, specifically the __destruct method of the PendingCommand class in src/Illuminate/Foundation/Testing/PendingCommand.php. This class enables deserialization attacks where an attacker can execute arbitrary console commands. However, the target version 5.6.40 does not contain the PendingCommand class at all - it was introduced in version 5.7.0. Exhaustive searches confirmed no PendingCommand file or class definition exists at target SHA 3012d3fbc4a1e56a5d5db1d469bb4d4cf306a032. While other Pending* classes with __destruct methods exist in 5.6.40 (PendingBroadcast, PendingDispatch, PendingResourceRegistration), none execute console commands. The vulnerability pattern specific to CVE-2019-9081 cannot exist in this version." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.6.40-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.6.40-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.6.40-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.6.40-p1+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.6.40-p1+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.6.40-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.6.40-p1+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.6.40-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.6.40-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:20:00.418969+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.6.40-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer (introduced in Laravel 8+) which uses Tippy.js tooltips with allowHTML: true for displaying user-controlled data. Laravel 5.6.40 uses the Whoops library and Symfony's ExceptionHandler for exception rendering, not Laravel's custom renderer. The vulnerable code path (Tippy.js with al...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer (introduced in Laravel 8+) which uses Tippy.js tooltips with allowHTML: true for displaying user-controlled data. Laravel 5.6.40 uses the Whoops library and Symfony's ExceptionHandler for exception rendering, not Laravel's custom renderer. The vulnerable code path (Tippy.js with al..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.6.40-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 does not contain the JSON:API resources feature that is affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API implementation (specifically in ResolvesJsonApiElements trait) which was introduced in Laravel 10+, approximately 4-5 major versions after 5.6. The target repository contains only basic JSON resources (Json\\JsonResource) but not JSON:API spec-complia...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 does not contain the JSON:API resources feature that is affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API implementation (specifically in ResolvesJsonApiElements trait) which was introduced in Laravel 10+, approximately 4-5 major versions after 5.6. The target repository contains only basic JSON resources (Json\\JsonResource) but not JSON:API spec-complia..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-11-04T12:55:04.611483+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.6.40-p1+tuxcare of laravel/framework, and is fixed in 5.6.40-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.6.40-p1+tuxcare of laravel/framework, and is fixed in 5.6.40-p5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.6.40-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.6.40-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40-p1+tuxcare uses SwiftMailer 6.3.0, not the Symfony Mailer targeted by GHSA-5vg9-5847-vvmq. SwiftMailer's Egulias EmailValidator provides CRLF validation that prevents the vulnerability pattern from manifesting.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40-p1+tuxcare uses SwiftMailer 6.3.0, not the Symfony Mailer targeted by GHSA-5vg9-5847-vvmq. SwiftMailer's Egulias EmailValidator provides CRLF validation that prevents the vulnerability pattern from manifesting." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:54:01.721135+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.6.40-p1+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization vulnerability in cookies). The fix was included in upstream Laravel 5.6.30 and is present in 5.6.40. The EncryptCookies middleware enforces static::$serialize = false for all cookie encryption/decryption operations, preventing PHP object serialization attacks. Additional hardening in Recaller cla...", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization vulnerability in cookies). The fix was included in upstream Laravel 5.6.30 and is present in 5.6.40. The EncryptCookies middleware enforces static::$serialize = false for all cookie encryption/decryption operations, preventing PHP object serialization attacks. Additional hardening in Recaller cla..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.6.40-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-7852-w36x-6mf6. The fix for the IV length validation vulnerability was shipped in the upstream Laravel 5.6.40 release, which TuxCare imported. The vulnerable code pattern (missing IV length check in the Encrypter's validPayload method) is not present; the fix validating that `strlen(base64_decode($payload['iv'], true)) === openssl_cip...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-7852-w36x-6mf6. The fix for the IV length validation vulnerability was shipped in the upstream Laravel 5.6.40 release, which TuxCare imported. The vulnerable code pattern (missing IV length check in the Encrypter's validPayload method) is not present; the fix validating that `strlen(base64_decode($payload['iv'], true)) === openssl_cip..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.6.40-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 does not have the vulnerable LocalFilesystemAdapter class or signed URL generation for local filesystem. The feature was introduced in Laravel 11+ (September 2024), years after this version. The FilesystemAdapter.temporaryUrl() method explicitly throws RuntimeException for local adapters - the feature is unsupported.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 does not have the vulnerable LocalFilesystemAdapter class or signed URL generation for local filesystem. The feature was introduced in Laravel 11+ (September 2024), years after this version. The FilesystemAdapter.temporaryUrl() method explicitly throws RuntimeException for local adapters - the feature is unsupported." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.6.40-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.6.40-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.6.40-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.6.40-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.6.40-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.6.40-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 affects version 5.8.38-p1+tuxcare of laravel/framework, and is fixed in 5.8.38-p2+tuxcare.", "vulnerability": { "name": "AIKIDO-2026-10659" }, "action_statement": "Vulnerability AIKIDO-2026-10659 affects version 5.8.38-p1+tuxcare of laravel/framework, and is fixed in 5.8.38-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.8.38-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.8.38-p1+tuxcare of laravel/framework. The target (Laravel 5.8.38) is not affected by CVE-2018-15133. The vulnerability was fixed upstream by Taylor Otwell in August 2018 by disabling PHP serialization for cookies and the X-XSRF-TOKEN header. Laravel 5.8.38 shipped with this fix already applied. The fix prevents PHP object injection by passing `false` to encrypt()/decrypt() methods, which disables automatic unserialize() calls on decrypted data. The vulnerable code pattern (automatic unserialization enabling RCE via crafted XSRF tokens) is not present in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "The target (Laravel 5.8.38) is not affected by CVE-2018-15133. The vulnerability was fixed upstream by Taylor Otwell in August 2018 by disabling PHP serialization for cookies and the X-XSRF-TOKEN header. Laravel 5.8.38 shipped with this fix already applied. The fix prevents PHP object injection by passing `false` to encrypt()/decrypt() methods, which disables automatic unserialize() calls on decrypted data. The vulnerable code pattern (automatic unserialization enabling RCE via crafted XSRF tokens) is not present in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-10-19T13:14:00.236705+00:00", "status_notes": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.8.38-p1+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19).", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 5.8.38-p1+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before 5.8.17. The target is version 5.8.38-p8+tuxcare, which already contains the upstream fix. The vulnerability was an OS command injection in the link() function where unescaped $link and $target parameters were interpolated into an exec() call. The fix wraps both parameters with escapeshellarg() before shell execution. This fix was already present in the upstream Laravel 5.8.38 release and was imported via the Initial commit when TuxCare onboarded this version. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before 5.8.17. The target is version 5.8.38-p8+tuxcare, which already contains the upstream fix. The vulnerability was an OS command injection in the link() function where unescaped $link and $target parameters were interpolated into an exec() call. The fix wraps both parameters with escapeshellarg() before shell execution. This fix was already present in the upstream Laravel 5.8.38 release and was imported via the Initial commit when TuxCare onboarded this version. The vulnerable code pattern is not present in the target." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.8.38-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 5.8.38-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 5.8.38-p1+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.8.38-p1+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.8.38-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 5.8.38-p1+tuxcare of laravel/framework, and is fixed in 5.8.38-p4+tuxcare.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 5.8.38-p1+tuxcare of laravel/framework, and is fixed in 5.8.38-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 affects version 5.8.38-p1+tuxcare of laravel/framework, and is fixed in 5.8.38-p4+tuxcare.", "vulnerability": { "name": "CVE-2025-27515" }, "action_statement": "Vulnerability CVE-2025-27515 affects version 5.8.38-p1+tuxcare of laravel/framework, and is fixed in 5.8.38-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:33:09.068963+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.8.38-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.8.38-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-11-04T12:52:00.536685+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.8.38-p1+tuxcare of laravel/framework, and is fixed in 5.8.38-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.8.38-p1+tuxcare of laravel/framework, and is fixed in 5.8.38-p9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.8.38-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 5.8.38-p1+tuxcare of laravel/framework, and is fixed in 5.8.38-p5+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 5.8.38-p1+tuxcare of laravel/framework, and is fixed in 5.8.38-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.8.38-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.8.38-p1+tuxcare of laravel/framework. not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.8.38-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.8.38-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.8.38-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p2+tuxcare" } } ], "timestamp": "2026-11-04T15:46:56.279623+00:00", "status_notes": "Vulnerability CVE-2015-8379 does not affect version 5.0.11-p2+tuxcare of cakephp/cakephp. CVE-2015-8379 affects CakePHP 2.x and 3.x before 3.1.5, where CsrfComponent validated CSRF tokens only for PATCH/PUT/POST/DELETE. CakePHP 5.0.11 does not contain that code: CSRF protection is provided by CsrfProtectionMiddleware, and the upstream 3.1.5 fix has never been applied to it upstream (unchanged on the 5.x branch). The version is outside the NVD affected range.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-8379" }, "impact_statement": "CVE-2015-8379 affects CakePHP 2.x and 3.x before 3.1.5, where CsrfComponent validated CSRF tokens only for PATCH/PUT/POST/DELETE. CakePHP 5.0.11 does not contain that code: CSRF protection is provided by CsrfProtectionMiddleware, and the upstream 3.1.5 fix has never been applied to it upstream (unchanged on the 5.x branch). The version is outside the NVD affected range." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p2+tuxcare" } } ], "timestamp": "2026-11-04T15:46:56.279623+00:00", "status_notes": "Vulnerability CVE-2020-15400 does not affect version 5.0.11-p2+tuxcare of cakephp/cakephp. not_affected \u2014 CVE-2020-15400 (CSRF token fixation vulnerability) is not present in CakePHP 5.0.11. The HMAC-based token generation and verification fix was already included in the upstream CakePHP 5.0.11 release before TuxCare onboarded this version. The vulnerable code pattern (accepting any matching token pair without cryptographic proof of origin) does not exist in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-15400" }, "impact_statement": "not_affected \u2014 CVE-2020-15400 (CSRF token fixation vulnerability) is not present in CakePHP 5.0.11. The HMAC-based token generation and verification fix was already included in the upstream CakePHP 5.0.11 release before TuxCare onboarded this version. The vulnerable code pattern (accepting any matching token pair without cryptographic proof of origin) does not exist in the target." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p2+tuxcare" } } ], "timestamp": "2026-11-04T15:47:28.949866+00:00", "status_notes": "Vulnerability CVE-2026-119415 is fixed in version 5.0.11-p2+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119415" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p2+tuxcare" } } ], "timestamp": "2026-11-04T15:47:28.949866+00:00", "status_notes": "Vulnerability CVE-2026-119416 is fixed in version 5.0.11-p2+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119416" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p2+tuxcare" } } ], "timestamp": "2026-11-04T15:47:28.949866+00:00", "status_notes": "Vulnerability CVE-2026-119417 is fixed in version 5.0.11-p2+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119417" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p2+tuxcare" } } ], "timestamp": "2026-11-04T15:47:28.949866+00:00", "status_notes": "Vulnerability CVE-2026-119418 is fixed in version 5.0.11-p2+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119418" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p2+tuxcare" } } ], "timestamp": "2026-11-04T15:47:28.949866+00:00", "status_notes": "Vulnerability CVE-2026-119419 is fixed in version 5.0.11-p2+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119419" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p2+tuxcare" } } ], "timestamp": "2026-11-04T15:46:56.279623+00:00", "status_notes": "Vulnerability CVE-2026-48820 is fixed in version 5.0.11-p2+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-48820" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p2+tuxcare" } } ], "timestamp": "2026-11-04T15:46:56.279623+00:00", "status_notes": "Vulnerability CVE-2026-77634 is fixed in version 5.0.11-p2+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-77634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@5.0.11-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@5.0.11-p2+tuxcare" } } ], "timestamp": "2026-11-04T15:46:56.279623+00:00", "status_notes": "Vulnerability CVE-2026-79752 is fixed in version 5.0.11-p2+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-79752" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare" } } ], "timestamp": "2026-11-04T12:54:37.275994+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.6.40-p5+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time remember_me token comparison in DatabaseUserProvider and EloquentUserProvider. The target Laravel 5.6.40-p4+tuxcare already contains the upstream fix: both providers use hash_equals() for constant-time comparison with proper null checks. The fix was introduced in Laravel 5.5.10 (Sept 2017) and inherited by all subsequent rele...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time remember_me token comparison in DatabaseUserProvider and EloquentUserProvider. The target Laravel 5.6.40-p4+tuxcare already contains the upstream fix: both providers use hash_equals() for constant-time comparison with proper null checks. The fix was introduced in Laravel 5.5.10 (Sept 2017) and inherited by all subsequent rele..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare" } } ], "timestamp": "2026-11-04T12:54:37.275994+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.6.40-p5+tuxcare of laravel/framework. CVE-2018-15133 affects Laravel 5.6.x through 5.6.29 (RCE via unserialized XSRF-TOKEN). Target repository is Laravel 5.6.40, onboarded to TuxCare on 2025-08-23 with the upstream fix already present. The vulnerable pattern (decrypt with serialization=true on untrusted XSRF-TOKEN) never existed in this repository's history. Upstream Laravel fixed the vulnerability in version 5.6.30 (August 2018) by disabling cookie serialization. The onboarding commit brought in the already-fixed version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 affects Laravel 5.6.x through 5.6.29 (RCE via unserialized XSRF-TOKEN). Target repository is Laravel 5.6.40, onboarded to TuxCare on 2025-08-23 with the upstream fix already present. The vulnerable pattern (decrypt with serialization=true on untrusted XSRF-TOKEN) never existed in this repository's history. Upstream Laravel fixed the vulnerability in version 5.6.30 (August 2018) by disabling cookie serialization. The onboarding commit brought in the already-fixed version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare" } } ], "timestamp": "2026-11-04T12:54:37.275994+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 5.6.40-p5+tuxcare of laravel/framework. CVE-2019-9081 affects Laravel Framework 5.7.x, specifically the __destruct method of the PendingCommand class in src/Illuminate/Foundation/Testing/PendingCommand.php. This class enables deserialization attacks where an attacker can execute arbitrary console commands. However, the target version 5.6.40 does not contain the PendingCommand class at all - it was introduced in version 5.7.0. Exhaustive searches confirmed no PendingCommand file or class definition exists at target SHA 3012d3fbc4a1e56a5d5db1d469bb4d4cf306a032. While other Pending* classes with __destruct methods exist in 5.6.40 (PendingBroadcast, PendingDispatch, PendingResourceRegistration), none execute console commands. The vulnerability pattern specific to CVE-2019-9081 cannot exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 affects Laravel Framework 5.7.x, specifically the __destruct method of the PendingCommand class in src/Illuminate/Foundation/Testing/PendingCommand.php. This class enables deserialization attacks where an attacker can execute arbitrary console commands. However, the target version 5.6.40 does not contain the PendingCommand class at all - it was introduced in version 5.7.0. Exhaustive searches confirmed no PendingCommand file or class definition exists at target SHA 3012d3fbc4a1e56a5d5db1d469bb4d4cf306a032. While other Pending* classes with __destruct methods exist in 5.6.40 (PendingBroadcast, PendingDispatch, PendingResourceRegistration), none execute console commands. The vulnerability pattern specific to CVE-2019-9081 cannot exist in this version." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare" } } ], "timestamp": "2026-11-04T12:54:37.275994+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.6.40-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare" } } ], "timestamp": "2026-11-04T12:54:37.275994+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.6.40-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare" } } ], "timestamp": "2026-11-04T12:54:37.275994+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.6.40-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare" } } ], "timestamp": "2026-11-04T12:54:37.275994+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.6.40-p5+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare" } } ], "timestamp": "2026-11-04T12:54:37.275994+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.6.40-p5+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare" } } ], "timestamp": "2026-11-04T12:54:37.275994+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.6.40-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare" } } ], "timestamp": "2026-11-04T12:54:37.275994+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.6.40-p5+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare" } } ], "timestamp": "2026-11-04T12:54:37.275994+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.6.40-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare" } } ], "timestamp": "2026-11-04T12:54:37.275994+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.6.40-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare" } } ], "timestamp": "2026-11-04T12:54:37.275994+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.6.40-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer (introduced in Laravel 8+) which uses Tippy.js tooltips with allowHTML: true for displaying user-controlled data. Laravel 5.6.40 uses the Whoops library and Symfony's ExceptionHandler for exception rendering, not Laravel's custom renderer. The vulnerable code path (Tippy.js with al...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer (introduced in Laravel 8+) which uses Tippy.js tooltips with allowHTML: true for displaying user-controlled data. Laravel 5.6.40 uses the Whoops library and Symfony's ExceptionHandler for exception rendering, not Laravel's custom renderer. The vulnerable code path (Tippy.js with al..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare" } } ], "timestamp": "2026-11-04T12:54:37.275994+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.6.40-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 does not contain the JSON:API resources feature that is affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API implementation (specifically in ResolvesJsonApiElements trait) which was introduced in Laravel 10+, approximately 4-5 major versions after 5.6. The target repository contains only basic JSON resources (Json\\JsonResource) but not JSON:API spec-complia...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 does not contain the JSON:API resources feature that is affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API implementation (specifically in ResolvesJsonApiElements trait) which was introduced in Laravel 10+, approximately 4-5 major versions after 5.6. The target repository contains only basic JSON resources (Json\\JsonResource) but not JSON:API spec-complia..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare" } } ], "timestamp": "2026-11-04T12:55:04.611483+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 5.6.40-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare" } } ], "timestamp": "2026-11-04T12:54:37.275994+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.6.40-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare" } } ], "timestamp": "2026-11-04T12:54:37.275994+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.6.40-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40-p1+tuxcare uses SwiftMailer 6.3.0, not the Symfony Mailer targeted by GHSA-5vg9-5847-vvmq. SwiftMailer's Egulias EmailValidator provides CRLF validation that prevents the vulnerability pattern from manifesting.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40-p1+tuxcare uses SwiftMailer 6.3.0, not the Symfony Mailer targeted by GHSA-5vg9-5847-vvmq. SwiftMailer's Egulias EmailValidator provides CRLF validation that prevents the vulnerability pattern from manifesting." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare" } } ], "timestamp": "2026-11-04T12:54:37.275994+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.6.40-p5+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization vulnerability in cookies). The fix was included in upstream Laravel 5.6.30 and is present in 5.6.40. The EncryptCookies middleware enforces static::$serialize = false for all cookie encryption/decryption operations, preventing PHP object serialization attacks. Additional hardening in Recaller cla...", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization vulnerability in cookies). The fix was included in upstream Laravel 5.6.30 and is present in 5.6.40. The EncryptCookies middleware enforces static::$serialize = false for all cookie encryption/decryption operations, preventing PHP object serialization attacks. Additional hardening in Recaller cla..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare" } } ], "timestamp": "2026-11-04T12:54:37.275994+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.6.40-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-7852-w36x-6mf6. The fix for the IV length validation vulnerability was shipped in the upstream Laravel 5.6.40 release, which TuxCare imported. The vulnerable code pattern (missing IV length check in the Encrypter's validPayload method) is not present; the fix validating that `strlen(base64_decode($payload['iv'], true)) === openssl_cip...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-7852-w36x-6mf6. The fix for the IV length validation vulnerability was shipped in the upstream Laravel 5.6.40 release, which TuxCare imported. The vulnerable code pattern (missing IV length check in the Encrypter's validPayload method) is not present; the fix validating that `strlen(base64_decode($payload['iv'], true)) === openssl_cip..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare" } } ], "timestamp": "2026-11-04T12:54:37.275994+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.6.40-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 does not have the vulnerable LocalFilesystemAdapter class or signed URL generation for local filesystem. The feature was introduced in Laravel 11+ (September 2024), years after this version. The FilesystemAdapter.temporaryUrl() method explicitly throws RuntimeException for local adapters - the feature is unsupported.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 does not have the vulnerable LocalFilesystemAdapter class or signed URL generation for local filesystem. The feature was introduced in Laravel 11+ (September 2024), years after this version. The FilesystemAdapter.temporaryUrl() method explicitly throws RuntimeException for local adapters - the feature is unsupported." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare" } } ], "timestamp": "2026-11-04T12:54:37.275994+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.6.40-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.6.40-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare" } } ], "timestamp": "2026-11-04T12:54:37.275994+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.6.40-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare" } } ], "timestamp": "2026-11-04T12:54:37.275994+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.6.40-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.6.40-p5+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p5+tuxcare" } } ], "timestamp": "2026-11-04T12:54:37.275994+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.6.40-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.6.40-p3+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time remember_me token comparison in DatabaseUserProvider and EloquentUserProvider. The target Laravel 5.6.40-p4+tuxcare already contains the upstream fix: both providers use hash_equals() for constant-time comparison with proper null checks. The fix was introduced in Laravel 5.5.10 (Sept 2017) and inherited by all subsequent rele...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time remember_me token comparison in DatabaseUserProvider and EloquentUserProvider. The target Laravel 5.6.40-p4+tuxcare already contains the upstream fix: both providers use hash_equals() for constant-time comparison with proper null checks. The fix was introduced in Laravel 5.5.10 (Sept 2017) and inherited by all subsequent rele..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.6.40-p3+tuxcare of laravel/framework. CVE-2018-15133 affects Laravel 5.6.x through 5.6.29 (RCE via unserialized XSRF-TOKEN). Target repository is Laravel 5.6.40, onboarded to TuxCare on 2025-08-23 with the upstream fix already present. The vulnerable pattern (decrypt with serialization=true on untrusted XSRF-TOKEN) never existed in this repository's history. Upstream Laravel fixed the vulnerability in version 5.6.30 (August 2018) by disabling cookie serialization. The onboarding commit brought in the already-fixed version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 affects Laravel 5.6.x through 5.6.29 (RCE via unserialized XSRF-TOKEN). Target repository is Laravel 5.6.40, onboarded to TuxCare on 2025-08-23 with the upstream fix already present. The vulnerable pattern (decrypt with serialization=true on untrusted XSRF-TOKEN) never existed in this repository's history. Upstream Laravel fixed the vulnerability in version 5.6.30 (August 2018) by disabling cookie serialization. The onboarding commit brought in the already-fixed version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 5.6.40-p3+tuxcare of laravel/framework. CVE-2019-9081 affects Laravel Framework 5.7.x, specifically the __destruct method of the PendingCommand class in src/Illuminate/Foundation/Testing/PendingCommand.php. This class enables deserialization attacks where an attacker can execute arbitrary console commands. However, the target version 5.6.40 does not contain the PendingCommand class at all - it was introduced in version 5.7.0. Exhaustive searches confirmed no PendingCommand file or class definition exists at target SHA 3012d3fbc4a1e56a5d5db1d469bb4d4cf306a032. While other Pending* classes with __destruct methods exist in 5.6.40 (PendingBroadcast, PendingDispatch, PendingResourceRegistration), none execute console commands. The vulnerability pattern specific to CVE-2019-9081 cannot exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 affects Laravel Framework 5.7.x, specifically the __destruct method of the PendingCommand class in src/Illuminate/Foundation/Testing/PendingCommand.php. This class enables deserialization attacks where an attacker can execute arbitrary console commands. However, the target version 5.6.40 does not contain the PendingCommand class at all - it was introduced in version 5.7.0. Exhaustive searches confirmed no PendingCommand file or class definition exists at target SHA 3012d3fbc4a1e56a5d5db1d469bb4d4cf306a032. While other Pending* classes with __destruct methods exist in 5.6.40 (PendingBroadcast, PendingDispatch, PendingResourceRegistration), none execute console commands. The vulnerability pattern specific to CVE-2019-9081 cannot exist in this version." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-12T07:06:00.254912+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.6.40-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-12T07:06:00.254912+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.6.40-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-12T07:06:00.254912+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.6.40-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.6.40-p3+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-12T07:06:00.254912+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.6.40-p3+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-12T07:06:00.254912+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.6.40-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-12T07:06:00.254912+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.6.40-p3+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-12T07:06:00.254912+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.6.40-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-12T07:06:00.254912+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.6.40-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-12T07:06:00.254912+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.6.40-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer (introduced in Laravel 8+) which uses Tippy.js tooltips with allowHTML: true for displaying user-controlled data. Laravel 5.6.40 uses the Whoops library and Symfony's ExceptionHandler for exception rendering, not Laravel's custom renderer. The vulnerable code path (Tippy.js with al...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer (introduced in Laravel 8+) which uses Tippy.js tooltips with allowHTML: true for displaying user-controlled data. Laravel 5.6.40 uses the Whoops library and Symfony's ExceptionHandler for exception rendering, not Laravel's custom renderer. The vulnerable code path (Tippy.js with al..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.6.40-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 does not contain the JSON:API resources feature that is affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API implementation (specifically in ResolvesJsonApiElements trait) which was introduced in Laravel 10+, approximately 4-5 major versions after 5.6. The target repository contains only basic JSON resources (Json\\JsonResource) but not JSON:API spec-complia...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 does not contain the JSON:API resources feature that is affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API implementation (specifically in ResolvesJsonApiElements trait) which was introduced in Laravel 10+, approximately 4-5 major versions after 5.6. The target repository contains only basic JSON resources (Json\\JsonResource) but not JSON:API spec-complia..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-11-04T12:55:04.611483+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.6.40-p3+tuxcare of laravel/framework, and is fixed in 5.6.40-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.6.40-p3+tuxcare of laravel/framework, and is fixed in 5.6.40-p5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-12T07:06:00.254912+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.6.40-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-12T07:06:00.254912+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.6.40-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40-p1+tuxcare uses SwiftMailer 6.3.0, not the Symfony Mailer targeted by GHSA-5vg9-5847-vvmq. SwiftMailer's Egulias EmailValidator provides CRLF validation that prevents the vulnerability pattern from manifesting.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40-p1+tuxcare uses SwiftMailer 6.3.0, not the Symfony Mailer targeted by GHSA-5vg9-5847-vvmq. SwiftMailer's Egulias EmailValidator provides CRLF validation that prevents the vulnerability pattern from manifesting." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:54:01.721135+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.6.40-p3+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization vulnerability in cookies). The fix was included in upstream Laravel 5.6.30 and is present in 5.6.40. The EncryptCookies middleware enforces static::$serialize = false for all cookie encryption/decryption operations, preventing PHP object serialization attacks. Additional hardening in Recaller cla...", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization vulnerability in cookies). The fix was included in upstream Laravel 5.6.30 and is present in 5.6.40. The EncryptCookies middleware enforces static::$serialize = false for all cookie encryption/decryption operations, preventing PHP object serialization attacks. Additional hardening in Recaller cla..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.6.40-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-7852-w36x-6mf6. The fix for the IV length validation vulnerability was shipped in the upstream Laravel 5.6.40 release, which TuxCare imported. The vulnerable code pattern (missing IV length check in the Encrypter's validPayload method) is not present; the fix validating that `strlen(base64_decode($payload['iv'], true)) === openssl_cip...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-7852-w36x-6mf6. The fix for the IV length validation vulnerability was shipped in the upstream Laravel 5.6.40 release, which TuxCare imported. The vulnerable code pattern (missing IV length check in the Encrypter's validPayload method) is not present; the fix validating that `strlen(base64_decode($payload['iv'], true)) === openssl_cip..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-12T07:06:00.254912+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.6.40-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 does not have the vulnerable LocalFilesystemAdapter class or signed URL generation for local filesystem. The feature was introduced in Laravel 11+ (September 2024), years after this version. The FilesystemAdapter.temporaryUrl() method explicitly throws RuntimeException for local adapters - the feature is unsupported.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 does not have the vulnerable LocalFilesystemAdapter class or signed URL generation for local filesystem. The feature was introduced in Laravel 11+ (September 2024), years after this version. The FilesystemAdapter.temporaryUrl() method explicitly throws RuntimeException for local adapters - the feature is unsupported." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.6.40-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.6.40-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-12T07:06:00.254912+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.6.40-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.6.40-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.6.40-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } } ], "timestamp": "2026-10-12T07:06:00.254912+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.6.40-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.6.40-p2+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time remember_me token comparison in DatabaseUserProvider and EloquentUserProvider. The target Laravel 5.6.40-p4+tuxcare already contains the upstream fix: both providers use hash_equals() for constant-time comparison with proper null checks. The fix was introduced in Laravel 5.5.10 (Sept 2017) and inherited by all subsequent rele...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time remember_me token comparison in DatabaseUserProvider and EloquentUserProvider. The target Laravel 5.6.40-p4+tuxcare already contains the upstream fix: both providers use hash_equals() for constant-time comparison with proper null checks. The fix was introduced in Laravel 5.5.10 (Sept 2017) and inherited by all subsequent rele..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.6.40-p2+tuxcare of laravel/framework. CVE-2018-15133 affects Laravel 5.6.x through 5.6.29 (RCE via unserialized XSRF-TOKEN). Target repository is Laravel 5.6.40, onboarded to TuxCare on 2025-08-23 with the upstream fix already present. The vulnerable pattern (decrypt with serialization=true on untrusted XSRF-TOKEN) never existed in this repository's history. Upstream Laravel fixed the vulnerability in version 5.6.30 (August 2018) by disabling cookie serialization. The onboarding commit brought in the already-fixed version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 affects Laravel 5.6.x through 5.6.29 (RCE via unserialized XSRF-TOKEN). Target repository is Laravel 5.6.40, onboarded to TuxCare on 2025-08-23 with the upstream fix already present. The vulnerable pattern (decrypt with serialization=true on untrusted XSRF-TOKEN) never existed in this repository's history. Upstream Laravel fixed the vulnerability in version 5.6.30 (August 2018) by disabling cookie serialization. The onboarding commit brought in the already-fixed version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 5.6.40-p2+tuxcare of laravel/framework. CVE-2019-9081 affects Laravel Framework 5.7.x, specifically the __destruct method of the PendingCommand class in src/Illuminate/Foundation/Testing/PendingCommand.php. This class enables deserialization attacks where an attacker can execute arbitrary console commands. However, the target version 5.6.40 does not contain the PendingCommand class at all - it was introduced in version 5.7.0. Exhaustive searches confirmed no PendingCommand file or class definition exists at target SHA 3012d3fbc4a1e56a5d5db1d469bb4d4cf306a032. While other Pending* classes with __destruct methods exist in 5.6.40 (PendingBroadcast, PendingDispatch, PendingResourceRegistration), none execute console commands. The vulnerability pattern specific to CVE-2019-9081 cannot exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 affects Laravel Framework 5.7.x, specifically the __destruct method of the PendingCommand class in src/Illuminate/Foundation/Testing/PendingCommand.php. This class enables deserialization attacks where an attacker can execute arbitrary console commands. However, the target version 5.6.40 does not contain the PendingCommand class at all - it was introduced in version 5.7.0. Exhaustive searches confirmed no PendingCommand file or class definition exists at target SHA 3012d3fbc4a1e56a5d5db1d469bb4d4cf306a032. While other Pending* classes with __destruct methods exist in 5.6.40 (PendingBroadcast, PendingDispatch, PendingResourceRegistration), none execute console commands. The vulnerability pattern specific to CVE-2019-9081 cannot exist in this version." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.6.40-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.6.40-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.6.40-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.6.40-p2+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.6.40-p2+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.6.40-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.6.40-p2+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.6.40-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.6.40-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:20:00.418969+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.6.40-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer (introduced in Laravel 8+) which uses Tippy.js tooltips with allowHTML: true for displaying user-controlled data. Laravel 5.6.40 uses the Whoops library and Symfony's ExceptionHandler for exception rendering, not Laravel's custom renderer. The vulnerable code path (Tippy.js with al...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer (introduced in Laravel 8+) which uses Tippy.js tooltips with allowHTML: true for displaying user-controlled data. Laravel 5.6.40 uses the Whoops library and Symfony's ExceptionHandler for exception rendering, not Laravel's custom renderer. The vulnerable code path (Tippy.js with al..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.6.40-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 does not contain the JSON:API resources feature that is affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API implementation (specifically in ResolvesJsonApiElements trait) which was introduced in Laravel 10+, approximately 4-5 major versions after 5.6. The target repository contains only basic JSON resources (Json\\JsonResource) but not JSON:API spec-complia...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 does not contain the JSON:API resources feature that is affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API implementation (specifically in ResolvesJsonApiElements trait) which was introduced in Laravel 10+, approximately 4-5 major versions after 5.6. The target repository contains only basic JSON resources (Json\\JsonResource) but not JSON:API spec-complia..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-11-04T12:55:04.611483+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.6.40-p2+tuxcare of laravel/framework, and is fixed in 5.6.40-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.6.40-p2+tuxcare of laravel/framework, and is fixed in 5.6.40-p5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.6.40-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.6.40-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40-p1+tuxcare uses SwiftMailer 6.3.0, not the Symfony Mailer targeted by GHSA-5vg9-5847-vvmq. SwiftMailer's Egulias EmailValidator provides CRLF validation that prevents the vulnerability pattern from manifesting.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40-p1+tuxcare uses SwiftMailer 6.3.0, not the Symfony Mailer targeted by GHSA-5vg9-5847-vvmq. SwiftMailer's Egulias EmailValidator provides CRLF validation that prevents the vulnerability pattern from manifesting." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:54:01.721135+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.6.40-p2+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization vulnerability in cookies). The fix was included in upstream Laravel 5.6.30 and is present in 5.6.40. The EncryptCookies middleware enforces static::$serialize = false for all cookie encryption/decryption operations, preventing PHP object serialization attacks. Additional hardening in Recaller cla...", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization vulnerability in cookies). The fix was included in upstream Laravel 5.6.30 and is present in 5.6.40. The EncryptCookies middleware enforces static::$serialize = false for all cookie encryption/decryption operations, preventing PHP object serialization attacks. Additional hardening in Recaller cla..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.6.40-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-7852-w36x-6mf6. The fix for the IV length validation vulnerability was shipped in the upstream Laravel 5.6.40 release, which TuxCare imported. The vulnerable code pattern (missing IV length check in the Encrypter's validPayload method) is not present; the fix validating that `strlen(base64_decode($payload['iv'], true)) === openssl_cip...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-7852-w36x-6mf6. The fix for the IV length validation vulnerability was shipped in the upstream Laravel 5.6.40 release, which TuxCare imported. The vulnerable code pattern (missing IV length check in the Encrypter's validPayload method) is not present; the fix validating that `strlen(base64_decode($payload['iv'], true)) === openssl_cip..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.6.40-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 does not have the vulnerable LocalFilesystemAdapter class or signed URL generation for local filesystem. The feature was introduced in Laravel 11+ (September 2024), years after this version. The FilesystemAdapter.temporaryUrl() method explicitly throws RuntimeException for local adapters - the feature is unsupported.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 does not have the vulnerable LocalFilesystemAdapter class or signed URL generation for local filesystem. The feature was introduced in Laravel 11+ (September 2024), years after this version. The FilesystemAdapter.temporaryUrl() method explicitly throws RuntimeException for local adapters - the feature is unsupported." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.6.40-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.6.40-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.6.40-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.6.40-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.6.40-p2+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.6.40-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.5.50-p1+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 is NOT present in Laravel 5.5.50-p4+tuxcare. The vulnerability affected Laravel before 5.5.10 due to non-constant-time token comparison in DatabaseUserProvider and EloquentUserProvider. The target version (5.5.50) already contains the upstream fix that was applied in Laravel 5.5.10, which replaced database-level string comparison with hash_equals() for constant-time comparison. T...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 is NOT present in Laravel 5.5.50-p4+tuxcare. The vulnerability affected Laravel before 5.5.10 due to non-constant-time token comparison in DatabaseUserProvider and EloquentUserProvider. The target version (5.5.50) already contains the upstream fix that was applied in Laravel 5.5.10, which replaced database-level string comparison with hash_equals() for constant-time comparison. T..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.5.50-p1+tuxcare of laravel/framework. Version 5.5.50 is not vulnerable. Summary: The target Laravel Framework v5.5.50-p2+tuxcare is NOT vulnerable to CVE-2018-15133. While the X-XSRF-TOKEN decryption feature exists, the vulnerable code pattern does not. The fix has been properly applied: the decrypt() method is called with false as the second parameter (via static::serialized()), preventing unsafe deserialization of the X-XSRF-TOKEN header value.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "Version 5.5.50 is not vulnerable. Summary: The target Laravel Framework v5.5.50-p2+tuxcare is NOT vulnerable to CVE-2018-15133. While the X-XSRF-TOKEN decryption feature exists, the vulnerable code pattern does not. The fix has been properly applied: the decrypt() method is called with false as the second parameter (via static::serialized()), preventing unsafe deserialization of the X-XSRF-TOKEN header value." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 5.5.50-p1+tuxcare of laravel/framework. CVE-2019-9081 was officially REJECTED by MITRE in 2022 as \"not a security issue\" after further investigation. Additionally, the target Laravel 5.5.50 does not contain the PendingCommand class mentioned in the CVE description. The CVE specifically references Laravel Framework 5.7.x and the PendingCommand class in PendingCommand.php, neither of which exist in version 5.5.50. Since the CVE itself is not a valid security vulnerability and the referenced code is absent, the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 was officially REJECTED by MITRE in 2022 as \"not a security issue\" after further investigation. Additionally, the target Laravel 5.5.50 does not contain the PendingCommand class mentioned in the CVE description. The CVE specifically references Laravel Framework 5.7.x and the PendingCommand class in PendingCommand.php, neither of which exist in version 5.5.50. Since the CVE itself is not a valid security vulnerability and the referenced code is absent, the target is not affected." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.5.50-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.5.50-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.5.50-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-10-19T13:03:00.146703+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.5.50-p1+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 affects version 5.5.50-p1+tuxcare of laravel/framework, and is fixed in 5.5.50-p2+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "action_statement": "Vulnerability CVE-2021-43617 affects version 5.5.50-p1+tuxcare of laravel/framework, and is fixed in 5.5.50-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.5.50-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.5.50-p1+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.5.50-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.5.50-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:17:00.109653+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.5.50-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in later versions (present in Laravel 12.x). Laravel 5.5.50 uses a completely different exception rendering architecture based on Whoops or Symfony ExceptionHandler, and does not contain the vulnerable component. The entire `src/Illumina...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in later versions (present in Laravel 12.x). Laravel 5.5.50 uses a completely different exception rendering architecture based on Whoops or Symfony ExceptionHandler, and does not contain the vulnerable component. The entire `src/Illumina..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:40:33.053070+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.5.50-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-114508. The vulnerability requires JsonAPI Resources support (Illuminate\\Http\\Resources\\JsonApi\\*), which was introduced in much later versions of Laravel (10+). Laravel 5.5 only has basic JSON Resources (Illuminate\\Http\\Resources\\Json\\*) that do not parse ?include= query parameters for relationship loading. While the underlying Eloquent ORM could theo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-114508. The vulnerability requires JsonAPI Resources support (Illuminate\\Http\\Resources\\JsonApi\\*), which was introduced in much later versions of Laravel (10+). Laravel 5.5 only has basic JSON Resources (Illuminate\\Http\\Resources\\Json\\*) that do not parse ?include= query parameters for relationship loading. While the underlying Eloquent ORM could theo..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-11-04T16:58:23.008576+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.5.50-p1+tuxcare of laravel/framework, and is fixed in 5.5.50-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.5.50-p1+tuxcare of laravel/framework, and is fixed in 5.5.50-p5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.5.50-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.5.50-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 uses SwiftMailer v6.3.0, not Symfony Mailer. The CVE explicitly describes a combination vulnerability requiring both Laravel's missing CRLF validation AND Symfony Mailer/Mime's specific handling of CRLF characters. Since the target uses a different mail library (SwiftMailer), the specific attack chain described in the CVE cannot be completed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 uses SwiftMailer v6.3.0, not Symfony Mailer. The CVE explicitly describes a combination vulnerability requiring both Laravel's missing CRLF validation AND Symfony Mailer/Mime's specific handling of CRLF characters. Since the target uses a different mail library (SwiftMailer), the specific attack chain described in the CVE cannot be completed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.5.50-p1+tuxcare of laravel/framework. Version 5.5.50 is not vulnerable. Summary: The target repository (Laravel 5.5.50-p2+tuxcare) is NOT VULNERABLE to GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie serialization). The repository has been patched with a global serialization disable mechanism that is more secure than the vendor's original selective fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "Version 5.5.50 is not vulnerable. Summary: The target repository (Laravel 5.5.50-p2+tuxcare) is NOT VULNERABLE to GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie serialization). The repository has been patched with a global serialization disable mechanism that is more secure than the vendor's original selective fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.5.50-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework 5.5.50-p4+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The IV length validation fix is present in the code (src/Illuminate/Encryption/Encrypter.php lines 209-210), preventing manipulated payloads with wrong-length IVs from causing decryption to return false. This fix was already included in the upstream Laravel 5.5.50 release (committed by Taylor Otwell in March ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel Framework 5.5.50-p4+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The IV length validation fix is present in the code (src/Illuminate/Encryption/Encrypter.php lines 209-210), preventing manipulated payloads with wrong-length IVs from causing decryption to return false. This fix was already included in the upstream Laravel 5.5.50 release (committed by Taylor Otwell in March ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.5.50-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 5.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.5.50 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 5.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.5.50-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.5.50-p1+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 5.5.50-p1+tuxcare of laravel/framework, and is fixed in 5.5.50-p2+tuxcare.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 5.5.50-p1+tuxcare of laravel/framework, and is fixed in 5.5.50-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.5.50-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.5.50-p1+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.5.50-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.5.50-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:18:26.551161+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 5.8.38-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.8.38-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.8.38-p6+tuxcare of laravel/framework. The target (Laravel 5.8.38) is not affected by CVE-2018-15133. The vulnerability was fixed upstream by Taylor Otwell in August 2018 by disabling PHP serialization for cookies and the X-XSRF-TOKEN header. Laravel 5.8.38 shipped with this fix already applied. The fix prevents PHP object injection by passing `false` to encrypt()/decrypt() methods, which disables automatic unserialize() calls on decrypted data. The vulnerable code pattern (automatic unserialization enabling RCE via crafted XSRF tokens) is not present in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "The target (Laravel 5.8.38) is not affected by CVE-2018-15133. The vulnerability was fixed upstream by Taylor Otwell in August 2018 by disabling PHP serialization for cookies and the X-XSRF-TOKEN header. Laravel 5.8.38 shipped with this fix already applied. The fix prevents PHP object injection by passing `false` to encrypt()/decrypt() methods, which disables automatic unserialize() calls on decrypted data. The vulnerable code pattern (automatic unserialization enabling RCE via crafted XSRF tokens) is not present in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-19T13:14:00.236705+00:00", "status_notes": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.8.38-p6+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19).", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 5.8.38-p6+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before 5.8.17. The target is version 5.8.38-p8+tuxcare, which already contains the upstream fix. The vulnerability was an OS command injection in the link() function where unescaped $link and $target parameters were interpolated into an exec() call. The fix wraps both parameters with escapeshellarg() before shell execution. This fix was already present in the upstream Laravel 5.8.38 release and was imported via the Initial commit when TuxCare onboarded this version. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before 5.8.17. The target is version 5.8.38-p8+tuxcare, which already contains the upstream fix. The vulnerability was an OS command injection in the link() function where unescaped $link and $target parameters were interpolated into an exec() call. The fix wraps both parameters with escapeshellarg() before shell execution. This fix was already present in the upstream Laravel 5.8.38 release and was imported via the Initial commit when TuxCare onboarded this version. The vulnerable code pattern is not present in the target." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:18:26.551161+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.8.38-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 5.8.38-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 5.8.38-p6+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.8.38-p6+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:18:26.551161+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.8.38-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:18:26.551161+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.8.38-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:18:26.551161+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.8.38-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:18:26.551161+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.8.38-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.8.38-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-11-04T12:52:00.536685+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.8.38-p6+tuxcare of laravel/framework, and is fixed in 5.8.38-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.8.38-p6+tuxcare of laravel/framework, and is fixed in 5.8.38-p9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:18:26.551161+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.8.38-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:18:26.551161+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 5.8.38-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.8.38-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.8.38-p6+tuxcare of laravel/framework. not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:18:26.551161+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.8.38-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p6+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:18:26.551161+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.8.38-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p6+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } } ], "timestamp": "2026-10-08T11:18:26.551161+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.8.38-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-12T07:00:11.552617+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 5.8.38-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.8.38-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.8.38-p7+tuxcare of laravel/framework. The target (Laravel 5.8.38) is not affected by CVE-2018-15133. The vulnerability was fixed upstream by Taylor Otwell in August 2018 by disabling PHP serialization for cookies and the X-XSRF-TOKEN header. Laravel 5.8.38 shipped with this fix already applied. The fix prevents PHP object injection by passing `false` to encrypt()/decrypt() methods, which disables automatic unserialize() calls on decrypted data. The vulnerable code pattern (automatic unserialization enabling RCE via crafted XSRF tokens) is not present in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "The target (Laravel 5.8.38) is not affected by CVE-2018-15133. The vulnerability was fixed upstream by Taylor Otwell in August 2018 by disabling PHP serialization for cookies and the X-XSRF-TOKEN header. Laravel 5.8.38 shipped with this fix already applied. The fix prevents PHP object injection by passing `false` to encrypt()/decrypt() methods, which disables automatic unserialize() calls on decrypted data. The vulnerable code pattern (automatic unserialization enabling RCE via crafted XSRF tokens) is not present in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-19T13:14:00.236705+00:00", "status_notes": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.8.38-p7+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19).", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 5.8.38-p7+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before 5.8.17. The target is version 5.8.38-p8+tuxcare, which already contains the upstream fix. The vulnerability was an OS command injection in the link() function where unescaped $link and $target parameters were interpolated into an exec() call. The fix wraps both parameters with escapeshellarg() before shell execution. This fix was already present in the upstream Laravel 5.8.38 release and was imported via the Initial commit when TuxCare onboarded this version. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before 5.8.17. The target is version 5.8.38-p8+tuxcare, which already contains the upstream fix. The vulnerability was an OS command injection in the link() function where unescaped $link and $target parameters were interpolated into an exec() call. The fix wraps both parameters with escapeshellarg() before shell execution. This fix was already present in the upstream Laravel 5.8.38 release and was imported via the Initial commit when TuxCare onboarded this version. The vulnerable code pattern is not present in the target." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-12T07:00:11.552617+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.8.38-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 5.8.38-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 5.8.38-p7+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.8.38-p7+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-12T07:00:11.552617+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.8.38-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-12T07:00:11.552617+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.8.38-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-12T07:00:11.552617+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.8.38-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-12T07:00:11.552617+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.8.38-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.8.38-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-11-04T12:52:00.536685+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 5.8.38-p7+tuxcare of laravel/framework, and is fixed in 5.8.38-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 5.8.38-p7+tuxcare of laravel/framework, and is fixed in 5.8.38-p9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-12T07:00:11.552617+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.8.38-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-12T07:00:11.552617+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 5.8.38-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.8.38-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.8.38-p7+tuxcare of laravel/framework. not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-12T07:00:11.552617+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.8.38-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p7+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-12T07:00:11.552617+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.8.38-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p7+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } } ], "timestamp": "2026-10-12T07:00:11.552617+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.8.38-p7+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 10.48.28-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2017-14775. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel v5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 10.48.28 inherited this fix from upstream - both DatabaseUserProvider and EloquentUserProvider use hash_equals() for token verification. The fix was autho...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2017-14775. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel v5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 10.48.28 inherited this fix from upstream - both DatabaseUserProvider and EloquentUserProvider use hash_equals() for token verification. The fix was autho..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 10.48.28-p2+tuxcare of laravel/framework. CVE-2018-15133 (RCE via unserialize on X-XSRF-TOKEN) is not present in Laravel 10.48.28. The vulnerability was fixed by Laravel upstream in August 2018 (commit 240d904606 by Taylor Otwell). The fix disables PHP serialization during cookie decryption by setting `static $serialize = false` and passing this value to all decrypt() calls. This protection was already present in Laravel 10.48.28 when TuxCare onboarded the version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 (RCE via unserialize on X-XSRF-TOKEN) is not present in Laravel 10.48.28. The vulnerability was fixed by Laravel upstream in August 2018 (commit 240d904606 by Taylor Otwell). The fix disables PHP serialization during cookie decryption by setting `static $serialize = false` and passing this value to all decrypt() calls. This protection was already present in Laravel 10.48.28 when TuxCare onboarded the version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 10.48.28-p2+tuxcare of laravel/framework. Laravel Framework 10.48.28 is not affected by CVE-2019-9081. While the PendingCommand class with a dangerous __destruct method exists, there is no reachable attack path. Cookie serialization is disabled by default (EncryptCookies::$serialize = false), and all other deserialization entry points (sessions, cache, queues) use server-side storage not controllable via HTTP requests. The vulnerability pattern cannot be triggered by attacker-controlled input in normal production usage.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "Laravel Framework 10.48.28 is not affected by CVE-2019-9081. While the PendingCommand class with a dangerous __destruct method exists, there is no reachable attack path. Cookie serialization is disabled by default (EncryptCookies::$serialize = false), and all other deserialization entry points (sessions, cache, queues) use server-side storage not controllable via HTTP requests. The vulnerability pattern cannot be triggered by attacker-controlled input in normal production usage." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 10.48.28-p2+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before version 5.8.17 (OS command injection via unescaped parameters in Filesystem::link()). The target repository is laravel/framework version 10.48.28-p3+tuxcare. Analysis confirms the fix (escapeshellarg() wrapping of both $target and $link parameters) is present at line 360 of src/Illuminate/Filesystem/Filesystem.php. Git blame shows this line originates from commit ae86934b - TuxCare's initial snapshot of upstream v10.48.28. The original upstream fix was committed by Taylor Otwell (taylor@laravel.com) in May 2019 as commit 44c3feb604. Since version 10.48.28 was released years after the 5.8.17 fix, the vulnerable code pattern never existed in this target version - the fix shipped with the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before version 5.8.17 (OS command injection via unescaped parameters in Filesystem::link()). The target repository is laravel/framework version 10.48.28-p3+tuxcare. Analysis confirms the fix (escapeshellarg() wrapping of both $target and $link parameters) is present at line 360 of src/Illuminate/Filesystem/Filesystem.php. Git blame shows this line originates from commit ae86934b - TuxCare's initial snapshot of upstream v10.48.28. The original upstream fix was committed by Taylor Otwell (taylor@laravel.com) in May 2019 as commit 44c3feb604. Since version 10.48.28 was released years after the 5.8.17 fix, the vulnerable code pattern never existed in this target version - the fix shipped with the upstream release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:41:35.131174+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 10.48.28-p2+tuxcare of laravel/framework. CVE-2020-24941 affects Laravel before 6.18.35 and 7.x before 7.24.0. The target is Laravel v10.48.28, which already contains the upstream fix. The GuardsAttributes trait includes the isGuardableColumn() method that validates attribute keys against actual database columns, preventing mass assignment bypass via crafted JSON path expressions or non-existent column names. The fix was present in the upstream Laravel v10.48.28 release that TuxCare onboarded via snapshot commit ae86934b on 2025-10-06, not applied as a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 affects Laravel before 6.18.35 and 7.x before 7.24.0. The target is Laravel v10.48.28, which already contains the upstream fix. The GuardsAttributes trait includes the isGuardableColumn() method that validates attribute keys against actual database columns, preventing mass assignment bypass via crafted JSON path expressions or non-existent column names. The fix was present in the upstream Laravel v10.48.28 release that TuxCare onboarded via snapshot commit ae86934b on 2025-10-06, not applied as a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 10.48.28-p2+tuxcare of laravel/framework. CVE-2021-21263 affects Laravel versions <6.20.12, <7.30.3, and <8.22.1. The target (Laravel 10.48.28-p3+tuxcare) is not affected because the upstream Laravel 10.48.28 release already contains the fix. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() method or array_slice() to prevent array values from adding unexpected query bindings. This protection was shipped in the upstream release and imported via TuxCare's snapshot commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "CVE-2021-21263 affects Laravel versions <6.20.12, <7.30.3, and <8.22.1. The target (Laravel 10.48.28-p3+tuxcare) is not affected because the upstream Laravel 10.48.28 release already contains the fix. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() method or array_slice() to prevent array values from adding unexpected query bindings. This protection was shipped in the upstream release and imported via TuxCare's snapshot commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 10.48.28-p2+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is not present in the target. The security fix was already included in upstream Laravel 10.48.28, which TuxCare onboarded. The target implements all three security components: random salt generation (using cryptographically secure random_bytes()), runtime placeholder computation, and cache-busting 'v2' prefix. The vulnerability was o...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is not present in the target. The security fix was already included in upstream Laravel 10.48.28, which TuxCare onboarded. The target implements all three security components: random salt generation (using cryptographically secure random_bytes()), runtime placeholder computation, and cache-busting 'v2' prefix. The vulnerability was o..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 10.48.28-p2+tuxcare of laravel/framework. Target version 10.48.28 is NOT AFFECTED by CVE-2024-52301. The vulnerability was fixed by Laravel upstream in v10.48.23 (November 12, 2024) via commit 8c07b6301b2a177a34ee5fdbca11443e3e541a15 authored by Taylor Otwell. The fix was already present in the upstream v10.48.28 release when TuxCare onboarded it on October 6, 2024. The target's detectEnvironment() method correctly blocks argv-based environment manipulation in non-CLI contexts by checking runningInConsole() before using $_SERVER['argv'].", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "Target version 10.48.28 is NOT AFFECTED by CVE-2024-52301. The vulnerability was fixed by Laravel upstream in v10.48.23 (November 12, 2024) via commit 8c07b6301b2a177a34ee5fdbca11443e3e541a15 authored by Taylor Otwell. The fix was already present in the upstream v10.48.28 release when TuxCare onboarded it on October 6, 2024. The target's detectEnvironment() method correctly blocks argv-based environment manipulation in non-CLI contexts by checking runningInConsole() before using $_SERVER['argv']." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 10.48.28-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:29:00.136561+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 10.48.28-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2026-102279. The vulnerability targets Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in Laravel 12.x. Laravel 10.x uses a completely different exception rendering architecture (Whoops PrettyPageHandler and Symfony HtmlErrorRenderer) that does not include JavaScript tooltips or the vulnerable allowHTML:true configuration....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2026-102279. The vulnerability targets Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in Laravel 12.x. Laravel 10.x uses a completely different exception rendering architecture (Whoops PrettyPageHandler and Symfony HtmlErrorRenderer) that does not include JavaScript tooltips or the vulnerable allowHTML:true configuration...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 10.48.28-p2+tuxcare of laravel/framework. not_affected \u2014 The target version (laravel/framework 10.48.28) is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resources feature, which was introduced in version 12.x (December 2025). Version 10.48.28 predates this feature entirely - the vulnerable code (ResolvesJsonApiElements trait) and the entire JsonApi module do not exist in v10.x. The target uses standard JSON resource...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target version (laravel/framework 10.48.28) is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resources feature, which was introduced in version 12.x (December 2025). Version 10.48.28 predates this feature entirely - the vulnerable code (ResolvesJsonApiElements trait) and the entire JsonApi module do not exist in v10.x. The target uses standard JSON resource..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-26T16:22:00.021432+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 10.48.28-p2+tuxcare of laravel/framework, and is fixed in 10.48.28-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 10.48.28-p2+tuxcare of laravel/framework, and is fixed in 10.48.28-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:45:12.375364+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 10.48.28-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework v10.48.28-p3+tuxcare is not affected by GHSA-4mg9-vhxq-vm7j (SQL Server limit/offset SQL injection). The vulnerability pattern is absent because the upstream fix was already included in Laravel v10.48.28, which was onboarded into the TuxCare branch. Integer casting protections are present in both Builder.php (limit/offset/skip/take methods) and SqlServerGrammar.php ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The target Laravel Framework v10.48.28-p3+tuxcare is not affected by GHSA-4mg9-vhxq-vm7j (SQL Server limit/offset SQL injection). The vulnerability pattern is absent because the upstream fix was already included in Laravel v10.48.28, which was onboarded into the TuxCare branch. Integer casting protections are present in both Builder.php (limit/offset/skip/take methods) and SqlServerGrammar.php ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 10.48.28-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 10.48.28-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28-p3+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie deserialization). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling automatic serialization for all cookies. Laravel 10.48.28 was released in 2024, approximately 6 years after the fix, and the protection was already present in the upstream release that TuxCare onboarded. Th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28-p3+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie deserialization). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling automatic serialization for all cookies. Laravel 10.48.28 was released in 2024, approximately 6 years after the fix, and the protection was already present in the upstream release that TuxCare onboarded. Th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-11-06T11:19:00.067933+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 10.48.28-p2+tuxcare of laravel/framework. Already fixed upstream before 10.48.28 (GHSA-7852-w36x-6mf6 affects only <5.5.40 and 5.6.0-5.6.14; patched in 5.5.40/5.6.15, upstream commits 28e53f23a7/886d261df0, 2018-03-30): Encrypter::decrypt() throws DecryptException when openssl_decrypt returns false, and validPayload() enforces the IV length via openssl_cipher_iv_length. Vendor fix present in laravel/framework v10.48.28; Encrypter.php on tuxcare-current/10.48.28 (72a551b0e0) is identical to upstream. No TuxCare patch needed. Ref PHPELSCVE-991.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "Already fixed upstream before 10.48.28 (GHSA-7852-w36x-6mf6 affects only <5.5.40 and 5.6.0-5.6.14; patched in 5.5.40/5.6.15, upstream commits 28e53f23a7/886d261df0, 2018-03-30): Encrypter::decrypt() throws DecryptException when openssl_decrypt returns false, and validPayload() enforces the IV length via openssl_cipher_iv_length. Vendor fix present in laravel/framework v10.48.28; Encrypter.php on tuxcare-current/10.48.28 (72a551b0e0) is identical to upstream. No TuxCare patch needed. Ref PHPELSCVE-991." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 10.48.28-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 does not contain the vulnerable code path. The vulnerability (GHSA-crmm-hgp2-wgrp) affects Laravel 11+'s LocalFilesystemAdapter class, which was introduced in Laravel 11 and does not exist in Laravel 10. Laravel 10 uses a delegating architecture where FilesystemAdapter throws RuntimeException for local filesystem temporary URLs rather than implementing them.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28 does not contain the vulnerable code path. The vulnerability (GHSA-crmm-hgp2-wgrp) affects Laravel 11+'s LocalFilesystemAdapter class, which was introduced in Laravel 11 and does not exist in Laravel 10. Laravel 10 uses a delegating architecture where FilesystemAdapter throws RuntimeException for local filesystem temporary URLs rather than implementing them." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:13:18.978013+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 10.48.28-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel framework 10.48.28 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable pattern described in the advisory (unexpected query bindings when array values are passed where scalars are expected) is not present in this version. The upstream Laravel 10.48.28 release already included the complete fix, which normalizes array inputs to scalar values using the `flattenValue()` helper method and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 Laravel framework 10.48.28 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable pattern described in the advisory (unexpected query bindings when array values are passed where scalars are expected) is not present in this version. The upstream Laravel 10.48.28 release already included the complete fix, which normalizes array inputs to scalar values using the `flattenValue()` helper method and ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:16:05.248593+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 10.48.28-p2+tuxcare of laravel/framework. The target Laravel framework v10.48.28-p3+tuxcare is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (cookie encryption oracle vulnerability). The security fix replacing predictable SHA1 cookie prefixes with HMAC-based prefixes was already present in the upstream Laravel v10.48.28 release that TuxCare onboarded. The vulnerable code pattern does not exist in the current codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework v10.48.28-p3+tuxcare is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (cookie encryption oracle vulnerability). The security fix replacing predictable SHA1 cookie prefixes with HMAC-based prefixes was already present in the upstream Laravel v10.48.28 release that TuxCare onboarded. The vulnerable code pattern does not exist in the current codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 10.48.28-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched by upstream Laravel in April 2021 (versions 6.20.26, 7.30.5, 8.40.0). Laravel 10.48.28, released in 2024, already contains all required integer casting defenses in SqlServerGrammar.php (is_numeric checks, int casts in compileColumns/compileLimit/compileOffset) and Build...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched by upstream Laravel in April 2021 (versions 6.20.26, 7.30.5, 8.40.0). Laravel 10.48.28, released in 2024, already contains all required integer casting defenses in SqlServerGrammar.php (is_numeric checks, int casts in compileColumns/compileLimit/compileOffset) and Build..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:41:42.263575+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 10.48.28-p2+tuxcare of laravel/framework. The target repository Laravel framework v10.48.28 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability fix (limiting query bindings from array inputs) was already included in the upstream Laravel 10.48.28 release. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the flattenValue() method to extract only the first element from array inputs, preventing binding manipulation attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "The target repository Laravel framework v10.48.28 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability fix (limiting query bindings from array inputs) was already included in the upstream Laravel 10.48.28 release. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the flattenValue() method to extract only the first element from array inputs, preventing binding manipulation attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/routing@v3.4.47-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v3.4.47-p1+tuxcare" } } ], "timestamp": "2026-11-06T08:10:37.020440+00:00", "status_notes": "Vulnerability CVE-2026-118516 does not affect version v3.4.47-p1+tuxcare of symfony/routing. not_affected \u2014 symfony/routing v3.4.47 has no CompiledUrlMatcher. Both UrlMatcher and the PhpMatcherDumper-generated matcher match the host regex against the host only and the path regex against the path only. The $host.'.'.$pathinfo concatenation behind CVE-2026-118516 does not exist, so a host placeholder can't consume part of the path.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-118516" }, "impact_statement": "not_affected \u2014 symfony/routing v3.4.47 has no CompiledUrlMatcher. Both UrlMatcher and the PhpMatcherDumper-generated matcher match the host regex against the host only and the path regex against the path only. The $host.'.'.$pathinfo concatenation behind CVE-2026-118516 does not exist, so a host placeholder can't consume part of the path." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v3.4.47-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v3.4.47-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45065 is fixed in version v3.4.47-p1+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-45065" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v3.4.47-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v3.4.47-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48784 is fixed in version v3.4.47-p1+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-48784" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 10.48.28-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2017-14775. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel v5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 10.48.28 inherited this fix from upstream - both DatabaseUserProvider and EloquentUserProvider use hash_equals() for token verification. The fix was autho...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2017-14775. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel v5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 10.48.28 inherited this fix from upstream - both DatabaseUserProvider and EloquentUserProvider use hash_equals() for token verification. The fix was autho..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 10.48.28-p3+tuxcare of laravel/framework. CVE-2018-15133 (RCE via unserialize on X-XSRF-TOKEN) is not present in Laravel 10.48.28. The vulnerability was fixed by Laravel upstream in August 2018 (commit 240d904606 by Taylor Otwell). The fix disables PHP serialization during cookie decryption by setting `static $serialize = false` and passing this value to all decrypt() calls. This protection was already present in Laravel 10.48.28 when TuxCare onboarded the version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 (RCE via unserialize on X-XSRF-TOKEN) is not present in Laravel 10.48.28. The vulnerability was fixed by Laravel upstream in August 2018 (commit 240d904606 by Taylor Otwell). The fix disables PHP serialization during cookie decryption by setting `static $serialize = false` and passing this value to all decrypt() calls. This protection was already present in Laravel 10.48.28 when TuxCare onboarded the version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 10.48.28-p3+tuxcare of laravel/framework. Laravel Framework 10.48.28 is not affected by CVE-2019-9081. While the PendingCommand class with a dangerous __destruct method exists, there is no reachable attack path. Cookie serialization is disabled by default (EncryptCookies::$serialize = false), and all other deserialization entry points (sessions, cache, queues) use server-side storage not controllable via HTTP requests. The vulnerability pattern cannot be triggered by attacker-controlled input in normal production usage.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "Laravel Framework 10.48.28 is not affected by CVE-2019-9081. While the PendingCommand class with a dangerous __destruct method exists, there is no reachable attack path. Cookie serialization is disabled by default (EncryptCookies::$serialize = false), and all other deserialization entry points (sessions, cache, queues) use server-side storage not controllable via HTTP requests. The vulnerability pattern cannot be triggered by attacker-controlled input in normal production usage." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 10.48.28-p3+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before version 5.8.17 (OS command injection via unescaped parameters in Filesystem::link()). The target repository is laravel/framework version 10.48.28-p3+tuxcare. Analysis confirms the fix (escapeshellarg() wrapping of both $target and $link parameters) is present at line 360 of src/Illuminate/Filesystem/Filesystem.php. Git blame shows this line originates from commit ae86934b - TuxCare's initial snapshot of upstream v10.48.28. The original upstream fix was committed by Taylor Otwell (taylor@laravel.com) in May 2019 as commit 44c3feb604. Since version 10.48.28 was released years after the 5.8.17 fix, the vulnerable code pattern never existed in this target version - the fix shipped with the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before version 5.8.17 (OS command injection via unescaped parameters in Filesystem::link()). The target repository is laravel/framework version 10.48.28-p3+tuxcare. Analysis confirms the fix (escapeshellarg() wrapping of both $target and $link parameters) is present at line 360 of src/Illuminate/Filesystem/Filesystem.php. Git blame shows this line originates from commit ae86934b - TuxCare's initial snapshot of upstream v10.48.28. The original upstream fix was committed by Taylor Otwell (taylor@laravel.com) in May 2019 as commit 44c3feb604. Since version 10.48.28 was released years after the 5.8.17 fix, the vulnerable code pattern never existed in this target version - the fix shipped with the upstream release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:41:35.131174+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 10.48.28-p3+tuxcare of laravel/framework. CVE-2020-24941 affects Laravel before 6.18.35 and 7.x before 7.24.0. The target is Laravel v10.48.28, which already contains the upstream fix. The GuardsAttributes trait includes the isGuardableColumn() method that validates attribute keys against actual database columns, preventing mass assignment bypass via crafted JSON path expressions or non-existent column names. The fix was present in the upstream Laravel v10.48.28 release that TuxCare onboarded via snapshot commit ae86934b on 2025-10-06, not applied as a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 affects Laravel before 6.18.35 and 7.x before 7.24.0. The target is Laravel v10.48.28, which already contains the upstream fix. The GuardsAttributes trait includes the isGuardableColumn() method that validates attribute keys against actual database columns, preventing mass assignment bypass via crafted JSON path expressions or non-existent column names. The fix was present in the upstream Laravel v10.48.28 release that TuxCare onboarded via snapshot commit ae86934b on 2025-10-06, not applied as a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 10.48.28-p3+tuxcare of laravel/framework. CVE-2021-21263 affects Laravel versions <6.20.12, <7.30.3, and <8.22.1. The target (Laravel 10.48.28-p3+tuxcare) is not affected because the upstream Laravel 10.48.28 release already contains the fix. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() method or array_slice() to prevent array values from adding unexpected query bindings. This protection was shipped in the upstream release and imported via TuxCare's snapshot commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "CVE-2021-21263 affects Laravel versions <6.20.12, <7.30.3, and <8.22.1. The target (Laravel 10.48.28-p3+tuxcare) is not affected because the upstream Laravel 10.48.28 release already contains the fix. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() method or array_slice() to prevent array values from adding unexpected query bindings. This protection was shipped in the upstream release and imported via TuxCare's snapshot commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 10.48.28-p3+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is not present in the target. The security fix was already included in upstream Laravel 10.48.28, which TuxCare onboarded. The target implements all three security components: random salt generation (using cryptographically secure random_bytes()), runtime placeholder computation, and cache-busting 'v2' prefix. The vulnerability was o...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is not present in the target. The security fix was already included in upstream Laravel 10.48.28, which TuxCare onboarded. The target implements all three security components: random salt generation (using cryptographically secure random_bytes()), runtime placeholder computation, and cache-busting 'v2' prefix. The vulnerability was o..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 10.48.28-p3+tuxcare of laravel/framework. Target version 10.48.28 is NOT AFFECTED by CVE-2024-52301. The vulnerability was fixed by Laravel upstream in v10.48.23 (November 12, 2024) via commit 8c07b6301b2a177a34ee5fdbca11443e3e541a15 authored by Taylor Otwell. The fix was already present in the upstream v10.48.28 release when TuxCare onboarded it on October 6, 2024. The target's detectEnvironment() method correctly blocks argv-based environment manipulation in non-CLI contexts by checking runningInConsole() before using $_SERVER['argv'].", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "Target version 10.48.28 is NOT AFFECTED by CVE-2024-52301. The vulnerability was fixed by Laravel upstream in v10.48.23 (November 12, 2024) via commit 8c07b6301b2a177a34ee5fdbca11443e3e541a15 authored by Taylor Otwell. The fix was already present in the upstream v10.48.28 release when TuxCare onboarded it on October 6, 2024. The target's detectEnvironment() method correctly blocks argv-based environment manipulation in non-CLI contexts by checking runningInConsole() before using $_SERVER['argv']." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-26T16:22:00.021432+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 10.48.28-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-26T16:22:00.021432+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 10.48.28-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2026-102279. The vulnerability targets Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in Laravel 12.x. Laravel 10.x uses a completely different exception rendering architecture (Whoops PrettyPageHandler and Symfony HtmlErrorRenderer) that does not include JavaScript tooltips or the vulnerable allowHTML:true configuration....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2026-102279. The vulnerability targets Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in Laravel 12.x. Laravel 10.x uses a completely different exception rendering architecture (Whoops PrettyPageHandler and Symfony HtmlErrorRenderer) that does not include JavaScript tooltips or the vulnerable allowHTML:true configuration...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 10.48.28-p3+tuxcare of laravel/framework. not_affected \u2014 The target version (laravel/framework 10.48.28) is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resources feature, which was introduced in version 12.x (December 2025). Version 10.48.28 predates this feature entirely - the vulnerable code (ResolvesJsonApiElements trait) and the entire JsonApi module do not exist in v10.x. The target uses standard JSON resource...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target version (laravel/framework 10.48.28) is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resources feature, which was introduced in version 12.x (December 2025). Version 10.48.28 predates this feature entirely - the vulnerable code (ResolvesJsonApiElements trait) and the entire JsonApi module do not exist in v10.x. The target uses standard JSON resource..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-26T16:22:00.021432+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 10.48.28-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:45:12.375364+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 10.48.28-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework v10.48.28-p3+tuxcare is not affected by GHSA-4mg9-vhxq-vm7j (SQL Server limit/offset SQL injection). The vulnerability pattern is absent because the upstream fix was already included in Laravel v10.48.28, which was onboarded into the TuxCare branch. Integer casting protections are present in both Builder.php (limit/offset/skip/take methods) and SqlServerGrammar.php ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The target Laravel Framework v10.48.28-p3+tuxcare is not affected by GHSA-4mg9-vhxq-vm7j (SQL Server limit/offset SQL injection). The vulnerability pattern is absent because the upstream fix was already included in Laravel v10.48.28, which was onboarded into the TuxCare branch. Integer casting protections are present in both Builder.php (limit/offset/skip/take methods) and SqlServerGrammar.php ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-26T16:22:00.021432+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 10.48.28-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 10.48.28-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28-p3+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie deserialization). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling automatic serialization for all cookies. Laravel 10.48.28 was released in 2024, approximately 6 years after the fix, and the protection was already present in the upstream release that TuxCare onboarded. Th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28-p3+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie deserialization). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling automatic serialization for all cookies. Laravel 10.48.28 was released in 2024, approximately 6 years after the fix, and the protection was already present in the upstream release that TuxCare onboarded. Th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-11-06T11:19:00.067933+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 10.48.28-p3+tuxcare of laravel/framework. Already fixed upstream before 10.48.28 (GHSA-7852-w36x-6mf6 affects only <5.5.40 and 5.6.0-5.6.14; patched in 5.5.40/5.6.15, upstream commits 28e53f23a7/886d261df0, 2018-03-30): Encrypter::decrypt() throws DecryptException when openssl_decrypt returns false, and validPayload() enforces the IV length via openssl_cipher_iv_length. Vendor fix present in laravel/framework v10.48.28; Encrypter.php on tuxcare-current/10.48.28 (72a551b0e0) is identical to upstream. No TuxCare patch needed. Ref PHPELSCVE-991.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "Already fixed upstream before 10.48.28 (GHSA-7852-w36x-6mf6 affects only <5.5.40 and 5.6.0-5.6.14; patched in 5.5.40/5.6.15, upstream commits 28e53f23a7/886d261df0, 2018-03-30): Encrypter::decrypt() throws DecryptException when openssl_decrypt returns false, and validPayload() enforces the IV length via openssl_cipher_iv_length. Vendor fix present in laravel/framework v10.48.28; Encrypter.php on tuxcare-current/10.48.28 (72a551b0e0) is identical to upstream. No TuxCare patch needed. Ref PHPELSCVE-991." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-26T16:22:00.021432+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 10.48.28-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 does not contain the vulnerable code path. The vulnerability (GHSA-crmm-hgp2-wgrp) affects Laravel 11+'s LocalFilesystemAdapter class, which was introduced in Laravel 11 and does not exist in Laravel 10. Laravel 10 uses a delegating architecture where FilesystemAdapter throws RuntimeException for local filesystem temporary URLs rather than implementing them.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28 does not contain the vulnerable code path. The vulnerability (GHSA-crmm-hgp2-wgrp) affects Laravel 11+'s LocalFilesystemAdapter class, which was introduced in Laravel 11 and does not exist in Laravel 10. Laravel 10 uses a delegating architecture where FilesystemAdapter throws RuntimeException for local filesystem temporary URLs rather than implementing them." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:13:18.978013+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 10.48.28-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel framework 10.48.28 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable pattern described in the advisory (unexpected query bindings when array values are passed where scalars are expected) is not present in this version. The upstream Laravel 10.48.28 release already included the complete fix, which normalizes array inputs to scalar values using the `flattenValue()` helper method and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 Laravel framework 10.48.28 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable pattern described in the advisory (unexpected query bindings when array values are passed where scalars are expected) is not present in this version. The upstream Laravel 10.48.28 release already included the complete fix, which normalizes array inputs to scalar values using the `flattenValue()` helper method and ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:16:05.248593+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 10.48.28-p3+tuxcare of laravel/framework. The target Laravel framework v10.48.28-p3+tuxcare is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (cookie encryption oracle vulnerability). The security fix replacing predictable SHA1 cookie prefixes with HMAC-based prefixes was already present in the upstream Laravel v10.48.28 release that TuxCare onboarded. The vulnerable code pattern does not exist in the current codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework v10.48.28-p3+tuxcare is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (cookie encryption oracle vulnerability). The security fix replacing predictable SHA1 cookie prefixes with HMAC-based prefixes was already present in the upstream Laravel v10.48.28 release that TuxCare onboarded. The vulnerable code pattern does not exist in the current codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 10.48.28-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched by upstream Laravel in April 2021 (versions 6.20.26, 7.30.5, 8.40.0). Laravel 10.48.28, released in 2024, already contains all required integer casting defenses in SqlServerGrammar.php (is_numeric checks, int casts in compileColumns/compileLimit/compileOffset) and Build...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched by upstream Laravel in April 2021 (versions 6.20.26, 7.30.5, 8.40.0). Laravel 10.48.28, released in 2024, already contains all required integer casting defenses in SqlServerGrammar.php (is_numeric checks, int casts in compileColumns/compileLimit/compileOffset) and Build..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:41:42.263575+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 10.48.28-p3+tuxcare of laravel/framework. The target repository Laravel framework v10.48.28 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability fix (limiting query bindings from array inputs) was already included in the upstream Laravel 10.48.28 release. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the flattenValue() method to extract only the first element from array inputs, preventing binding manipulation attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "The target repository Laravel framework v10.48.28 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability fix (limiting query bindings from array inputs) was already included in the upstream Laravel 10.48.28 release. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the flattenValue() method to extract only the first element from array inputs, preventing binding manipulation attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 10.48.28-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2017-14775. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel v5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 10.48.28 inherited this fix from upstream - both DatabaseUserProvider and EloquentUserProvider use hash_equals() for token verification. The fix was autho...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2017-14775. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel v5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 10.48.28 inherited this fix from upstream - both DatabaseUserProvider and EloquentUserProvider use hash_equals() for token verification. The fix was autho..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 10.48.28-p1+tuxcare of laravel/framework. CVE-2018-15133 (RCE via unserialize on X-XSRF-TOKEN) is not present in Laravel 10.48.28. The vulnerability was fixed by Laravel upstream in August 2018 (commit 240d904606 by Taylor Otwell). The fix disables PHP serialization during cookie decryption by setting `static $serialize = false` and passing this value to all decrypt() calls. This protection was already present in Laravel 10.48.28 when TuxCare onboarded the version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 (RCE via unserialize on X-XSRF-TOKEN) is not present in Laravel 10.48.28. The vulnerability was fixed by Laravel upstream in August 2018 (commit 240d904606 by Taylor Otwell). The fix disables PHP serialization during cookie decryption by setting `static $serialize = false` and passing this value to all decrypt() calls. This protection was already present in Laravel 10.48.28 when TuxCare onboarded the version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 10.48.28-p1+tuxcare of laravel/framework. Laravel Framework 10.48.28 is not affected by CVE-2019-9081. While the PendingCommand class with a dangerous __destruct method exists, there is no reachable attack path. Cookie serialization is disabled by default (EncryptCookies::$serialize = false), and all other deserialization entry points (sessions, cache, queues) use server-side storage not controllable via HTTP requests. The vulnerability pattern cannot be triggered by attacker-controlled input in normal production usage.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "Laravel Framework 10.48.28 is not affected by CVE-2019-9081. While the PendingCommand class with a dangerous __destruct method exists, there is no reachable attack path. Cookie serialization is disabled by default (EncryptCookies::$serialize = false), and all other deserialization entry points (sessions, cache, queues) use server-side storage not controllable via HTTP requests. The vulnerability pattern cannot be triggered by attacker-controlled input in normal production usage." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 10.48.28-p1+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before version 5.8.17 (OS command injection via unescaped parameters in Filesystem::link()). The target repository is laravel/framework version 10.48.28-p3+tuxcare. Analysis confirms the fix (escapeshellarg() wrapping of both $target and $link parameters) is present at line 360 of src/Illuminate/Filesystem/Filesystem.php. Git blame shows this line originates from commit ae86934b - TuxCare's initial snapshot of upstream v10.48.28. The original upstream fix was committed by Taylor Otwell (taylor@laravel.com) in May 2019 as commit 44c3feb604. Since version 10.48.28 was released years after the 5.8.17 fix, the vulnerable code pattern never existed in this target version - the fix shipped with the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before version 5.8.17 (OS command injection via unescaped parameters in Filesystem::link()). The target repository is laravel/framework version 10.48.28-p3+tuxcare. Analysis confirms the fix (escapeshellarg() wrapping of both $target and $link parameters) is present at line 360 of src/Illuminate/Filesystem/Filesystem.php. Git blame shows this line originates from commit ae86934b - TuxCare's initial snapshot of upstream v10.48.28. The original upstream fix was committed by Taylor Otwell (taylor@laravel.com) in May 2019 as commit 44c3feb604. Since version 10.48.28 was released years after the 5.8.17 fix, the vulnerable code pattern never existed in this target version - the fix shipped with the upstream release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:41:35.131174+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 10.48.28-p1+tuxcare of laravel/framework. CVE-2020-24941 affects Laravel before 6.18.35 and 7.x before 7.24.0. The target is Laravel v10.48.28, which already contains the upstream fix. The GuardsAttributes trait includes the isGuardableColumn() method that validates attribute keys against actual database columns, preventing mass assignment bypass via crafted JSON path expressions or non-existent column names. The fix was present in the upstream Laravel v10.48.28 release that TuxCare onboarded via snapshot commit ae86934b on 2025-10-06, not applied as a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 affects Laravel before 6.18.35 and 7.x before 7.24.0. The target is Laravel v10.48.28, which already contains the upstream fix. The GuardsAttributes trait includes the isGuardableColumn() method that validates attribute keys against actual database columns, preventing mass assignment bypass via crafted JSON path expressions or non-existent column names. The fix was present in the upstream Laravel v10.48.28 release that TuxCare onboarded via snapshot commit ae86934b on 2025-10-06, not applied as a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 10.48.28-p1+tuxcare of laravel/framework. CVE-2021-21263 affects Laravel versions <6.20.12, <7.30.3, and <8.22.1. The target (Laravel 10.48.28-p3+tuxcare) is not affected because the upstream Laravel 10.48.28 release already contains the fix. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() method or array_slice() to prevent array values from adding unexpected query bindings. This protection was shipped in the upstream release and imported via TuxCare's snapshot commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "CVE-2021-21263 affects Laravel versions <6.20.12, <7.30.3, and <8.22.1. The target (Laravel 10.48.28-p3+tuxcare) is not affected because the upstream Laravel 10.48.28 release already contains the fix. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() method or array_slice() to prevent array values from adding unexpected query bindings. This protection was shipped in the upstream release and imported via TuxCare's snapshot commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 10.48.28-p1+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is not present in the target. The security fix was already included in upstream Laravel 10.48.28, which TuxCare onboarded. The target implements all three security components: random salt generation (using cryptographically secure random_bytes()), runtime placeholder computation, and cache-busting 'v2' prefix. The vulnerability was o...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is not present in the target. The security fix was already included in upstream Laravel 10.48.28, which TuxCare onboarded. The target implements all three security components: random salt generation (using cryptographically secure random_bytes()), runtime placeholder computation, and cache-busting 'v2' prefix. The vulnerability was o..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 10.48.28-p1+tuxcare of laravel/framework. Target version 10.48.28 is NOT AFFECTED by CVE-2024-52301. The vulnerability was fixed by Laravel upstream in v10.48.23 (November 12, 2024) via commit 8c07b6301b2a177a34ee5fdbca11443e3e541a15 authored by Taylor Otwell. The fix was already present in the upstream v10.48.28 release when TuxCare onboarded it on October 6, 2024. The target's detectEnvironment() method correctly blocks argv-based environment manipulation in non-CLI contexts by checking runningInConsole() before using $_SERVER['argv'].", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "Target version 10.48.28 is NOT AFFECTED by CVE-2024-52301. The vulnerability was fixed by Laravel upstream in v10.48.23 (November 12, 2024) via commit 8c07b6301b2a177a34ee5fdbca11443e3e541a15 authored by Taylor Otwell. The fix was already present in the upstream v10.48.28 release when TuxCare onboarded it on October 6, 2024. The target's detectEnvironment() method correctly blocks argv-based environment manipulation in non-CLI contexts by checking runningInConsole() before using $_SERVER['argv']." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 10.48.28-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:29:00.136561+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 10.48.28-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2026-102279. The vulnerability targets Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in Laravel 12.x. Laravel 10.x uses a completely different exception rendering architecture (Whoops PrettyPageHandler and Symfony HtmlErrorRenderer) that does not include JavaScript tooltips or the vulnerable allowHTML:true configuration....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2026-102279. The vulnerability targets Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in Laravel 12.x. Laravel 10.x uses a completely different exception rendering architecture (Whoops PrettyPageHandler and Symfony HtmlErrorRenderer) that does not include JavaScript tooltips or the vulnerable allowHTML:true configuration...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 10.48.28-p1+tuxcare of laravel/framework. not_affected \u2014 The target version (laravel/framework 10.48.28) is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resources feature, which was introduced in version 12.x (December 2025). Version 10.48.28 predates this feature entirely - the vulnerable code (ResolvesJsonApiElements trait) and the entire JsonApi module do not exist in v10.x. The target uses standard JSON resource...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target version (laravel/framework 10.48.28) is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resources feature, which was introduced in version 12.x (December 2025). Version 10.48.28 predates this feature entirely - the vulnerable code (ResolvesJsonApiElements trait) and the entire JsonApi module do not exist in v10.x. The target uses standard JSON resource..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-26T16:22:00.021432+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 10.48.28-p1+tuxcare of laravel/framework, and is fixed in 10.48.28-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 10.48.28-p1+tuxcare of laravel/framework, and is fixed in 10.48.28-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:45:12.375364+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 10.48.28-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework v10.48.28-p3+tuxcare is not affected by GHSA-4mg9-vhxq-vm7j (SQL Server limit/offset SQL injection). The vulnerability pattern is absent because the upstream fix was already included in Laravel v10.48.28, which was onboarded into the TuxCare branch. Integer casting protections are present in both Builder.php (limit/offset/skip/take methods) and SqlServerGrammar.php ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The target Laravel Framework v10.48.28-p3+tuxcare is not affected by GHSA-4mg9-vhxq-vm7j (SQL Server limit/offset SQL injection). The vulnerability pattern is absent because the upstream fix was already included in Laravel v10.48.28, which was onboarded into the TuxCare branch. Integer casting protections are present in both Builder.php (limit/offset/skip/take methods) and SqlServerGrammar.php ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 10.48.28-p1+tuxcare of laravel/framework, and is fixed in 10.48.28-p2+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 10.48.28-p1+tuxcare of laravel/framework, and is fixed in 10.48.28-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 10.48.28-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28-p3+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie deserialization). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling automatic serialization for all cookies. Laravel 10.48.28 was released in 2024, approximately 6 years after the fix, and the protection was already present in the upstream release that TuxCare onboarded. Th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28-p3+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie deserialization). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling automatic serialization for all cookies. Laravel 10.48.28 was released in 2024, approximately 6 years after the fix, and the protection was already present in the upstream release that TuxCare onboarded. Th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-11-06T11:19:00.067933+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 10.48.28-p1+tuxcare of laravel/framework. Already fixed upstream before 10.48.28 (GHSA-7852-w36x-6mf6 affects only <5.5.40 and 5.6.0-5.6.14; patched in 5.5.40/5.6.15, upstream commits 28e53f23a7/886d261df0, 2018-03-30): Encrypter::decrypt() throws DecryptException when openssl_decrypt returns false, and validPayload() enforces the IV length via openssl_cipher_iv_length. Vendor fix present in laravel/framework v10.48.28; Encrypter.php on tuxcare-current/10.48.28 (72a551b0e0) is identical to upstream. No TuxCare patch needed. Ref PHPELSCVE-991.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "Already fixed upstream before 10.48.28 (GHSA-7852-w36x-6mf6 affects only <5.5.40 and 5.6.0-5.6.14; patched in 5.5.40/5.6.15, upstream commits 28e53f23a7/886d261df0, 2018-03-30): Encrypter::decrypt() throws DecryptException when openssl_decrypt returns false, and validPayload() enforces the IV length via openssl_cipher_iv_length. Vendor fix present in laravel/framework v10.48.28; Encrypter.php on tuxcare-current/10.48.28 (72a551b0e0) is identical to upstream. No TuxCare patch needed. Ref PHPELSCVE-991." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 10.48.28-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 does not contain the vulnerable code path. The vulnerability (GHSA-crmm-hgp2-wgrp) affects Laravel 11+'s LocalFilesystemAdapter class, which was introduced in Laravel 11 and does not exist in Laravel 10. Laravel 10 uses a delegating architecture where FilesystemAdapter throws RuntimeException for local filesystem temporary URLs rather than implementing them.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28 does not contain the vulnerable code path. The vulnerability (GHSA-crmm-hgp2-wgrp) affects Laravel 11+'s LocalFilesystemAdapter class, which was introduced in Laravel 11 and does not exist in Laravel 10. Laravel 10 uses a delegating architecture where FilesystemAdapter throws RuntimeException for local filesystem temporary URLs rather than implementing them." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:13:18.978013+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 10.48.28-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel framework 10.48.28 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable pattern described in the advisory (unexpected query bindings when array values are passed where scalars are expected) is not present in this version. The upstream Laravel 10.48.28 release already included the complete fix, which normalizes array inputs to scalar values using the `flattenValue()` helper method and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 Laravel framework 10.48.28 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable pattern described in the advisory (unexpected query bindings when array values are passed where scalars are expected) is not present in this version. The upstream Laravel 10.48.28 release already included the complete fix, which normalizes array inputs to scalar values using the `flattenValue()` helper method and ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:16:05.248593+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 10.48.28-p1+tuxcare of laravel/framework. The target Laravel framework v10.48.28-p3+tuxcare is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (cookie encryption oracle vulnerability). The security fix replacing predictable SHA1 cookie prefixes with HMAC-based prefixes was already present in the upstream Laravel v10.48.28 release that TuxCare onboarded. The vulnerable code pattern does not exist in the current codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework v10.48.28-p3+tuxcare is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (cookie encryption oracle vulnerability). The security fix replacing predictable SHA1 cookie prefixes with HMAC-based prefixes was already present in the upstream Laravel v10.48.28 release that TuxCare onboarded. The vulnerable code pattern does not exist in the current codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 10.48.28-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched by upstream Laravel in April 2021 (versions 6.20.26, 7.30.5, 8.40.0). Laravel 10.48.28, released in 2024, already contains all required integer casting defenses in SqlServerGrammar.php (is_numeric checks, int casts in compileColumns/compileLimit/compileOffset) and Build...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched by upstream Laravel in April 2021 (versions 6.20.26, 7.30.5, 8.40.0). Laravel 10.48.28, released in 2024, already contains all required integer casting defenses in SqlServerGrammar.php (is_numeric checks, int casts in compileColumns/compileLimit/compileOffset) and Build..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:41:42.263575+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 10.48.28-p1+tuxcare of laravel/framework. The target repository Laravel framework v10.48.28 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability fix (limiting query bindings from array inputs) was already included in the upstream Laravel 10.48.28 release. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the flattenValue() method to extract only the first element from array inputs, preventing binding manipulation attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "The target repository Laravel framework v10.48.28 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability fix (limiting query bindings from array inputs) was already included in the upstream Laravel 10.48.28 release. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the flattenValue() method to extract only the first element from array inputs, preventing binding manipulation attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v2.8.52-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v2.8.52-p3+tuxcare" } } ], "timestamp": "2026-10-22T09:08:31.184285+00:00", "status_notes": "Vulnerability CVE-2026-109413 does not affect version v2.8.52-p3+tuxcare of symfony/yaml. not_affected - CVE-2026-109413 is unbounded recursion in Parser::lexInlineStructure(), which does not exist in v2.8.52. Inline [ / { recursion in Inline::parseSequence()/parseMapping() is capped at 128 by commit 5e9542f (CVE-2026-45133 backport, released p3). Verified: 70k '[' / '{' under memory_limit=128M throws ParseException on PHP 5.6/7.4/8.4.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109413" }, "impact_statement": "not_affected - CVE-2026-109413 is unbounded recursion in Parser::lexInlineStructure(), which does not exist in v2.8.52. Inline [ / { recursion in Inline::parseSequence()/parseMapping() is capped at 128 by commit 5e9542f (CVE-2026-45133 backport, released p3). Verified: 70k '[' / '{' under memory_limit=128M throws ParseException on PHP 5.6/7.4/8.4." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v2.8.52-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v2.8.52-p3+tuxcare" } } ], "timestamp": "2026-11-06T15:28:50.835691+00:00", "status_notes": "Vulnerability CVE-2026-123792 affects version v2.8.52-p3+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-123792" }, "action_statement": "Vulnerability CVE-2026-123792 affects version v2.8.52-p3+tuxcare of symfony/yaml." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v2.8.52-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v2.8.52-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45133 is fixed in version v2.8.52-p3+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45133" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v2.8.52-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v2.8.52-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45304 is fixed in version v2.8.52-p3+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45304" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v2.8.52-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v2.8.52-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45305 is fixed in version v2.8.52-p3+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45305" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v4.4.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v4.4.45-p1+tuxcare" } } ], "timestamp": "2026-10-21T09:41:00.085219+00:00", "status_notes": "Vulnerability CVE-2026-109413 affects version v4.4.45-p1+tuxcare of symfony/yaml, and is fixed in v4.4.45-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-109413" }, "action_statement": "Vulnerability CVE-2026-109413 affects version v4.4.45-p1+tuxcare of symfony/yaml, and is fixed in v4.4.45-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v4.4.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v4.4.45-p1+tuxcare" } } ], "timestamp": "2026-11-06T15:28:50.835691+00:00", "status_notes": "Vulnerability CVE-2026-123792 affects version v4.4.45-p1+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-123792" }, "action_statement": "Vulnerability CVE-2026-123792 affects version v4.4.45-p1+tuxcare of symfony/yaml." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v4.4.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v4.4.45-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45133 is fixed in version v4.4.45-p1+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45133" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v4.4.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v4.4.45-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45304 affects version v4.4.45-p1+tuxcare of symfony/yaml, and is fixed in v4.4.45-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-45304" }, "action_statement": "Vulnerability CVE-2026-45304 affects version v4.4.45-p1+tuxcare of symfony/yaml, and is fixed in v4.4.45-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v4.4.45-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v4.4.45-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45305 is fixed in version v4.4.45-p1+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45305" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v4.4.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v4.4.45-p2+tuxcare" } } ], "timestamp": "2026-10-21T09:41:00.085219+00:00", "status_notes": "Vulnerability CVE-2026-109413 affects version v4.4.45-p2+tuxcare of symfony/yaml, and is fixed in v4.4.45-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-109413" }, "action_statement": "Vulnerability CVE-2026-109413 affects version v4.4.45-p2+tuxcare of symfony/yaml, and is fixed in v4.4.45-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v4.4.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v4.4.45-p2+tuxcare" } } ], "timestamp": "2026-11-06T15:28:50.835691+00:00", "status_notes": "Vulnerability CVE-2026-123792 affects version v4.4.45-p2+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-123792" }, "action_statement": "Vulnerability CVE-2026-123792 affects version v4.4.45-p2+tuxcare of symfony/yaml." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v4.4.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v4.4.45-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45133 is fixed in version v4.4.45-p2+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45133" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v4.4.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v4.4.45-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45304 is fixed in version v4.4.45-p2+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45304" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v4.4.45-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v4.4.45-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45305 is fixed in version v4.4.45-p2+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45305" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2018-14773 does not affect version v5.4.50-p1+tuxcare of symfony/http-foundation. not_affected \u2014 CVE-2018-14773 is NOT present in symfony/http-foundation v5.4.50. The vulnerability involved unsafe processing of X-Original-URL and X-Rewrite-URL headers in prepareRequestUri() that allowed attackers to override the request URI for cache poisoning attacks. The fix (complete removal of these header checks) was applied by upstream Symfony in July 2018 across all supported versions. The target v5...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14773" }, "impact_statement": "not_affected \u2014 CVE-2018-14773 is NOT present in symfony/http-foundation v5.4.50. The vulnerability involved unsafe processing of X-Original-URL and X-Rewrite-URL headers in prepareRequestUri() that allowed attackers to override the request URI for cache poisoning attacks. The fix (complete removal of these header checks) was applied by upstream Symfony in July 2018 across all supported versions. The target v5..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:19:23.616509+00:00", "status_notes": "Vulnerability CVE-2019-10913 does not affect version v5.4.50-p1+tuxcare of symfony/http-foundation. CVE-2019-10913 is not present in symfony/http-foundation v5.4.50. The vulnerability allowed arbitrary strings from X-HTTP-METHOD-OVERRIDE header or _method parameter to become the HTTP method without validation, enabling SQL injection or XSS when the method value was used in queries or output. The fix (validation against HTTP method whitelist and uppercase-letter pattern with SuspiciousOperationException for invalid input) was already present in upstream Symfony v5.4.50 when TuxCare onboarded it via snapshot commit b92697f4. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10913" }, "impact_statement": "CVE-2019-10913 is not present in symfony/http-foundation v5.4.50. The vulnerability allowed arbitrary strings from X-HTTP-METHOD-OVERRIDE header or _method parameter to become the HTTP method without validation, enabling SQL injection or XSS when the method value was used in queries or output. The fix (validation against HTTP method whitelist and uppercase-letter pattern with SuspiciousOperationException for invalid input) was already present in upstream Symfony v5.4.50 when TuxCare onboarded it via snapshot commit b92697f4. The vulnerable code pattern is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:19:23.616509+00:00", "status_notes": "Vulnerability CVE-2019-18888 does not affect version v5.4.50-p1+tuxcare of symfony/http-foundation. CVE-2019-18888 affected FileBinaryMimeTypeGuesser class in symfony/http-foundation versions < 5.0.0. This class executed the `file` system command without properly escaping filenames starting with dash (-), allowing command argument injection. In Symfony 5.0.0, all MimeType classes were removed from http-foundation and functionality moved to symfony/mime component. Target version 5.4.50 never contained this vulnerable code - it delegates all MIME type detection to the external symfony/mime dependency.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-18888" }, "impact_statement": "CVE-2019-18888 affected FileBinaryMimeTypeGuesser class in symfony/http-foundation versions < 5.0.0. This class executed the `file` system command without properly escaping filenames starting with dash (-), allowing command argument injection. In Symfony 5.0.0, all MimeType classes were removed from http-foundation and functionality moved to symfony/mime component. Target version 5.4.50 never contained this vulnerable code - it delegates all MIME type detection to the external symfony/mime dependency." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare" } } ], "timestamp": "2026-10-21T07:22:00.252163+00:00", "status_notes": "Vulnerability CVE-2024-50345 does not affect version v5.4.50-p1+tuxcare of symfony/http-foundation. already_fixed \u2014 The target repository (symfony/http-foundation v5.4.50) already contains the fix for CVE-2024-50345. The Request::create() method includes all four validation checks from the upstream patch that reject URIs with invalid characters, preventing parsing discrepancies between the Request class and browsers that could lead to redirect vulnerabilities.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-50345" }, "impact_statement": "already_fixed \u2014 The target repository (symfony/http-foundation v5.4.50) already contains the fix for CVE-2024-50345. The Request::create() method includes all four validation checks from the upstream patch that reject URIs with invalid characters, preventing parsing discrepancies between the Request class and browsers that could lead to redirect vulnerabilities." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare" } } ], "timestamp": "2026-10-21T07:22:00.252163+00:00", "status_notes": "Vulnerability CVE-2025-64500 does not affect version v5.4.50-p1+tuxcare of symfony/http-foundation. already_fixed \u2014 The target repository (symfony/http-foundation v5.4.50) already contains the fix for CVE-2025-64500. The vulnerable code pattern described in the CVE - where the Request class could produce URL paths without a leading '/' character - has been addressed by the same fix present in the vendor patches.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-64500" }, "impact_statement": "already_fixed \u2014 The target repository (symfony/http-foundation v5.4.50) already contains the fix for CVE-2025-64500. The vulnerable code pattern described in the CVE - where the Request class could produce URL paths without a leading '/' character - has been addressed by the same fix present in the vendor patches." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare" } } ], "timestamp": "2026-10-21T07:23:00.098700+00:00", "status_notes": "Vulnerability CVE-2026-108082 is fixed in version v5.4.50-p1+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2026-108082" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare" } } ], "timestamp": "2026-11-06T14:19:00.049771+00:00", "status_notes": "Vulnerability CVE-2026-118514 affects version v5.4.50-p1+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2026-118514" }, "action_statement": "Vulnerability CVE-2026-118514 affects version v5.4.50-p1+tuxcare of symfony/http-foundation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare" } } ], "timestamp": "2026-10-29T01:02:19.900071+00:00", "status_notes": "Vulnerability CVE-2026-48736 does not affect version v5.4.50-p1+tuxcare of symfony/http-foundation. not_affected \u2014 symfony/http-foundation v5.4.50 is not affected by CVE-2026-48736. On version 5.4, the vulnerable PRIVATE_SUBNETS constant (missing IPv6 transition mechanism prefixes) resides in symfony/http-client's NoPrivateNetworkHttpClient class, not in http-foundation. The http-foundation package on v5.4 only provides generic IP checking utilities (IpUtils::checkIp, checkIp4, checkIp6) and does not mainta...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48736" }, "impact_statement": "not_affected \u2014 symfony/http-foundation v5.4.50 is not affected by CVE-2026-48736. On version 5.4, the vulnerable PRIVATE_SUBNETS constant (missing IPv6 transition mechanism prefixes) resides in symfony/http-client's NoPrivateNetworkHttpClient class, not in http-foundation. The http-foundation package on v5.4 only provides generic IP checking utilities (IpUtils::checkIp, checkIp4, checkIp6) and does not mainta..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v2.8.52-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v2.8.52-p2+tuxcare" } } ], "timestamp": "2026-10-22T09:08:31.184285+00:00", "status_notes": "Vulnerability CVE-2026-109413 does not affect version v2.8.52-p2+tuxcare of symfony/yaml. not_affected - CVE-2026-109413 is unbounded recursion in Parser::lexInlineStructure(), which does not exist in v2.8.52. Inline [ / { recursion in Inline::parseSequence()/parseMapping() is capped at 128 by commit 5e9542f (CVE-2026-45133 backport, released p3). Verified: 70k '[' / '{' under memory_limit=128M throws ParseException on PHP 5.6/7.4/8.4.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109413" }, "impact_statement": "not_affected - CVE-2026-109413 is unbounded recursion in Parser::lexInlineStructure(), which does not exist in v2.8.52. Inline [ / { recursion in Inline::parseSequence()/parseMapping() is capped at 128 by commit 5e9542f (CVE-2026-45133 backport, released p3). Verified: 70k '[' / '{' under memory_limit=128M throws ParseException on PHP 5.6/7.4/8.4." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v2.8.52-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v2.8.52-p2+tuxcare" } } ], "timestamp": "2026-11-06T15:28:50.835691+00:00", "status_notes": "Vulnerability CVE-2026-123792 affects version v2.8.52-p2+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-123792" }, "action_statement": "Vulnerability CVE-2026-123792 affects version v2.8.52-p2+tuxcare of symfony/yaml." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v2.8.52-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v2.8.52-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45133 affects version v2.8.52-p2+tuxcare of symfony/yaml, and is fixed in v2.8.52-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-45133" }, "action_statement": "Vulnerability CVE-2026-45133 affects version v2.8.52-p2+tuxcare of symfony/yaml, and is fixed in v2.8.52-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v2.8.52-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v2.8.52-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45304 is fixed in version v2.8.52-p2+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45304" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v2.8.52-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v2.8.52-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45305 is fixed in version v2.8.52-p2+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45305" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v2.8.52-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v2.8.52-p1+tuxcare" } } ], "timestamp": "2026-10-22T09:08:31.184285+00:00", "status_notes": "Vulnerability CVE-2026-109413 does not affect version v2.8.52-p1+tuxcare of symfony/yaml. not_affected - CVE-2026-109413 is unbounded recursion in Parser::lexInlineStructure(), which does not exist in v2.8.52. Inline [ / { recursion in Inline::parseSequence()/parseMapping() is capped at 128 by commit 5e9542f (CVE-2026-45133 backport, released p3). Verified: 70k '[' / '{' under memory_limit=128M throws ParseException on PHP 5.6/7.4/8.4.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-109413" }, "impact_statement": "not_affected - CVE-2026-109413 is unbounded recursion in Parser::lexInlineStructure(), which does not exist in v2.8.52. Inline [ / { recursion in Inline::parseSequence()/parseMapping() is capped at 128 by commit 5e9542f (CVE-2026-45133 backport, released p3). Verified: 70k '[' / '{' under memory_limit=128M throws ParseException on PHP 5.6/7.4/8.4." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v2.8.52-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v2.8.52-p1+tuxcare" } } ], "timestamp": "2026-11-06T15:28:50.835691+00:00", "status_notes": "Vulnerability CVE-2026-123792 affects version v2.8.52-p1+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-123792" }, "action_statement": "Vulnerability CVE-2026-123792 affects version v2.8.52-p1+tuxcare of symfony/yaml." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v2.8.52-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v2.8.52-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45133 affects version v2.8.52-p1+tuxcare of symfony/yaml, and is fixed in v2.8.52-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-45133" }, "action_statement": "Vulnerability CVE-2026-45133 affects version v2.8.52-p1+tuxcare of symfony/yaml, and is fixed in v2.8.52-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v2.8.52-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v2.8.52-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45304 affects version v2.8.52-p1+tuxcare of symfony/yaml, and is fixed in v2.8.52-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-45304" }, "action_statement": "Vulnerability CVE-2026-45304 affects version v2.8.52-p1+tuxcare of symfony/yaml, and is fixed in v2.8.52-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v2.8.52-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v2.8.52-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45305 is fixed in version v2.8.52-p1+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45305" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v3.4.47-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v3.4.47-p1+tuxcare" } } ], "timestamp": "2026-10-16T15:15:00.151476+00:00", "status_notes": "Vulnerability CVE-2026-109413 does not affect version v3.4.47-p1+tuxcare of symfony/yaml. not_affected \u2014 Target version v3.4.47-p2+tuxcare is NOT affected by CVE-2026-109413. The vulnerability is specific to a lexer architecture (with lexInlineStructure/lexInlineMapping/lexInlineSequence methods) that was introduced in Symfony YAML versions after v3.4.47. This target uses an older architecture where inline YAML collections are parsed directly via Inline::parseSequence() and Inline::parseMapping(),...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-109413" }, "impact_statement": "not_affected \u2014 Target version v3.4.47-p2+tuxcare is NOT affected by CVE-2026-109413. The vulnerability is specific to a lexer architecture (with lexInlineStructure/lexInlineMapping/lexInlineSequence methods) that was introduced in Symfony YAML versions after v3.4.47. This target uses an older architecture where inline YAML collections are parsed directly via Inline::parseSequence() and Inline::parseMapping(),..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v3.4.47-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v3.4.47-p1+tuxcare" } } ], "timestamp": "2026-11-06T15:28:50.835691+00:00", "status_notes": "Vulnerability CVE-2026-123792 affects version v3.4.47-p1+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-123792" }, "action_statement": "Vulnerability CVE-2026-123792 affects version v3.4.47-p1+tuxcare of symfony/yaml." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v3.4.47-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v3.4.47-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45133 affects version v3.4.47-p1+tuxcare of symfony/yaml, and is fixed in v3.4.47-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-45133" }, "action_statement": "Vulnerability CVE-2026-45133 affects version v3.4.47-p1+tuxcare of symfony/yaml, and is fixed in v3.4.47-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v3.4.47-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v3.4.47-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45304 is fixed in version v3.4.47-p1+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45304" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v3.4.47-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v3.4.47-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45305 is fixed in version v3.4.47-p1+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45305" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v3.4.47-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v3.4.47-p2+tuxcare" } } ], "timestamp": "2026-10-16T15:15:00.151476+00:00", "status_notes": "Vulnerability CVE-2026-109413 does not affect version v3.4.47-p2+tuxcare of symfony/yaml. not_affected \u2014 Target version v3.4.47-p2+tuxcare is NOT affected by CVE-2026-109413. The vulnerability is specific to a lexer architecture (with lexInlineStructure/lexInlineMapping/lexInlineSequence methods) that was introduced in Symfony YAML versions after v3.4.47. This target uses an older architecture where inline YAML collections are parsed directly via Inline::parseSequence() and Inline::parseMapping(),...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-109413" }, "impact_statement": "not_affected \u2014 Target version v3.4.47-p2+tuxcare is NOT affected by CVE-2026-109413. The vulnerability is specific to a lexer architecture (with lexInlineStructure/lexInlineMapping/lexInlineSequence methods) that was introduced in Symfony YAML versions after v3.4.47. This target uses an older architecture where inline YAML collections are parsed directly via Inline::parseSequence() and Inline::parseMapping(),..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v3.4.47-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v3.4.47-p2+tuxcare" } } ], "timestamp": "2026-11-06T15:28:50.835691+00:00", "status_notes": "Vulnerability CVE-2026-123792 affects version v3.4.47-p2+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-123792" }, "action_statement": "Vulnerability CVE-2026-123792 affects version v3.4.47-p2+tuxcare of symfony/yaml." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v3.4.47-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v3.4.47-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45133 is fixed in version v3.4.47-p2+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45133" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v3.4.47-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v3.4.47-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45304 is fixed in version v3.4.47-p2+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45304" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v3.4.47-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v3.4.47-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45305 is fixed in version v3.4.47-p2+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45305" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v4.4.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v4.4.45-p3+tuxcare" } } ], "timestamp": "2026-10-21T09:41:00.085219+00:00", "status_notes": "Vulnerability CVE-2026-109413 is fixed in version v4.4.45-p3+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-109413" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/yaml@v4.4.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v4.4.45-p3+tuxcare" } } ], "timestamp": "2026-11-06T15:28:50.835691+00:00", "status_notes": "Vulnerability CVE-2026-123792 affects version v4.4.45-p3+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-123792" }, "action_statement": "Vulnerability CVE-2026-123792 affects version v4.4.45-p3+tuxcare of symfony/yaml." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v4.4.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v4.4.45-p3+tuxcare" } } ], "timestamp": "2026-10-21T09:41:00.085219+00:00", "status_notes": "Vulnerability CVE-2026-45133 is fixed in version v4.4.45-p3+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45133" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v4.4.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v4.4.45-p3+tuxcare" } } ], "timestamp": "2026-10-21T09:41:00.085219+00:00", "status_notes": "Vulnerability CVE-2026-45304 is fixed in version v4.4.45-p3+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45304" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/yaml@v4.4.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/yaml@v4.4.45-p3+tuxcare" } } ], "timestamp": "2026-10-21T09:41:00.085219+00:00", "status_notes": "Vulnerability CVE-2026-45305 is fixed in version v4.4.45-p3+tuxcare of symfony/yaml.", "vulnerability": { "name": "CVE-2026-45305" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:23:12.853297+00:00", "status_notes": "Vulnerability CVE-2015-8379 affects version 4.4.18-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2015-8379" }, "action_statement": "Vulnerability CVE-2015-8379 affects version 4.4.18-p1+tuxcare of cakephp/cakephp." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:41:42.084809+00:00", "status_notes": "Vulnerability CVE-2020-15400 does not affect version 4.4.18-p1+tuxcare of cakephp/cakephp. not_affected \u2014 Target CakePHP 4.4.18 is not affected by CVE-2020-15400. The CSRF token fixation vulnerability was fixed in upstream CakePHP 4.0.6 (April 2020) by adding mandatory HMAC-based token validation. The target version already contains this upstream fix: all tokens require HMAC verification using the application's secret salt (Security::getSalt()), preventing acceptance of attacker-fixated tokens. The...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-15400" }, "impact_statement": "not_affected \u2014 Target CakePHP 4.4.18 is not affected by CVE-2020-15400. The CSRF token fixation vulnerability was fixed in upstream CakePHP 4.0.6 (April 2020) by adding mandatory HMAC-based token validation. The target version already contains this upstream fix: all tokens require HMAC verification using the application's secret salt (Security::getSalt()), preventing acceptance of attacker-fixated tokens. The..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:54:00.080763+00:00", "status_notes": "Vulnerability CVE-2026-119415 affects version 4.4.18-p1+tuxcare of cakephp/cakephp, and is fixed in 4.4.18-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-119415" }, "action_statement": "Vulnerability CVE-2026-119415 affects version 4.4.18-p1+tuxcare of cakephp/cakephp, and is fixed in 4.4.18-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:54:00.080763+00:00", "status_notes": "Vulnerability CVE-2026-119416 affects version 4.4.18-p1+tuxcare of cakephp/cakephp, and is fixed in 4.4.18-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-119416" }, "action_statement": "Vulnerability CVE-2026-119416 affects version 4.4.18-p1+tuxcare of cakephp/cakephp, and is fixed in 4.4.18-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:54:00.080763+00:00", "status_notes": "Vulnerability CVE-2026-119417 affects version 4.4.18-p1+tuxcare of cakephp/cakephp, and is fixed in 4.4.18-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-119417" }, "action_statement": "Vulnerability CVE-2026-119417 affects version 4.4.18-p1+tuxcare of cakephp/cakephp, and is fixed in 4.4.18-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:54:00.080763+00:00", "status_notes": "Vulnerability CVE-2026-119418 affects version 4.4.18-p1+tuxcare of cakephp/cakephp, and is fixed in 4.4.18-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-119418" }, "action_statement": "Vulnerability CVE-2026-119418 affects version 4.4.18-p1+tuxcare of cakephp/cakephp, and is fixed in 4.4.18-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:54:00.080763+00:00", "status_notes": "Vulnerability CVE-2026-119419 affects version 4.4.18-p1+tuxcare of cakephp/cakephp, and is fixed in 4.4.18-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-119419" }, "action_statement": "Vulnerability CVE-2026-119419 affects version 4.4.18-p1+tuxcare of cakephp/cakephp, and is fixed in 4.4.18-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:32:00.306118+00:00", "status_notes": "Vulnerability CVE-2026-48820 is fixed in version 4.4.18-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-48820" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:32:00.306118+00:00", "status_notes": "Vulnerability CVE-2026-77634 is fixed in version 4.4.18-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-77634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:32:00.306118+00:00", "status_notes": "Vulnerability CVE-2026-79752 is fixed in version 4.4.18-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-79752" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.5.12-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:52:04.528579+00:00", "status_notes": "Vulnerability CVE-2015-8379 affects version 4.5.12-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2015-8379" }, "action_statement": "Vulnerability CVE-2015-8379 affects version 4.5.12-p1+tuxcare of cakephp/cakephp." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.5.12-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:52:04.528579+00:00", "status_notes": "Vulnerability CVE-2020-15400 does not affect version 4.5.12-p1+tuxcare of cakephp/cakephp. not_affected \u2014 The target CakePHP 4.5.12 is not affected by CVE-2020-15400 (CSRF token fixation vulnerability). The upstream fix, which adds HMAC-based token validation to prevent attackers from fixating arbitrary matching token pairs, was already present in CakePHP 4.0.6. Version 4.5.12 contains the complete fix via createToken() generating HMAC-signed tokens and _verifyToken() validating the HMAC. The fix s...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-15400" }, "impact_statement": "not_affected \u2014 The target CakePHP 4.5.12 is not affected by CVE-2020-15400 (CSRF token fixation vulnerability). The upstream fix, which adds HMAC-based token validation to prevent attackers from fixating arbitrary matching token pairs, was already present in CakePHP 4.0.6. Version 4.5.12 contains the complete fix via createToken() generating HMAC-signed tokens and _verifyToken() validating the HMAC. The fix s..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.5.12-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:53:00.090104+00:00", "status_notes": "Vulnerability CVE-2026-119415 is fixed in version 4.5.12-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119415" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.5.12-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:53:00.090104+00:00", "status_notes": "Vulnerability CVE-2026-119416 is fixed in version 4.5.12-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119416" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.5.12-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:53:00.090104+00:00", "status_notes": "Vulnerability CVE-2026-119417 is fixed in version 4.5.12-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119417" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.5.12-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:53:00.090104+00:00", "status_notes": "Vulnerability CVE-2026-119418 is fixed in version 4.5.12-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119418" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.5.12-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:53:00.090104+00:00", "status_notes": "Vulnerability CVE-2026-119419 is fixed in version 4.5.12-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119419" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.5.12-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:52:04.528579+00:00", "status_notes": "Vulnerability CVE-2026-48820 does not affect version 4.5.12-p1+tuxcare of cakephp/cakephp. not_affected \u2014 The target CakePHP 4.5.12 (at commit ac1786bad6) is not vulnerable to CVE-2026-48820. The upstream vendor (CakePHP core team) included the path traversal security fix in the 4.5.12 release prior to TuxCare's onboarding. The snapshot commit ef8acfc149 that TuxCare imported already contains the complete fix: the `_checkFilePath()` method validates that resolved file paths stay within allowed temp...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48820" }, "impact_statement": "not_affected \u2014 The target CakePHP 4.5.12 (at commit ac1786bad6) is not vulnerable to CVE-2026-48820. The upstream vendor (CakePHP core team) included the path traversal security fix in the 4.5.12 release prior to TuxCare's onboarding. The snapshot commit ef8acfc149 that TuxCare imported already contains the complete fix: the `_checkFilePath()` method validates that resolved file paths stay within allowed temp..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.5.12-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:52:04.528579+00:00", "status_notes": "Vulnerability CVE-2026-77634 does not affect version 4.5.12-p1+tuxcare of cakephp/cakephp. The target repository (CakePHP 4.5.12) is NOT AFFECTED by CVE-2026-77634. The vulnerability (CRLF injection in mail headers) is not present because the upstream 4.5.12 release already contained the fix. Both SmtpTransport and MailTransport implementations properly strip CRLF bytes from all header values before transmission. The fix was authored by Mark Story in the upstream repository and was included in the 4.5.12 release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-77634" }, "impact_statement": "The target repository (CakePHP 4.5.12) is NOT AFFECTED by CVE-2026-77634. The vulnerability (CRLF injection in mail headers) is not present because the upstream 4.5.12 release already contained the fix. Both SmtpTransport and MailTransport implementations properly strip CRLF bytes from all header values before transmission. The fix was authored by Mark Story in the upstream repository and was included in the 4.5.12 release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.5.12-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.5.12-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:52:04.528579+00:00", "status_notes": "Vulnerability CVE-2026-79752 does not affect version 4.5.12-p1+tuxcare of cakephp/cakephp. CVE-2026-79752 is NOT present in the target. The SQL injection vulnerability in FunctionsBuilder methods (cast, extract, datePart, dateAdd) was fixed in the upstream CakePHP 4.5.12 release. The target contains this upstream fix, which validates type/part/unit parameters using ensureSimpleString() to reject non-alphanumeric values, preventing SQL injection attacks. The fix was already present when TuxCare onboarded version 4.5.12.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-79752" }, "impact_statement": "CVE-2026-79752 is NOT present in the target. The SQL injection vulnerability in FunctionsBuilder methods (cast, extract, datePart, dateAdd) was fixed in the upstream CakePHP 4.5.12 release. The target contains this upstream fix, which validates type/part/unit parameters using ensureSimpleString() to reject non-alphanumeric values, preventing SQL injection attacks. The fix was already present when TuxCare onboarded version 4.5.12." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.6.5-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.6.5-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:50:33.938572+00:00", "status_notes": "Vulnerability CVE-2015-8379 affects version 4.6.5-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2015-8379" }, "action_statement": "Vulnerability CVE-2015-8379 affects version 4.6.5-p1+tuxcare of cakephp/cakephp." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.6.5-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.6.5-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:50:33.938572+00:00", "status_notes": "Vulnerability CVE-2020-15400 does not affect version 4.6.5-p1+tuxcare of cakephp/cakephp. not_affected \u2014 CVE-2020-15400 (CSRF token fixation vulnerability) is NOT present in CakePHP 4.6.5. The target contains the upstream fix that was released in CakePHP 4.0.6 (April 2020). The fix adds HMAC-based token origin verification using the application's secret salt, preventing attackers from fixating tokens via XSS or other means. Token generation (line 264-269) appends hash_hmac('sha1', value, Security:...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-15400" }, "impact_statement": "not_affected \u2014 CVE-2020-15400 (CSRF token fixation vulnerability) is NOT present in CakePHP 4.6.5. The target contains the upstream fix that was released in CakePHP 4.0.6 (April 2020). The fix adds HMAC-based token origin verification using the application's secret salt, preventing attackers from fixating tokens via XSS or other means. Token generation (line 264-269) appends hash_hmac('sha1', value, Security:..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.6.5-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.6.5-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:51:00.099135+00:00", "status_notes": "Vulnerability CVE-2026-119415 is fixed in version 4.6.5-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119415" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.6.5-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.6.5-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:51:00.099135+00:00", "status_notes": "Vulnerability CVE-2026-119416 is fixed in version 4.6.5-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119416" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.6.5-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.6.5-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:51:00.099135+00:00", "status_notes": "Vulnerability CVE-2026-119417 is fixed in version 4.6.5-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119417" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.6.5-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.6.5-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:51:00.099135+00:00", "status_notes": "Vulnerability CVE-2026-119418 is fixed in version 4.6.5-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119418" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.6.5-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.6.5-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:51:00.099135+00:00", "status_notes": "Vulnerability CVE-2026-119419 is fixed in version 4.6.5-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119419" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.6.5-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.6.5-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:50:33.938572+00:00", "status_notes": "Vulnerability CVE-2026-48820 does not affect version 4.6.5-p1+tuxcare of cakephp/cakephp. not_affected \u2014 CVE-2026-48820 path traversal vulnerability is NOT present in target version 4.6.5. The fix (_checkFilePath validation) was already included in the upstream 4.6.5 release. All three vulnerable methods (_getElementFileName, _getLayoutFileName, _getTemplateFileName) call _checkFilePath() which validates that paths containing \"..\" sequences do not escape allowed template directories using realpath...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48820" }, "impact_statement": "not_affected \u2014 CVE-2026-48820 path traversal vulnerability is NOT present in target version 4.6.5. The fix (_checkFilePath validation) was already included in the upstream 4.6.5 release. All three vulnerable methods (_getElementFileName, _getLayoutFileName, _getTemplateFileName) call _checkFilePath() which validates that paths containing \"..\" sequences do not escape allowed template directories using realpath..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.6.5-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.6.5-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:50:33.938572+00:00", "status_notes": "Vulnerability CVE-2026-77634 does not affect version 4.6.5-p1+tuxcare of cakephp/cakephp. Target version 4.6.5 is NOT AFFECTED. The CRLF header injection vulnerability (CVE-2026-77634) was fixed by upstream CakePHP and shipped in version 4.6.5. The fix strips CRLF bytes from email headers in both SmtpTransport and MailTransport before transmission, preventing header injection attacks. TuxCare onboarded version 4.6.5 via snapshot commit 308ce9b5cd, which already contained the complete fix. No TuxCare backport was needed for this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-77634" }, "impact_statement": "Target version 4.6.5 is NOT AFFECTED. The CRLF header injection vulnerability (CVE-2026-77634) was fixed by upstream CakePHP and shipped in version 4.6.5. The fix strips CRLF bytes from email headers in both SmtpTransport and MailTransport before transmission, preventing header injection attacks. TuxCare onboarded version 4.6.5 via snapshot commit 308ce9b5cd, which already contained the complete fix. No TuxCare backport was needed for this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.6.5-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.6.5-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:50:33.938572+00:00", "status_notes": "Vulnerability CVE-2026-79752 does not affect version 4.6.5-p1+tuxcare of cakephp/cakephp. CVE-2026-79752 affects FunctionsBuilder methods that accept user-controlled strings for SQL type/part/unit parameters. The vulnerability allows SQL injection when these parameters are inserted as literals without validation. The upstream CakePHP 4.6.5 release already contains the fix (commit 79e1d6bc6f by Mark Story), which adds alphanumeric-only validation via ensureSimpleString() to reject injection attempts. The target repository was onboarded from this fixed upstream release, so the vulnerable pattern is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-79752" }, "impact_statement": "CVE-2026-79752 affects FunctionsBuilder methods that accept user-controlled strings for SQL type/part/unit parameters. The vulnerability allows SQL injection when these parameters are inserted as literals without validation. The upstream CakePHP 4.6.5 release already contains the fix (commit 79e1d6bc6f by Mark Story), which adds alphanumeric-only validation via ensureSimpleString() to reject injection attempts. The target repository was onboarded from this fixed upstream release, so the vulnerable pattern is not present." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p2+tuxcare" } } ], "timestamp": "2026-11-09T09:53:32.654337+00:00", "status_notes": "Vulnerability CVE-2015-8379 affects version 4.4.18-p2+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2015-8379" }, "action_statement": "Vulnerability CVE-2015-8379 affects version 4.4.18-p2+tuxcare of cakephp/cakephp." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p2+tuxcare" } } ], "timestamp": "2026-11-09T09:53:32.654337+00:00", "status_notes": "Vulnerability CVE-2020-15400 does not affect version 4.4.18-p2+tuxcare of cakephp/cakephp. not_affected \u2014 Target CakePHP 4.4.18 is not affected by CVE-2020-15400. The CSRF token fixation vulnerability was fixed in upstream CakePHP 4.0.6 (April 2020) by adding mandatory HMAC-based token validation. The target version already contains this upstream fix: all tokens require HMAC verification using the application's secret salt (Security::getSalt()), preventing acceptance of attacker-fixated tokens. The...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-15400" }, "impact_statement": "not_affected \u2014 Target CakePHP 4.4.18 is not affected by CVE-2020-15400. The CSRF token fixation vulnerability was fixed in upstream CakePHP 4.0.6 (April 2020) by adding mandatory HMAC-based token validation. The target version already contains this upstream fix: all tokens require HMAC verification using the application's secret salt (Security::getSalt()), preventing acceptance of attacker-fixated tokens. The..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p2+tuxcare" } } ], "timestamp": "2026-11-09T09:54:00.080763+00:00", "status_notes": "Vulnerability CVE-2026-119415 is fixed in version 4.4.18-p2+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119415" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p2+tuxcare" } } ], "timestamp": "2026-11-09T09:54:00.080763+00:00", "status_notes": "Vulnerability CVE-2026-119416 is fixed in version 4.4.18-p2+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119416" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p2+tuxcare" } } ], "timestamp": "2026-11-09T09:54:00.080763+00:00", "status_notes": "Vulnerability CVE-2026-119417 is fixed in version 4.4.18-p2+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119417" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p2+tuxcare" } } ], "timestamp": "2026-11-09T09:54:00.080763+00:00", "status_notes": "Vulnerability CVE-2026-119418 is fixed in version 4.4.18-p2+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119418" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p2+tuxcare" } } ], "timestamp": "2026-11-09T09:54:00.080763+00:00", "status_notes": "Vulnerability CVE-2026-119419 is fixed in version 4.4.18-p2+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119419" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p2+tuxcare" } } ], "timestamp": "2026-11-09T09:53:32.654337+00:00", "status_notes": "Vulnerability CVE-2026-48820 is fixed in version 4.4.18-p2+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-48820" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p2+tuxcare" } } ], "timestamp": "2026-11-09T09:53:32.654337+00:00", "status_notes": "Vulnerability CVE-2026-77634 is fixed in version 4.4.18-p2+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-77634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@4.4.18-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@4.4.18-p2+tuxcare" } } ], "timestamp": "2026-11-09T09:53:32.654337+00:00", "status_notes": "Vulnerability CVE-2026-79752 is fixed in version 4.4.18-p2+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-79752" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:54:53.319305+00:00", "status_notes": "Vulnerability CVE-2022-23614 affects version v3.19.0-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2022-23614" }, "action_statement": "Vulnerability CVE-2022-23614 affects version v3.19.0-p1+tuxcare of twig/twig." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:54:53.319305+00:00", "status_notes": "Vulnerability CVE-2022-39261 affects version v3.19.0-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2022-39261" }, "action_statement": "Vulnerability CVE-2022-39261 affects version v3.19.0-p1+tuxcare of twig/twig." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:54:53.319305+00:00", "status_notes": "Vulnerability CVE-2024-45411 affects version v3.19.0-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2024-45411" }, "action_statement": "Vulnerability CVE-2024-45411 affects version v3.19.0-p1+tuxcare of twig/twig." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:54:53.319305+00:00", "status_notes": "Vulnerability CVE-2024-51754 does not affect version v3.19.0-p1+tuxcare of twig/twig. not_affected \u2014 CVE-2024-51754 (Twig sandbox bypass via __toString() in arrays/argument lists) is NOT present in target v3.19.0. The upstream security fix was committed Oct 25, 2024 (commits cafc608ec, d4a302681) and included in Twig v3.19.0 release (Jan 28, 2025). TuxCare's snapshot commit (075823a8c9) imported this already-fixed version. Both defense components are present: (1) runtime recursive array valida...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-51754" }, "impact_statement": "not_affected \u2014 CVE-2024-51754 (Twig sandbox bypass via __toString() in arrays/argument lists) is NOT present in target v3.19.0. The upstream security fix was committed Oct 25, 2024 (commits cafc608ec, d4a302681) and included in Twig v3.19.0 release (Jan 28, 2025). TuxCare's snapshot commit (075823a8c9) imported this already-fixed version. Both defense components are present: (1) runtime recursive array valida..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:54:53.319305+00:00", "status_notes": "Vulnerability CVE-2024-51755 does not affect version v3.19.0-p1+tuxcare of twig/twig. not_affected \u2014 The target repository (Twig v3.19.0) is NOT affected by CVE-2024-51755. The security fix for the sandbox ArrayAccess bypass vulnerability was already present in the upstream Twig v3.19.0 release when TuxCare onboarded it. The fix includes: (1) ARRAY_LIKE_CLASSES constant whitelist for native PHP array-like classes, (2) security policy check via checkPropertyAllowed() before isset() evaluation f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-51755" }, "impact_statement": "not_affected \u2014 The target repository (Twig v3.19.0) is NOT affected by CVE-2024-51755. The security fix for the sandbox ArrayAccess bypass vulnerability was already present in the upstream Twig v3.19.0 release when TuxCare onboarded it. The fix includes: (1) ARRAY_LIKE_CLASSES constant whitelist for native PHP array-like classes, (2) security policy check via checkPropertyAllowed() before isset() evaluation f..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:54:53.319305+00:00", "status_notes": "Vulnerability CVE-2026-24425 affects version v3.19.0-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-24425" }, "action_statement": "Vulnerability CVE-2026-24425 affects version v3.19.0-p1+tuxcare of twig/twig." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:56:00.059747+00:00", "status_notes": "Vulnerability CVE-2026-46628 is fixed in version v3.19.0-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46628" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:56:00.059747+00:00", "status_notes": "Vulnerability CVE-2026-46633 is fixed in version v3.19.0-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46633" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:54:53.319305+00:00", "status_notes": "Vulnerability CVE-2026-46634 affects version v3.19.0-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46634" }, "action_statement": "Vulnerability CVE-2026-46634 affects version v3.19.0-p1+tuxcare of twig/twig." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:56:00.059747+00:00", "status_notes": "Vulnerability CVE-2026-46635 is fixed in version v3.19.0-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46635" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:56:00.059747+00:00", "status_notes": "Vulnerability CVE-2026-46638 is fixed in version v3.19.0-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46638" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:54:53.319305+00:00", "status_notes": "Vulnerability CVE-2026-46640 affects version v3.19.0-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-46640" }, "action_statement": "Vulnerability CVE-2026-46640 affects version v3.19.0-p1+tuxcare of twig/twig." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:56:00.059747+00:00", "status_notes": "Vulnerability CVE-2026-47730 is fixed in version v3.19.0-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-47730" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:56:00.059747+00:00", "status_notes": "Vulnerability CVE-2026-47732 is fixed in version v3.19.0-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-47732" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:54:53.319305+00:00", "status_notes": "Vulnerability CVE-2026-48805 does not affect version v3.19.0-p1+tuxcare of twig/twig. not_affected \u2014 Twig v3.19.0 is not affected by CVE-2026-48805. The vulnerability was introduced in v3.26.0 when CoreExtension method signatures changed from taking Environment objects to taking bool $isSandboxed parameters, but the deprecated wrapper functions in src/Resources/core.php were not updated accordingly. In v3.19.0, the wrappers correctly pass Environment objects to CoreExtension methods that expec...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48805" }, "impact_statement": "not_affected \u2014 Twig v3.19.0 is not affected by CVE-2026-48805. The vulnerability was introduced in v3.26.0 when CoreExtension method signatures changed from taking Environment objects to taking bool $isSandboxed parameters, but the deprecated wrapper functions in src/Resources/core.php were not updated accordingly. In v3.19.0, the wrappers correctly pass Environment objects to CoreExtension methods that expec..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:55:12.018852+00:00", "status_notes": "Vulnerability CVE-2026-48806 is fixed in version v3.19.0-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48806" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:55:14.193207+00:00", "status_notes": "Vulnerability CVE-2026-48807 is fixed in version v3.19.0-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48807" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:56:00.059747+00:00", "status_notes": "Vulnerability CVE-2026-48808 is fixed in version v3.19.0-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-48808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/twig/twig@v3.19.0-p1+tuxcare" } } ], "timestamp": "2026-11-09T09:56:00.059747+00:00", "status_notes": "Vulnerability CVE-2026-49981 is fixed in version v3.19.0-p1+tuxcare of twig/twig.", "vulnerability": { "name": "CVE-2026-49981" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10090 is fixed in version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10859 is fixed in version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 3.9.15-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 3.9.15-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 3.9.15-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 3.9.15-p1+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 3.9.15-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2023-30179 is a false positive for craftcms/cms 3.9.15-p1+tuxcare.", "vulnerability": { "name": "CVE-2023-30179" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33495 is fixed in version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 3.9.15-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52291 is fixed in version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52291" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52292 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p8+tuxcare.", "vulnerability": { "name": "CVE-2024-52292" }, "action_statement": "Vulnerability CVE-2024-52292 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 3.9.15-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. per review of Brhane", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "per review of Brhane" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-35939 is fixed in version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-35939" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54417 is fixed in version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-54417" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2025-57811" }, "action_statement": "Vulnerability CVE-2025-57811 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ...", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68437 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p3+tuxcare.", "vulnerability": { "name": "CVE-2025-68437" }, "action_statement": "Vulnerability CVE-2025-68437 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2025-68454" }, "action_statement": "Vulnerability CVE-2025-68454 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68456 is fixed in version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68456" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-11-09T23:08:00.049119+00:00", "status_notes": "Vulnerability CVE-2026-115934 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 Target is Craft CMS 3.9.15 (TuxCare build). No vendor patch was supplied and the CVE text is vague. The only element-search SQL path is Search service, which builds SQL by string concatenation, but attacker input is neutralised before concatenation. The anonymous GraphQL endpoint's orderBy is allow-listed. No unauthenticated element-search endpoint injects raw input into SQL. Confidence is mode...", "vulnerability": { "name": "CVE-2026-115934" }, "impact_statement": "not_affected \u2014 Target is Craft CMS 3.9.15 (TuxCare build). No vendor patch was supplied and the CVE text is vague. The only element-search SQL path is Search service, which builds SQL by string concatenation, but attacker input is neutralised before concatenation. The anonymous GraphQL endpoint's orderBy is allow-listed. No unauthenticated element-search endpoint injects raw input into SQL. Confidence is mode..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-11-02T14:56:09.367348+00:00", "status_notes": "Vulnerability CVE-2026-115935 affects version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115935" }, "action_statement": "Vulnerability CVE-2026-115935 affects version 3.9.15-p1+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2026-115938 affects version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115938" }, "action_statement": "Vulnerability CVE-2026-115938 affects version 3.9.15-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 is fixed in version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25493" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-25494" }, "action_statement": "Vulnerability CVE-2026-25494 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 is fixed in version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25495" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-25496" }, "action_statement": "Vulnerability CVE-2026-25496 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-25498" }, "action_statement": "Vulnerability CVE-2026-25498 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27127 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-27127" }, "action_statement": "Vulnerability CVE-2026-27127 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 is fixed in version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27128" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27129 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-27129" }, "action_statement": "Vulnerability CVE-2026-27129 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28783 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-28783" }, "action_statement": "Vulnerability CVE-2026-28783 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29069 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-29069" }, "action_statement": "Vulnerability CVE-2026-29069 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-29113" }, "action_statement": "Vulnerability CVE-2026-29113 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31859 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-31859" }, "action_statement": "Vulnerability CVE-2026-31859 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32262" }, "action_statement": "Vulnerability CVE-2026-32262 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32264" }, "action_statement": "Vulnerability CVE-2026-32264 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-32267" }, "action_statement": "Vulnerability CVE-2026-32267 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare.", "vulnerability": { "name": "CVE-2026-33157" }, "action_statement": "Vulnerability CVE-2026-33157 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33158" }, "action_statement": "Vulnerability CVE-2026-33158 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33159" }, "action_statement": "Vulnerability CVE-2026-33159 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33160" }, "action_statement": "Vulnerability CVE-2026-33160 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33161" }, "action_statement": "Vulnerability CVE-2026-33161 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55790 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-55790" }, "action_statement": "Vulnerability CVE-2026-55790 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55793 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55793" }, "impact_statement": "not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56382 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-56382" }, "action_statement": "Vulnerability CVE-2026-56382 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56383 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-56383" }, "action_statement": "Vulnerability CVE-2026-56383 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56384 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-56384" }, "action_statement": "Vulnerability CVE-2026-56384 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56385 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-56385" }, "action_statement": "Vulnerability CVE-2026-56385 affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-11-08T14:16:00.068422+00:00", "status_notes": "Vulnerability CVE-2026-56393 affects version 3.9.15-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56393" }, "action_statement": "Vulnerability CVE-2026-56393 affects version 3.9.15-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3m9m-24vh-39wx affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p4+tuxcare.", "vulnerability": { "name": "GHSA-3m9m-24vh-39wx" }, "action_statement": "Vulnerability GHSA-3m9m-24vh-39wx affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-44px-qjjc-xrhq affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "GHSA-44px-qjjc-xrhq" }, "action_statement": "Vulnerability GHSA-44px-qjjc-xrhq affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6j87-m5qx-9fqp affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "GHSA-6j87-m5qx-9fqp" }, "action_statement": "Vulnerability GHSA-6j87-m5qx-9fqp affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-86vw-x4ww-x467 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-86vw-x4ww-x467" }, "impact_statement": "not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-95wr-3f2v-v2wh does not affect version 3.9.15-p1+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "GHSA-95wr-3f2v-v2wh" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c43v-4cr8-6mvp does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c43v-4cr8-6mvp" }, "impact_statement": "not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-19T17:32:00.114420+00:00", "status_notes": "Vulnerability GHSA-g3hp-vvqf-8vw6 does not affect version 3.9.15-p1+tuxcare of craftcms/cms. craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-g3hp-vvqf-8vw6" }, "impact_statement": "craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 3.9.15-p1+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x76w-8c62-48mg affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "GHSA-x76w-8c62-48mg" }, "action_statement": "Vulnerability GHSA-x76w-8c62-48mg affects version 3.9.15-p1+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability AIKIDO-2025-10090 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability AIKIDO-2025-10859 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 3.9.15-p12+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 3.9.15-p12+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 3.9.15-p12+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 3.9.15-p12+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 3.9.15-p12+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2023-30179 is a false positive for craftcms/cms 3.9.15-p12+tuxcare.", "vulnerability": { "name": "CVE-2023-30179" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2023-33495 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 3.9.15-p12+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2024-52291 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52291" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2024-52292 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52292" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 3.9.15-p12+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. per review of Brhane", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "per review of Brhane" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2025-35939 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-35939" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2025-54417 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-54417" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2025-57811 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-57811" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ...", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2025-68437 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68437" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2025-68454 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68454" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2025-68456 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68456" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-11-09T23:08:00.049119+00:00", "status_notes": "Vulnerability CVE-2026-115934 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 Target is Craft CMS 3.9.15 (TuxCare build). No vendor patch was supplied and the CVE text is vague. The only element-search SQL path is Search service, which builds SQL by string concatenation, but attacker input is neutralised before concatenation. The anonymous GraphQL endpoint's orderBy is allow-listed. No unauthenticated element-search endpoint injects raw input into SQL. Confidence is mode...", "vulnerability": { "name": "CVE-2026-115934" }, "impact_statement": "not_affected \u2014 Target is Craft CMS 3.9.15 (TuxCare build). No vendor patch was supplied and the CVE text is vague. The only element-search SQL path is Search service, which builds SQL by string concatenation, but attacker input is neutralised before concatenation. The anonymous GraphQL endpoint's orderBy is allow-listed. No unauthenticated element-search endpoint injects raw input into SQL. Confidence is mode..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-11-02T14:56:09.367348+00:00", "status_notes": "Vulnerability CVE-2026-115935 affects version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115935" }, "action_statement": "Vulnerability CVE-2026-115935 affects version 3.9.15-p12+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2026-115938 affects version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115938" }, "action_statement": "Vulnerability CVE-2026-115938 affects version 3.9.15-p12+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-25493 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25493" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-25494 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25494" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-25495 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25495" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-25496 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25496" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-25498 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25498" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-27127 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27127" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-27128 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27128" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-27129 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27129" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-28783 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-28783" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-29069 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29069" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-29113 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29113" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-31859 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-31859" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-32262 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32262" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-32264 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32264" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-32267 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32267" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-33157 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33157" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-33158 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33158" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-33159 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33159" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-33160 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33160" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-33161 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33161" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-55790 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55790" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-55793 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55793" }, "impact_statement": "not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-56382 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56382" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-56383 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56383" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-56384 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56384" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-56385 is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56385" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-11-08T14:16:00.068422+00:00", "status_notes": "Vulnerability CVE-2026-56393 affects version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56393" }, "action_statement": "Vulnerability CVE-2026-56393 affects version 3.9.15-p12+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability GHSA-3m9m-24vh-39wx is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-3m9m-24vh-39wx" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability GHSA-44px-qjjc-xrhq is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-44px-qjjc-xrhq" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability GHSA-6j87-m5qx-9fqp is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-6j87-m5qx-9fqp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability GHSA-86vw-x4ww-x467 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-86vw-x4ww-x467" }, "impact_statement": "not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability GHSA-95wr-3f2v-v2wh does not affect version 3.9.15-p12+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "GHSA-95wr-3f2v-v2wh" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability GHSA-c43v-4cr8-6mvp does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c43v-4cr8-6mvp" }, "impact_statement": "not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-19T17:32:00.114420+00:00", "status_notes": "Vulnerability GHSA-g3hp-vvqf-8vw6 does not affect version 3.9.15-p12+tuxcare of craftcms/cms. craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-g3hp-vvqf-8vw6" }, "impact_statement": "craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 3.9.15-p12+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p12+tuxcare" } } ], "timestamp": "2026-10-12T07:10:00.396717+00:00", "status_notes": "Vulnerability GHSA-x76w-8c62-48mg is fixed in version 3.9.15-p12+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-x76w-8c62-48mg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability AIKIDO-2025-10090 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability AIKIDO-2025-10859 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 3.9.15-p11+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 3.9.15-p11+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 3.9.15-p11+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 3.9.15-p11+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 3.9.15-p11+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2023-30179 is a false positive for craftcms/cms 3.9.15-p11+tuxcare.", "vulnerability": { "name": "CVE-2023-30179" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2023-33495 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 3.9.15-p11+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2024-52291 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52291" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2024-52292 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52292" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 3.9.15-p11+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. per review of Brhane", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "per review of Brhane" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2025-35939 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-35939" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2025-54417 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-54417" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2025-57811 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-57811" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ...", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2025-68437 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68437" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2025-68454 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68454" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2025-68456 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68456" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-11-09T23:08:00.049119+00:00", "status_notes": "Vulnerability CVE-2026-115934 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 Target is Craft CMS 3.9.15 (TuxCare build). No vendor patch was supplied and the CVE text is vague. The only element-search SQL path is Search service, which builds SQL by string concatenation, but attacker input is neutralised before concatenation. The anonymous GraphQL endpoint's orderBy is allow-listed. No unauthenticated element-search endpoint injects raw input into SQL. Confidence is mode...", "vulnerability": { "name": "CVE-2026-115934" }, "impact_statement": "not_affected \u2014 Target is Craft CMS 3.9.15 (TuxCare build). No vendor patch was supplied and the CVE text is vague. The only element-search SQL path is Search service, which builds SQL by string concatenation, but attacker input is neutralised before concatenation. The anonymous GraphQL endpoint's orderBy is allow-listed. No unauthenticated element-search endpoint injects raw input into SQL. Confidence is mode..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-11-02T14:56:09.367348+00:00", "status_notes": "Vulnerability CVE-2026-115935 affects version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115935" }, "action_statement": "Vulnerability CVE-2026-115935 affects version 3.9.15-p11+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2026-115938 affects version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115938" }, "action_statement": "Vulnerability CVE-2026-115938 affects version 3.9.15-p11+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-25493 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25493" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-25494 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25494" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-25495 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25495" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-25496 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25496" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-25498 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25498" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-27127 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27127" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-27128 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27128" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-27129 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27129" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-28783 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-28783" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-29069 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29069" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-29113 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29113" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-31859 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-31859" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-32262 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32262" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-32264 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32264" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-32267 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32267" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-33157 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33157" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-33158 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33158" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-33159 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33159" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-33160 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33160" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-33161 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33161" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-55790 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55790" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-55793 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55793" }, "impact_statement": "not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-56382 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56382" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-56383 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56383" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-56384 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56384" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-56385 is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56385" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-11-08T14:16:00.068422+00:00", "status_notes": "Vulnerability CVE-2026-56393 affects version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56393" }, "action_statement": "Vulnerability CVE-2026-56393 affects version 3.9.15-p11+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability GHSA-3m9m-24vh-39wx is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-3m9m-24vh-39wx" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability GHSA-44px-qjjc-xrhq is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-44px-qjjc-xrhq" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability GHSA-6j87-m5qx-9fqp is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-6j87-m5qx-9fqp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability GHSA-86vw-x4ww-x467 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-86vw-x4ww-x467" }, "impact_statement": "not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability GHSA-95wr-3f2v-v2wh does not affect version 3.9.15-p11+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "GHSA-95wr-3f2v-v2wh" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability GHSA-c43v-4cr8-6mvp does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c43v-4cr8-6mvp" }, "impact_statement": "not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-19T17:32:00.114420+00:00", "status_notes": "Vulnerability GHSA-g3hp-vvqf-8vw6 does not affect version 3.9.15-p11+tuxcare of craftcms/cms. craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-g3hp-vvqf-8vw6" }, "impact_statement": "craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 3.9.15-p11+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p11+tuxcare" } } ], "timestamp": "2026-10-11T18:22:00.136921+00:00", "status_notes": "Vulnerability GHSA-x76w-8c62-48mg is fixed in version 3.9.15-p11+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-x76w-8c62-48mg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10090 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10859 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 3.9.15-p5+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 3.9.15-p5+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 3.9.15-p5+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 3.9.15-p5+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 3.9.15-p5+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2023-30179 is a false positive for craftcms/cms 3.9.15-p5+tuxcare.", "vulnerability": { "name": "CVE-2023-30179" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33495 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 3.9.15-p5+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52291 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52291" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52292 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p8+tuxcare.", "vulnerability": { "name": "CVE-2024-52292" }, "action_statement": "Vulnerability CVE-2024-52292 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 3.9.15-p5+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. per review of Brhane", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "per review of Brhane" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-35939 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-35939" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54417 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-54417" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2025-57811" }, "action_statement": "Vulnerability CVE-2025-57811 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ...", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68437 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68437" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2025-68454" }, "action_statement": "Vulnerability CVE-2025-68454 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68456 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68456" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-11-09T23:08:00.049119+00:00", "status_notes": "Vulnerability CVE-2026-115934 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 Target is Craft CMS 3.9.15 (TuxCare build). No vendor patch was supplied and the CVE text is vague. The only element-search SQL path is Search service, which builds SQL by string concatenation, but attacker input is neutralised before concatenation. The anonymous GraphQL endpoint's orderBy is allow-listed. No unauthenticated element-search endpoint injects raw input into SQL. Confidence is mode...", "vulnerability": { "name": "CVE-2026-115934" }, "impact_statement": "not_affected \u2014 Target is Craft CMS 3.9.15 (TuxCare build). No vendor patch was supplied and the CVE text is vague. The only element-search SQL path is Search service, which builds SQL by string concatenation, but attacker input is neutralised before concatenation. The anonymous GraphQL endpoint's orderBy is allow-listed. No unauthenticated element-search endpoint injects raw input into SQL. Confidence is mode..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-11-02T14:56:09.367348+00:00", "status_notes": "Vulnerability CVE-2026-115935 affects version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115935" }, "action_statement": "Vulnerability CVE-2026-115935 affects version 3.9.15-p5+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2026-115938 affects version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115938" }, "action_statement": "Vulnerability CVE-2026-115938 affects version 3.9.15-p5+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25493" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-25494" }, "action_statement": "Vulnerability CVE-2026-25494 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25495" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25496" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-25498" }, "action_statement": "Vulnerability CVE-2026-25498 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27127 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27127" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27128" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27129 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-27129" }, "action_statement": "Vulnerability CVE-2026-27129 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28783 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-28783" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29069 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29069" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-29113" }, "action_statement": "Vulnerability CVE-2026-29113 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31859 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-31859" }, "action_statement": "Vulnerability CVE-2026-31859 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32262" }, "action_statement": "Vulnerability CVE-2026-32262 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32264" }, "action_statement": "Vulnerability CVE-2026-32264 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32267" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare.", "vulnerability": { "name": "CVE-2026-33157" }, "action_statement": "Vulnerability CVE-2026-33157 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33158" }, "action_statement": "Vulnerability CVE-2026-33158 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33159" }, "action_statement": "Vulnerability CVE-2026-33159 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33160" }, "action_statement": "Vulnerability CVE-2026-33160 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33161" }, "action_statement": "Vulnerability CVE-2026-33161 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55790 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-55790" }, "action_statement": "Vulnerability CVE-2026-55790 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55793 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55793" }, "impact_statement": "not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56382 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-56382" }, "action_statement": "Vulnerability CVE-2026-56382 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56383 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-56383" }, "action_statement": "Vulnerability CVE-2026-56383 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56384 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-56384" }, "action_statement": "Vulnerability CVE-2026-56384 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56385 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-56385" }, "action_statement": "Vulnerability CVE-2026-56385 affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-11-08T14:16:00.068422+00:00", "status_notes": "Vulnerability CVE-2026-56393 affects version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56393" }, "action_statement": "Vulnerability CVE-2026-56393 affects version 3.9.15-p5+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3m9m-24vh-39wx is fixed in version 3.9.15-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-3m9m-24vh-39wx" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-44px-qjjc-xrhq affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "GHSA-44px-qjjc-xrhq" }, "action_statement": "Vulnerability GHSA-44px-qjjc-xrhq affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6j87-m5qx-9fqp affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "GHSA-6j87-m5qx-9fqp" }, "action_statement": "Vulnerability GHSA-6j87-m5qx-9fqp affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-86vw-x4ww-x467 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-86vw-x4ww-x467" }, "impact_statement": "not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-95wr-3f2v-v2wh does not affect version 3.9.15-p5+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "GHSA-95wr-3f2v-v2wh" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c43v-4cr8-6mvp does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c43v-4cr8-6mvp" }, "impact_statement": "not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-19T17:32:00.114420+00:00", "status_notes": "Vulnerability GHSA-g3hp-vvqf-8vw6 does not affect version 3.9.15-p5+tuxcare of craftcms/cms. craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-g3hp-vvqf-8vw6" }, "impact_statement": "craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 3.9.15-p5+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x76w-8c62-48mg affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "GHSA-x76w-8c62-48mg" }, "action_statement": "Vulnerability GHSA-x76w-8c62-48mg affects version 3.9.15-p5+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10090 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10859 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 3.9.15-p10+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 3.9.15-p10+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 3.9.15-p10+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 3.9.15-p10+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 3.9.15-p10+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2023-30179 is a false positive for craftcms/cms 3.9.15-p10+tuxcare.", "vulnerability": { "name": "CVE-2023-30179" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33495 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 3.9.15-p10+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52291 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52291" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52292 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52292" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 3.9.15-p10+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. per review of Brhane", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "per review of Brhane" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-35939 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-35939" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54417 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-54417" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-57811" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ...", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68437 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68437" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68454" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68456 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68456" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-11-09T23:08:00.049119+00:00", "status_notes": "Vulnerability CVE-2026-115934 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 Target is Craft CMS 3.9.15 (TuxCare build). No vendor patch was supplied and the CVE text is vague. The only element-search SQL path is Search service, which builds SQL by string concatenation, but attacker input is neutralised before concatenation. The anonymous GraphQL endpoint's orderBy is allow-listed. No unauthenticated element-search endpoint injects raw input into SQL. Confidence is mode...", "vulnerability": { "name": "CVE-2026-115934" }, "impact_statement": "not_affected \u2014 Target is Craft CMS 3.9.15 (TuxCare build). No vendor patch was supplied and the CVE text is vague. The only element-search SQL path is Search service, which builds SQL by string concatenation, but attacker input is neutralised before concatenation. The anonymous GraphQL endpoint's orderBy is allow-listed. No unauthenticated element-search endpoint injects raw input into SQL. Confidence is mode..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-11-02T14:56:09.367348+00:00", "status_notes": "Vulnerability CVE-2026-115935 affects version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115935" }, "action_statement": "Vulnerability CVE-2026-115935 affects version 3.9.15-p10+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2026-115938 affects version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115938" }, "action_statement": "Vulnerability CVE-2026-115938 affects version 3.9.15-p10+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25493" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25494" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25495" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25496" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25498" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27127 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27127" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27128" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27129 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27129" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28783 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-28783" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29069 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29069" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29113" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31859 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-31859" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32262" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32264" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32267" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33157" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33158" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33159" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33160" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33161" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55790 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55790" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55793 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55793" }, "impact_statement": "not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56382 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56382" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56383 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56383" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56384 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56384" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56385 is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56385" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-11-08T14:16:00.068422+00:00", "status_notes": "Vulnerability CVE-2026-56393 affects version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56393" }, "action_statement": "Vulnerability CVE-2026-56393 affects version 3.9.15-p10+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3m9m-24vh-39wx is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-3m9m-24vh-39wx" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-44px-qjjc-xrhq is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-44px-qjjc-xrhq" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6j87-m5qx-9fqp is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-6j87-m5qx-9fqp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-86vw-x4ww-x467 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-86vw-x4ww-x467" }, "impact_statement": "not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-95wr-3f2v-v2wh does not affect version 3.9.15-p10+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "GHSA-95wr-3f2v-v2wh" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c43v-4cr8-6mvp does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c43v-4cr8-6mvp" }, "impact_statement": "not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-19T17:32:00.114420+00:00", "status_notes": "Vulnerability GHSA-g3hp-vvqf-8vw6 does not affect version 3.9.15-p10+tuxcare of craftcms/cms. craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-g3hp-vvqf-8vw6" }, "impact_statement": "craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 3.9.15-p10+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x76w-8c62-48mg is fixed in version 3.9.15-p10+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-x76w-8c62-48mg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10090 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10859 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 3.9.15-p8+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 3.9.15-p8+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 3.9.15-p8+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 3.9.15-p8+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 3.9.15-p8+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2023-30179 is a false positive for craftcms/cms 3.9.15-p8+tuxcare.", "vulnerability": { "name": "CVE-2023-30179" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33495 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 3.9.15-p8+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52291 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52291" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52292 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52292" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 3.9.15-p8+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. per review of Brhane", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "per review of Brhane" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-35939 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-35939" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54417 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-54417" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-57811" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ...", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68437 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68437" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 affects version 3.9.15-p8+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2025-68454" }, "action_statement": "Vulnerability CVE-2025-68454 affects version 3.9.15-p8+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68456 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68456" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-11-09T23:08:00.049119+00:00", "status_notes": "Vulnerability CVE-2026-115934 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 Target is Craft CMS 3.9.15 (TuxCare build). No vendor patch was supplied and the CVE text is vague. The only element-search SQL path is Search service, which builds SQL by string concatenation, but attacker input is neutralised before concatenation. The anonymous GraphQL endpoint's orderBy is allow-listed. No unauthenticated element-search endpoint injects raw input into SQL. Confidence is mode...", "vulnerability": { "name": "CVE-2026-115934" }, "impact_statement": "not_affected \u2014 Target is Craft CMS 3.9.15 (TuxCare build). No vendor patch was supplied and the CVE text is vague. The only element-search SQL path is Search service, which builds SQL by string concatenation, but attacker input is neutralised before concatenation. The anonymous GraphQL endpoint's orderBy is allow-listed. No unauthenticated element-search endpoint injects raw input into SQL. Confidence is mode..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-11-02T14:56:09.367348+00:00", "status_notes": "Vulnerability CVE-2026-115935 affects version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115935" }, "action_statement": "Vulnerability CVE-2026-115935 affects version 3.9.15-p8+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2026-115938 affects version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115938" }, "action_statement": "Vulnerability CVE-2026-115938 affects version 3.9.15-p8+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25493" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25494" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25495" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25496" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25498" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27127 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27127" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27128" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27129 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27129" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28783 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-28783" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29069 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29069" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29113" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31859 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-31859" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 affects version 3.9.15-p8+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32262" }, "action_statement": "Vulnerability CVE-2026-32262 affects version 3.9.15-p8+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 affects version 3.9.15-p8+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32264" }, "action_statement": "Vulnerability CVE-2026-32264 affects version 3.9.15-p8+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32267" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 affects version 3.9.15-p8+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare.", "vulnerability": { "name": "CVE-2026-33157" }, "action_statement": "Vulnerability CVE-2026-33157 affects version 3.9.15-p8+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33158" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33159" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33160" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33161" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55790 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55790" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55793 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55793" }, "impact_statement": "not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56382 affects version 3.9.15-p8+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-56382" }, "action_statement": "Vulnerability CVE-2026-56382 affects version 3.9.15-p8+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56383 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56383" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56384 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56384" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56385 is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56385" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-11-08T14:16:00.068422+00:00", "status_notes": "Vulnerability CVE-2026-56393 affects version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56393" }, "action_statement": "Vulnerability CVE-2026-56393 affects version 3.9.15-p8+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3m9m-24vh-39wx is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-3m9m-24vh-39wx" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-44px-qjjc-xrhq is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-44px-qjjc-xrhq" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6j87-m5qx-9fqp is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-6j87-m5qx-9fqp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-86vw-x4ww-x467 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-86vw-x4ww-x467" }, "impact_statement": "not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-95wr-3f2v-v2wh does not affect version 3.9.15-p8+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "GHSA-95wr-3f2v-v2wh" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c43v-4cr8-6mvp does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c43v-4cr8-6mvp" }, "impact_statement": "not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-19T17:32:00.114420+00:00", "status_notes": "Vulnerability GHSA-g3hp-vvqf-8vw6 does not affect version 3.9.15-p8+tuxcare of craftcms/cms. craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-g3hp-vvqf-8vw6" }, "impact_statement": "craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 3.9.15-p8+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x76w-8c62-48mg is fixed in version 3.9.15-p8+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-x76w-8c62-48mg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10090 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10859 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 3.9.15-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 3.9.15-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 3.9.15-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 3.9.15-p3+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 3.9.15-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2023-30179 is a false positive for craftcms/cms 3.9.15-p3+tuxcare.", "vulnerability": { "name": "CVE-2023-30179" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33495 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 3.9.15-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52291 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52291" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52292 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p8+tuxcare.", "vulnerability": { "name": "CVE-2024-52292" }, "action_statement": "Vulnerability CVE-2024-52292 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 3.9.15-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. per review of Brhane", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "per review of Brhane" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-35939 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-35939" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54417 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-54417" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2025-57811" }, "action_statement": "Vulnerability CVE-2025-57811 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ...", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68437 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68437" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2025-68454" }, "action_statement": "Vulnerability CVE-2025-68454 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68456 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68456" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-11-09T23:08:00.049119+00:00", "status_notes": "Vulnerability CVE-2026-115934 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 Target is Craft CMS 3.9.15 (TuxCare build). No vendor patch was supplied and the CVE text is vague. The only element-search SQL path is Search service, which builds SQL by string concatenation, but attacker input is neutralised before concatenation. The anonymous GraphQL endpoint's orderBy is allow-listed. No unauthenticated element-search endpoint injects raw input into SQL. Confidence is mode...", "vulnerability": { "name": "CVE-2026-115934" }, "impact_statement": "not_affected \u2014 Target is Craft CMS 3.9.15 (TuxCare build). No vendor patch was supplied and the CVE text is vague. The only element-search SQL path is Search service, which builds SQL by string concatenation, but attacker input is neutralised before concatenation. The anonymous GraphQL endpoint's orderBy is allow-listed. No unauthenticated element-search endpoint injects raw input into SQL. Confidence is mode..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-11-02T14:56:09.367348+00:00", "status_notes": "Vulnerability CVE-2026-115935 affects version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115935" }, "action_statement": "Vulnerability CVE-2026-115935 affects version 3.9.15-p3+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2026-115938 affects version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115938" }, "action_statement": "Vulnerability CVE-2026-115938 affects version 3.9.15-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25493" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-25494" }, "action_statement": "Vulnerability CVE-2026-25494 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25495" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-25496" }, "action_statement": "Vulnerability CVE-2026-25496 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-25498" }, "action_statement": "Vulnerability CVE-2026-25498 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27127 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27127" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27128" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27129 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-27129" }, "action_statement": "Vulnerability CVE-2026-27129 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28783 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-28783" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29069 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29069" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-29113" }, "action_statement": "Vulnerability CVE-2026-29113 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31859 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-31859" }, "action_statement": "Vulnerability CVE-2026-31859 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32262" }, "action_statement": "Vulnerability CVE-2026-32262 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32264" }, "action_statement": "Vulnerability CVE-2026-32264 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 is fixed in version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32267" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare.", "vulnerability": { "name": "CVE-2026-33157" }, "action_statement": "Vulnerability CVE-2026-33157 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33158" }, "action_statement": "Vulnerability CVE-2026-33158 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33159" }, "action_statement": "Vulnerability CVE-2026-33159 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33160" }, "action_statement": "Vulnerability CVE-2026-33160 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33161" }, "action_statement": "Vulnerability CVE-2026-33161 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55790 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-55790" }, "action_statement": "Vulnerability CVE-2026-55790 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55793 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55793" }, "impact_statement": "not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56382 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-56382" }, "action_statement": "Vulnerability CVE-2026-56382 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56383 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-56383" }, "action_statement": "Vulnerability CVE-2026-56383 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56384 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-56384" }, "action_statement": "Vulnerability CVE-2026-56384 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56385 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-56385" }, "action_statement": "Vulnerability CVE-2026-56385 affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-11-08T14:16:00.068422+00:00", "status_notes": "Vulnerability CVE-2026-56393 affects version 3.9.15-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56393" }, "action_statement": "Vulnerability CVE-2026-56393 affects version 3.9.15-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3m9m-24vh-39wx affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p4+tuxcare.", "vulnerability": { "name": "GHSA-3m9m-24vh-39wx" }, "action_statement": "Vulnerability GHSA-3m9m-24vh-39wx affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-44px-qjjc-xrhq affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "GHSA-44px-qjjc-xrhq" }, "action_statement": "Vulnerability GHSA-44px-qjjc-xrhq affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6j87-m5qx-9fqp affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "GHSA-6j87-m5qx-9fqp" }, "action_statement": "Vulnerability GHSA-6j87-m5qx-9fqp affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-86vw-x4ww-x467 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-86vw-x4ww-x467" }, "impact_statement": "not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-95wr-3f2v-v2wh does not affect version 3.9.15-p3+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "GHSA-95wr-3f2v-v2wh" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c43v-4cr8-6mvp does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c43v-4cr8-6mvp" }, "impact_statement": "not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-19T17:32:00.114420+00:00", "status_notes": "Vulnerability GHSA-g3hp-vvqf-8vw6 does not affect version 3.9.15-p3+tuxcare of craftcms/cms. craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-g3hp-vvqf-8vw6" }, "impact_statement": "craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 3.9.15-p3+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x76w-8c62-48mg affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "GHSA-x76w-8c62-48mg" }, "action_statement": "Vulnerability GHSA-x76w-8c62-48mg affects version 3.9.15-p3+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10090 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10859 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 3.9.15-p6+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 3.9.15-p6+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 3.9.15-p6+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 3.9.15-p6+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 3.9.15-p6+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2023-30179 is a false positive for craftcms/cms 3.9.15-p6+tuxcare.", "vulnerability": { "name": "CVE-2023-30179" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33495 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 3.9.15-p6+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52291 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52291" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52292 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p8+tuxcare.", "vulnerability": { "name": "CVE-2024-52292" }, "action_statement": "Vulnerability CVE-2024-52292 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 3.9.15-p6+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. per review of Brhane", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "per review of Brhane" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-35939 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-35939" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54417 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-54417" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2025-57811" }, "action_statement": "Vulnerability CVE-2025-57811 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ...", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68437 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68437" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2025-68454" }, "action_statement": "Vulnerability CVE-2025-68454 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68456 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68456" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-11-09T23:08:00.049119+00:00", "status_notes": "Vulnerability CVE-2026-115934 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 Target is Craft CMS 3.9.15 (TuxCare build). No vendor patch was supplied and the CVE text is vague. The only element-search SQL path is Search service, which builds SQL by string concatenation, but attacker input is neutralised before concatenation. The anonymous GraphQL endpoint's orderBy is allow-listed. No unauthenticated element-search endpoint injects raw input into SQL. Confidence is mode...", "vulnerability": { "name": "CVE-2026-115934" }, "impact_statement": "not_affected \u2014 Target is Craft CMS 3.9.15 (TuxCare build). No vendor patch was supplied and the CVE text is vague. The only element-search SQL path is Search service, which builds SQL by string concatenation, but attacker input is neutralised before concatenation. The anonymous GraphQL endpoint's orderBy is allow-listed. No unauthenticated element-search endpoint injects raw input into SQL. Confidence is mode..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-11-02T14:56:09.367348+00:00", "status_notes": "Vulnerability CVE-2026-115935 affects version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115935" }, "action_statement": "Vulnerability CVE-2026-115935 affects version 3.9.15-p6+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2026-115938 affects version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115938" }, "action_statement": "Vulnerability CVE-2026-115938 affects version 3.9.15-p6+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25493" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-25494" }, "action_statement": "Vulnerability CVE-2026-25494 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25495" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25496" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-25498" }, "action_statement": "Vulnerability CVE-2026-25498 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27127 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27127" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27128" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27129 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-27129" }, "action_statement": "Vulnerability CVE-2026-27129 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28783 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-28783" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29069 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29069" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-29113" }, "action_statement": "Vulnerability CVE-2026-29113 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31859 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-31859" }, "action_statement": "Vulnerability CVE-2026-31859 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32262" }, "action_statement": "Vulnerability CVE-2026-32262 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32264" }, "action_statement": "Vulnerability CVE-2026-32264 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32267" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare.", "vulnerability": { "name": "CVE-2026-33157" }, "action_statement": "Vulnerability CVE-2026-33157 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33158" }, "action_statement": "Vulnerability CVE-2026-33158 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33159" }, "action_statement": "Vulnerability CVE-2026-33159 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33160" }, "action_statement": "Vulnerability CVE-2026-33160 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33161" }, "action_statement": "Vulnerability CVE-2026-33161 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55790 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55790" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55793 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55793" }, "impact_statement": "not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56382 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-56382" }, "action_statement": "Vulnerability CVE-2026-56382 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56383 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-56383" }, "action_statement": "Vulnerability CVE-2026-56383 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56384 is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56384" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56385 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-56385" }, "action_statement": "Vulnerability CVE-2026-56385 affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-11-08T14:16:00.068422+00:00", "status_notes": "Vulnerability CVE-2026-56393 affects version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56393" }, "action_statement": "Vulnerability CVE-2026-56393 affects version 3.9.15-p6+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3m9m-24vh-39wx is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-3m9m-24vh-39wx" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-44px-qjjc-xrhq affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "GHSA-44px-qjjc-xrhq" }, "action_statement": "Vulnerability GHSA-44px-qjjc-xrhq affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6j87-m5qx-9fqp affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "GHSA-6j87-m5qx-9fqp" }, "action_statement": "Vulnerability GHSA-6j87-m5qx-9fqp affects version 3.9.15-p6+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-86vw-x4ww-x467 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-86vw-x4ww-x467" }, "impact_statement": "not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-95wr-3f2v-v2wh does not affect version 3.9.15-p6+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "GHSA-95wr-3f2v-v2wh" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c43v-4cr8-6mvp does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c43v-4cr8-6mvp" }, "impact_statement": "not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-19T17:32:00.114420+00:00", "status_notes": "Vulnerability GHSA-g3hp-vvqf-8vw6 does not affect version 3.9.15-p6+tuxcare of craftcms/cms. craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-g3hp-vvqf-8vw6" }, "impact_statement": "craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 3.9.15-p6+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x76w-8c62-48mg is fixed in version 3.9.15-p6+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-x76w-8c62-48mg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 is an XSS vulnerability in Craft CMS allowing malicious script execution via uploaded HTML files. The vendor patch (commit 8ee85a8f03c143fa2420e7d6f311d95cae3b19ce, Jan 2021) removed 'htm' and 'html' from the default allowedFileExtensions array in src/config/GeneralConfig.php. Analysis of the target repository (craftcms/cms 4.18.9-p1+tuxcare at SHA 9f8c824e72) confirms the allowe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 is an XSS vulnerability in Craft CMS allowing malicious script execution via uploaded HTML files. The vendor patch (commit 8ee85a8f03c143fa2420e7d6f311d95cae3b19ce, Jan 2021) removed 'htm' and 'html' from the default allowedFileExtensions array in src/config/GeneralConfig.php. Analysis of the target repository (craftcms/cms 4.18.9-p1+tuxcare at SHA 9f8c824e72) confirms the allowe..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 4.18.9-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 4.18.9-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is not affected by CVE-2021-32470. The vulnerability (XSS via unescaped prompt input in FieldLayoutDesigner.js) was fixed in upstream Craft CMS 3.6.13. Version 4.18.9 inherited this fix from upstream - the code at src/web/assets/cp/src/js/FieldLayoutDesigner.js:150-151 properly wraps the prompt() result with Craft.escapeHtml() before DOM insertion, preventing the XSS attac...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is not affected by CVE-2021-32470. The vulnerability (XSS via unescaped prompt input in FieldLayoutDesigner.js) was fixed in upstream Craft CMS 3.6.13. Version 4.18.9 inherited this fix from upstream - the code at src/web/assets/cp/src/js/FieldLayoutDesigner.js:150-151 properly wraps the prompt() result with Craft.escapeHtml() before DOM insertion, preventing the XSS attac..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 4.18.9-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 4.18.9-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is an XSS vulnerability in Craft CMS FeedWidget where malicious feed data with javascript: URLs in permalink fields could execute arbitrary JavaScript. The fix validates that permalinks start with http:// or https:// before processing. Target version 4.18.9 already contains this fix - it was present in the upstream release when TuxCare onboarded it. The vulnerable pattern (unvali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is an XSS vulnerability in Craft CMS FeedWidget where malicious feed data with javascript: URLs in permalink fields could execute arbitrary JavaScript. The fix validates that permalinks start with http:// or https:// before processing. Target version 4.18.9 already contains this fix - it was present in the upstream release when TuxCare onboarded it. The vulnerable pattern (unvali..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:44:49.610847+00:00", "status_notes": "Vulnerability CVE-2022-29933 is fixed in version 4.18.9-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS version 4.2.0.1. The target is running version 4.18.9, which already contains all the XSS fixes from the upstream vendor. The vulnerability pattern (unescaped HTML rendering of user-controlled strings) is not present in the target because HTML encoding (`Html::encode()`, Twig `|e` filter, `Craft.escapeHtml()`) has been applied to all affected f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS version 4.2.0.1. The target is running version 4.18.9, which already contains all the XSS fixes from the upstream vendor. The vulnerability pattern (unescaped HTML rendering of user-controlled strings) is not present in the target because HTML encoding (`Html::encode()`, Twig `|e` filter, `Craft.escapeHtml()`) has been applied to all affected f..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 4.18.9-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 4.18.9-p3+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 4.18.9-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 4.18.9-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-30177 affects CraftCMS prior to version 3.7.68 due to XSS via unencoded volume name output. The target version 4.18.9-p1+tuxcare is NOT vulnerable. The fix was already present in the upstream 4.18.9 release when TuxCare onboarded it. Both output locations use HTML encoding: src/elements/Asset.php line 2804 applies Html::encode() directly, and line 1424 breadcrumbs are auto-encoded by t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 CVE-2023-30177 affects CraftCMS prior to version 3.7.68 due to XSS via unencoded volume name output. The target version 4.18.9-p1+tuxcare is NOT vulnerable. The fix was already present in the upstream 4.18.9 release when TuxCare onboarded it. Both output locations use HTML encoding: src/elements/Asset.php line 2804 applies Html::encode() directly, and line 1424 breadcrumbs are auto-encoded by t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-31144 (XSS via malformed feed widget titles) is NOT present in CraftCMS 4.18.9-p1+tuxcare. The vulnerability required JSON_UNESCAPED_SLASHES flag to be set, allowing unescaped forward slashes in JSON output that could break out of script contexts (e.g., via \"\" in feed titles). The upstream vendor (Pixel & Tonic) fixed this by removing JSON_UNESCAPED_SLASHES from the default en...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "not_affected \u2014 CVE-2023-31144 (XSS via malformed feed widget titles) is NOT present in CraftCMS 4.18.9-p1+tuxcare. The vulnerability required JSON_UNESCAPED_SLASHES flag to be set, allowing unescaped forward slashes in JSON output that could break out of script contexts (e.g., via \"\" in feed titles). The upstream vendor (Pixel & Tonic) fixed this by removing JSON_UNESCAPED_SLASHES from the default en..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is not present in the target. The fix was authored by brandon@pixelandtonic.com (Pixel & Tonic - upstream vendor) on April 3, 2023 in commit 9d0cd0bda7, and shipped with upstream Craft CMS 4.18.9. TuxCare onboarded version 4.18.9 on October 3, 2026, which already contained the fix. The vulnerable pattern (HTML string concatenation) is...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is not present in the target. The fix was authored by brandon@pixelandtonic.com (Pixel & Tonic - upstream vendor) on April 3, 2023 in commit 9d0cd0bda7, and shipped with upstream Craft CMS 4.18.9. TuxCare onboarded version 4.18.9 on October 3, 2026, which already contained the fix. The vulnerable pattern (HTML string concatenation) is..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2023-33495 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33495 (HTML injection in Craft CMS through 4.4.9) is not present in version 4.18.9. The vulnerable pattern (unsafe HTML rendering of exporter names via `html: option.label` in UI.js) was fixed by upstream vendor Pixel & Tonic in commit 57334cd435 (2026-01-04). The fix uses jQuery's `.text()` method which safely escapes HTML. This fix was already present in the upstream 4.18.9 release w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33495" }, "impact_statement": "not_affected \u2014 CVE-2023-33495 (HTML injection in Craft CMS through 4.4.9) is not present in version 4.18.9. The vulnerable pattern (unsafe HTML rendering of exporter names via `html: option.label` in UI.js) was fixed by upstream vendor Pixel & Tonic in commit 57334cd435 (2026-01-04). The fix uses jQuery's `.text()` method which safely escapes HTML. This fix was already present in the upstream 4.18.9 release w..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2023-36260 is a false positive for craftcms/cms 4.18.9-p3+tuxcare. CVE-2023-36260 is a false positive for this repository. The CVE describes a DoS vulnerability in the Feed-Me plugin (craftcms/feed-me) related to saving feeds with asset element types and no volume selected. This repository is craftcms/cms (Craft CMS core version 4.18.9), which does not include, vendor, or depend on the Feed-Me plugin. The Feed-Me plugin is a separate package for content import functionality. The core CMS contains only a simple Feed widget for displaying RSS feeds, which lacks the asset/volume functionality described in the CVE.", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "CVE-2023-36260 is a false positive for this repository. The CVE describes a DoS vulnerability in the Feed-Me plugin (craftcms/feed-me) related to saving feeds with asset element types and no volume selected. This repository is craftcms/cms (Craft CMS core version 4.18.9), which does not include, vendor, or depend on the Feed-Me plugin. The Feed-Me plugin is a separate package for content import functionality. The core CMS contains only a simple Feed widget for displaying RSS feeds, which lacks the asset/volume functionality described in the CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2023-40035 affects version 4.18.9-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-40035" }, "action_statement": "Vulnerability CVE-2023-40035 affects version 4.18.9-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2024-21622 describes a privilege escalation vulnerability in Craft CMS that was fixed in versions 4.4.16 and 3.9.6. The target is running Craft CMS 4.18.9, which is significantly newer than the fixed version. Analysis confirms both security patches are present in the target code: (1) ElementsController.php implements double authorization checks before and after applying POST parameters, and...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "not_affected \u2014 CVE-2024-21622 describes a privilege escalation vulnerability in Craft CMS that was fixed in versions 4.4.16 and 3.9.6. The target is running Craft CMS 4.18.9, which is significantly newer than the fixed version. Analysis confirms both security patches are present in the target code: (1) ElementsController.php implements double authorization checks before and after applying POST parameters, and..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 4.18.9-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 4.18.9-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 4.18.9 is not affected by CVE-2024-41800. The vulnerability concerns TOTP token reuse in Craft CMS 5's two-factor authentication system. TOTP authentication functionality was introduced in Craft CMS 5 and does not exist in Craft 4. The target repository contains no TOTP implementation code, no Google2FA dependency, no authenticator database tables, and no TOTP verification methods. Th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 4.18.9 is not affected by CVE-2024-41800. The vulnerability concerns TOTP token reuse in Craft CMS 5's two-factor authentication system. TOTP authentication functionality was introduced in Craft CMS 5 and does not exist in Craft 4. The target repository contains no TOTP implementation code, no Google2FA dependency, no authenticator database tables, and no TOTP verification methods. Th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2024-52291 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. CVE-2024-52291 is NOT present in CraftCMS 4.18.9. The vulnerability involved bypassing local filesystem validation using double file:// schemes (e.g., file://file:////), but the upstream fix was already included in version 4.18.9 when TuxCare onboarded it. The vulnerable code pattern (StringHelper::removeLeft) was replaced with a secure regex pattern that removes all consecutive file:// prefixes.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52291" }, "impact_statement": "CVE-2024-52291 is NOT present in CraftCMS 4.18.9. The vulnerability involved bypassing local filesystem validation using double file:// schemes (e.g., file://file:////), but the upstream fix was already included in version 4.18.9 when TuxCare onboarded it. The vulnerable code pattern (StringHelper::removeLeft) was replaced with a secure regex pattern that removes all consecutive file:// prefixes." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2024-52292 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. The target repository (Craft CMS 4.18.9) is NOT affected by CVE-2024-52292. The vulnerability pattern\u2014unrestricted absolute file path reading via the dataUrl() function\u2014is not present. The fix (path containment validation at src/helpers/Html.php:995-999) was included in upstream Craft CMS 4.18.9 before TuxCare onboarded the version on 2026-09-24. The snapshot commit imported the already-fixed codebase, and no subsequent modifications were made to the dataUrl() function on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52292" }, "impact_statement": "The target repository (Craft CMS 4.18.9) is NOT affected by CVE-2024-52292. The vulnerability pattern\u2014unrestricted absolute file path reading via the dataUrl() function\u2014is not present. The fix (path containment validation at src/helpers/Html.php:995-999) was included in upstream Craft CMS 4.18.9 before TuxCare onboarded the version on 2026-09-24. The snapshot commit imported the already-fixed codebase, and no subsequent modifications were made to the dataUrl() function on this branch." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. CVE-2024-52293 is NOT present in the target. The vulnerability (missing normalizePath in FileHelper::absolutePath) was fixed by upstream Craft CMS in version 4.12.2 (commit 123e48a696, 2024-09-11, author brandon@pixelandtonic.com). The target version 4.18.9 already includes this fix from the upstream release. Line 136 of FileHelper.php contains 'return static::normalizePath($from . $ds . $to, $ds);', which is the fixed version that prevents directory traversal attacks. The vulnerable pattern (raw concatenation without normalization) is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 is NOT present in the target. The vulnerability (missing normalizePath in FileHelper::absolutePath) was fixed by upstream Craft CMS in version 4.12.2 (commit 123e48a696, 2024-09-11, author brandon@pixelandtonic.com). The target version 4.18.9 already includes this fix from the upstream release. Line 136 of FileHelper.php contains 'return static::normalizePath($from . $ds . $to, $ds);', which is the fixed version that prevents directory traversal attacks. The vulnerable pattern (raw concatenation without normalization) is not present." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 4.18.9-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 4.18.9-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. The target repository (Craft CMS 4.18.9) is not affected by CVE-2025-23209. The vulnerable method UpdaterController::actionRestoreDb() has been completely disabled and now throws NotSupportedException, preventing any path traversal attack that could lead to RCE. This fix was already present in upstream Craft CMS 4.18.9 before TuxCare onboarded the version. The fixing commit a19d46be78 by brandon@pixelandtonic.com (upstream vendor) shipped in the 4.18.9 release, which TuxCare subsequently onboarded via snapshot commit b1a16b0026.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "The target repository (Craft CMS 4.18.9) is not affected by CVE-2025-23209. The vulnerable method UpdaterController::actionRestoreDb() has been completely disabled and now throws NotSupportedException, preventing any path traversal attack that could lead to RCE. This fix was already present in upstream Craft CMS 4.18.9 before TuxCare onboarded the version. The fixing commit a19d46be78 by brandon@pixelandtonic.com (upstream vendor) shipped in the 4.18.9 release, which TuxCare subsequently onboarded via snapshot commit b1a16b0026." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. The target repository (craftcms/cms version 4.18.9) is not affected by CVE-2025-32432. The RCE vulnerability, which exploited missing type validation on the transform handle parameter, was fixed in upstream version 4.14.15. The fix is present in the target's version 4.18.9, which was imported via snapshot commit b1a16b0026 on 2026-09-24. The type check at src/controllers/AssetsController.php:1208-1210 prevents non-string values (objects/arrays) from reaching the vulnerable ImageTransforms::normalizeTransform() method, blocking the RCE attack vector.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "The target repository (craftcms/cms version 4.18.9) is not affected by CVE-2025-32432. The RCE vulnerability, which exploited missing type validation on the transform handle parameter, was fixed in upstream version 4.14.15. The fix is present in the target's version 4.18.9, which was imported via snapshot commit b1a16b0026 on 2026-09-24. The type check at src/controllers/AssetsController.php:1208-1210 prevents non-string values (objects/arrays) from reaching the vulnerable ImageTransforms::normalizeTransform() method, blocking the RCE attack vector." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2025-35939 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is NOT affected by CVE-2025-35939. The vulnerability (storing unsanitized return URLs with arbitrary content/PHP code in session files) is absent because the upstream Craft CMS 4.18.9 release already included the fix. The target's src/web/User.php:473-480 contains a setReturnUrl() method that applies strip_tags() to remove HTML/PHP tags and validates URL schemes before sto...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-35939" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is NOT affected by CVE-2025-35939. The vulnerability (storing unsanitized return URLs with arbitrary content/PHP code in session files) is absent because the upstream Craft CMS 4.18.9 release already included the fix. The target's src/web/User.php:473-480 contains a setReturnUrl() method that applies strip_tags() to remove HTML/PHP tags and validates URL schemes before sto..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2025-46731 is fixed in version 4.18.9-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-46731" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2025-57811 is fixed in version 4.18.9-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-57811" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is NOT vulnerable to CVE-2025-68436. The fix that prevents mass assignment of the photoId attribute was released upstream in Craft CMS version 4.16.17 (December 2025). Version 4.18.9, released September 2026, inherits this fix. The defense code (safeAttributes() method removing 'photoId' from mass-assignable attributes) is present in the target at src/elements/User.php:924...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is NOT vulnerable to CVE-2025-68436. The fix that prevents mass assignment of the photoId attribute was released upstream in Craft CMS version 4.16.17 (December 2025). Version 4.18.9, released September 2026, inherits this fix. The defense code (safeAttributes() method removing 'photoId' from mass-assignable attributes) is present in the target at src/elements/User.php:924..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2025-68437 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 4.18.9 is not affected by CVE-2025-68437 (SSRF via GraphQL save__Asset mutation). The vulnerable pattern is not present because the upstream 4.18.9 release already includes comprehensive SSRF protection via the craftcms/url-validator package. The fix validates URLs and rejects those containing IP addresses or targeting internal resources before any connection is ma...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68437" }, "impact_statement": "not_affected \u2014 Craft CMS version 4.18.9 is not affected by CVE-2025-68437 (SSRF via GraphQL save__Asset mutation). The vulnerable pattern is not present because the upstream 4.18.9 release already includes comprehensive SSRF protection via the craftcms/url-validator package. The fix validates URLs and rejects those containing IP addresses or targeting internal resources before any connection is ma..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2025-68454 is fixed in version 4.18.9-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68454" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. The target version 4.18.9 is not affected by CVE-2025-68455. The vulnerability was fixed by the upstream vendor in version 4.16.17 (released 2025-12-04) via commits that add Component::cleanseConfig() calls to sanitize configuration arrays before object instantiation. Version 4.18.9 (released 2026-09-17) already contains these fixes from the upstream vendor. The fix prevents RCE via malicious Yii2 behaviors by removing \"on \" and \"as \" keys from user-provided configuration arrays, which would otherwise allow attackers to attach malicious behaviors or event handlers to dynamically configured objects.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "The target version 4.18.9 is not affected by CVE-2025-68455. The vulnerability was fixed by the upstream vendor in version 4.16.17 (released 2025-12-04) via commits that add Component::cleanseConfig() calls to sanitize configuration arrays before object instantiation. Version 4.18.9 (released 2026-09-17) already contains these fixes from the upstream vendor. The fix prevents RCE via malicious Yii2 behaviors by removing \"on \" and \"as \" keys from user-provided configuration arrays, which would otherwise allow attackers to attach malicious behaviors or event handlers to dynamically configured objects." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2025-68456 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. The target repository (craftcms/cms version 4.18.9) is NOT AFFECTED by CVE-2025-68456. The upstream vendor fix that prevents unauthenticated database backup triggering is already present in the codebase at src/controllers/UpdaterController.php lines 72-75. This fix was shipped in upstream release 4.18.9 (commit 1718011a5f by brandon@pixelandtonic.com) before TuxCare onboarded the version. The fix adds a precondition check that only allows the actionBackup() method to execute database backups when migrations are pending, effectively preventing the DoS attack via repeated arbitrary backup requests described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68456" }, "impact_statement": "The target repository (craftcms/cms version 4.18.9) is NOT AFFECTED by CVE-2025-68456. The upstream vendor fix that prevents unauthenticated database backup triggering is already present in the codebase at src/controllers/UpdaterController.php lines 72-75. This fix was shipped in upstream release 4.18.9 (commit 1718011a5f by brandon@pixelandtonic.com) before TuxCare onboarded the version. The fix adds a precondition check that only allows the actionBackup() method to execute database backups when migrations are pending, effectively preventing the DoS attack via repeated arbitrary backup requests described in the CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-09T23:03:00.035941+00:00", "status_notes": "Vulnerability CVE-2026-115934 affects version 4.18.9-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115934" }, "action_statement": "Vulnerability CVE-2026-115934 affects version 4.18.9-p3+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-115935 affects version 4.18.9-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115935" }, "action_statement": "Vulnerability CVE-2026-115935 affects version 4.18.9-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-115938 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 The target Craft CMS 4.18.9-p2+tuxcare is NOT AFFECTED by CVE-2026-115938. The vulnerability (Twig sandbox escape in element-search conditions leading to securityKey leakage and RCE) was fixed in upstream Craft CMS 4.17.4 (Feb 11, 2026) via commit 8d4903647d by brandon@pixelandtonic.com, which changed BaseElementSelectConditionRule.php to use renderSandboxedObjectTemplate() instead of the unsan...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-115938" }, "impact_statement": "not_affected \u2014 The target Craft CMS 4.18.9-p2+tuxcare is NOT AFFECTED by CVE-2026-115938. The vulnerability (Twig sandbox escape in element-search conditions leading to securityKey leakage and RCE) was fixed in upstream Craft CMS 4.17.4 (Feb 11, 2026) via commit 8d4903647d by brandon@pixelandtonic.com, which changed BaseElementSelectConditionRule.php to use renderSandboxedObjectTemplate() instead of the unsan..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 4.18.9 is not affected by CVE-2026-25491. While the Twig template does not apply the |e escape filter to entry type names (line 28 of _entrytypes/index.twig), the architecture uses Vue.js client-side rendering with automatic HTML escaping via {{ }} interpolation syntax (App.vue:115,120). Additionally, JSON encoding provides JavaScript context protection. The CVE affects versions 5.0.0...", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Craft CMS 4.18.9 is not affected by CVE-2026-25491. While the Twig template does not apply the |e escape filter to entry type names (line 28 of _entrytypes/index.twig), the architecture uses Vue.js client-side rendering with automatic HTML escaping via {{ }} interpolation syntax (App.vue:115,120). Additionally, JSON encoding provides JavaScript context protection. The CVE affects versions 5.0.0..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-25493 (SSRF via HTTP redirect bypass) is NOT present in craftcms/cms 4.18.9. The target version already contains the upstream vendor fix (RequestOptions::ALLOW_REDIRECTS => false) from Craft CMS 4.16.18+. The vulnerability affected versions 4.0.0-RC1 through 4.16.17; target version 4.18.9 is beyond the patched threshold. The fix was implemented by Pixel & Tonic (upstream vendor) in com...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 CVE-2026-25493 (SSRF via HTTP redirect bypass) is NOT present in craftcms/cms 4.18.9. The target version already contains the upstream vendor fix (RequestOptions::ALLOW_REDIRECTS => false) from Craft CMS 4.16.18+. The vulnerability affected versions 4.0.0-RC1 through 4.16.17; target version 4.18.9 is beyond the patched threshold. The fix was implemented by Pixel & Tonic (upstream vendor) in com..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-25494 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is not affected by CVE-2026-25494. The vulnerability (hex-encoded IP bypass in saveAsset GraphQL mutation) was fixed in upstream version 4.16.18 (Jan 2026). TuxCare's snapshot of 4.18.9 (Sep 2026) already includes the fix via the craftcms/url-validator package v1.0.0, which contains hex-to-decimal normalization and cloud metadata blocklists. The vulnerable pattern (relying...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is not affected by CVE-2026-25494. The vulnerability (hex-encoded IP bypass in saveAsset GraphQL mutation) was fixed in upstream version 4.16.18 (Jan 2026). TuxCare's snapshot of 4.18.9 (Sep 2026) already includes the fix via the craftcms/url-validator package v1.0.0, which contains hex-to-decimal normalization and cloud metadata blocklists. The vulnerable pattern (relying..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. The target (craftcms/cms v4.18.9) is NOT AFFECTED by CVE-2026-25495. The SQL injection vulnerability described in the CVE has been fixed by the upstream vendor (Pixel & Tonic) in version 4.17.4. The fix was already present when TuxCare onboarded version 4.18.9. The defense mechanism `ElementHelper::cleanseQueryCriteria()` removes dangerous SQL clause parameters (orderBy, where, select, from, groupBy, join, having, union, withQueries, params) from user-supplied criteria before database query construction, preventing arbitrary SQL injection. This is an upstream vendor fix, not a TuxCare backport, hence verdict is not_affected rather than already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "The target (craftcms/cms v4.18.9) is NOT AFFECTED by CVE-2026-25495. The SQL injection vulnerability described in the CVE has been fixed by the upstream vendor (Pixel & Tonic) in version 4.17.4. The fix was already present when TuxCare onboarded version 4.18.9. The defense mechanism `ElementHelper::cleanseQueryCriteria()` removes dangerous SQL clause parameters (orderBy, where, select, from, groupBy, join, having, union, withQueries, params) from user-supplied criteria before database query construction, preventing arbitrary SQL injection. This is an upstream vendor fix, not a TuxCare backport, hence verdict is not_affected rather than already_fixed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-25496 is NOT present in Craft CMS 4.18.9. The stored XSS vulnerability in Number field prefix/suffix rendering has been fixed by the upstream vendor. The target's Number/input.twig template includes the security fix (encode=true parameter added to the md filter on lines 28 and 43), which HTML-encodes prefix/suffix values before Markdown processing, preventing script injection. This fix...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 CVE-2026-25496 is NOT present in Craft CMS 4.18.9. The stored XSS vulnerability in Number field prefix/suffix rendering has been fixed by the upstream vendor. The target's Number/input.twig template includes the security fix (encode=true parameter added to the md filter on lines 28 and 43), which HTML-encodes prefix/suffix values before Markdown processing, preventing script injection. This fix..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. CVE-2026-25498 (GHSA-7jx7-3846-m7w7) is NOT present in the target. The vulnerability affects Craft CMS versions 4.0.0-RC1 through 4.16.17, where assembleLayoutFromPost() in src/services/Fields.php fails to sanitize user-supplied configuration data, allowing RCE via Yii2 behavior injection. The fix was released in upstream Craft CMS 4.16.18 (2026-01-09), adding ComponentHelper::cleanseConfig() to remove malicious \"on \" and \"as \" prefixed configuration keys. The target version 4.18.9 (released 2026-09-17) already includes this upstream fix. Analysis confirmed the fix is present at Fields.php:1286, and it was imported during the snapshot/onboarding of version 4.18.9, not added by TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "CVE-2026-25498 (GHSA-7jx7-3846-m7w7) is NOT present in the target. The vulnerability affects Craft CMS versions 4.0.0-RC1 through 4.16.17, where assembleLayoutFromPost() in src/services/Fields.php fails to sanitize user-supplied configuration data, allowing RCE via Yii2 behavior injection. The fix was released in upstream Craft CMS 4.16.18 (2026-01-09), adding ComponentHelper::cleanseConfig() to remove malicious \"on \" and \"as \" prefixed configuration keys. The target version 4.18.9 (released 2026-09-17) already includes this upstream fix. Analysis confirmed the fix is present at Fields.php:1286, and it was imported during the snapshot/onboarding of version 4.18.9, not added by TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 contains the complete XSS fix that was released upstream in Craft CMS 4.16.19. The fix includes three defenses: (1) a typeOptions() whitelist excluding 'html' as a valid column type, (2) validateColumns() that rejects unsupported column types and defaults them to 'singleline', and (3) HTML encoding of 'heading' column values in _getInputHtml(). All three fixes are present ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 contains the complete XSS fix that was released upstream in Craft CMS 4.16.19. The fix includes three defenses: (1) a typeOptions() whitelist excluding 'html' as a valid column type, (2) validateColumns() that rejects unsupported column types and defaults them to 'singleline', and (3) HTML encoding of 'heading' column values in _getInputHtml(). All three fixes are present ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-27127 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. Target version 4.18.9 is NOT AFFECTED by CVE-2026-27127 (DNS rebinding TOCTOU SSRF vulnerability). The upstream Craft CMS 4.18.9 release already contains the complete DNS pinning fix that prevents DNS rebinding attacks. The fix implements both CURLOPT_RESOLVE to pin DNS resolution and ON_STATS callback to validate the actual connected IP, eliminating the TOCTOU vulnerability between validation and request.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27127" }, "impact_statement": "Target version 4.18.9 is NOT AFFECTED by CVE-2026-27127 (DNS rebinding TOCTOU SSRF vulnerability). The upstream Craft CMS 4.18.9 release already contains the complete DNS pinning fix that prevents DNS rebinding attacks. The fix implements both CURLOPT_RESOLVE to pin DNS resolution and ON_STATS callback to validate the actual connected IP, eliminating the TOCTOU vulnerability between validation and request." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.9) is NOT AFFECTED by CVE-2026-27128. The TOCTOU race condition vulnerability in token validation has already been fixed by the upstream vendor. The fix (mutex-based synchronization wrapping the read-check-update sequence in getTokenRoute()) was included in upstream release 4.16.19 and is present in the target's version 4.18.9. TuxCare onboarded version 4.18.9 via sna...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.9) is NOT AFFECTED by CVE-2026-27128. The TOCTOU race condition vulnerability in token validation has already been fixed by the upstream vendor. The fix (mutex-based synchronization wrapping the read-check-update sequence in getTokenRoute()) was included in upstream release 4.16.19 and is present in the target's version 4.18.9. TuxCare onboarded version 4.18.9 via sna..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-27129 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-27129 describes an IPv6 bypass vulnerability in Craft CMS versions that use inline SSRF validation with gethostbyname(), which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, gethostbyname() returns the hostname string unchanged, bypassing IP blocklist checks. However, the target (version 4.18.9) uses a fundamentally different architecture: it delegates all ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27129" }, "impact_statement": "not_affected \u2014 CVE-2026-27129 describes an IPv6 bypass vulnerability in Craft CMS versions that use inline SSRF validation with gethostbyname(), which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, gethostbyname() returns the hostname string unchanged, bypassing IP blocklist checks. However, the target (version 4.18.9) uses a fundamentally different architecture: it delegates all ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. CVE-2026-31857 affects Craft CMS versions prior to 4.17.4 and 5.9.9. The target is version 4.18.9, which already contains the upstream fix. The vulnerable code in BaseElementSelectConditionRule::getElementId() that used unsandboxed renderObjectTemplate() has been replaced with renderSandboxedObjectTemplate(). The complete Twig sandbox infrastructure with SecurityPolicy allowlist enforcement is present. The fix was shipped in upstream version 4.17.4 (released 2026-02-11), seven months before the target's base version 4.18.9 (released 2026-09-17).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "CVE-2026-31857 affects Craft CMS versions prior to 4.17.4 and 5.9.9. The target is version 4.18.9, which already contains the upstream fix. The vulnerable code in BaseElementSelectConditionRule::getElementId() that used unsandboxed renderObjectTemplate() has been replaced with renderSandboxedObjectTemplate(). The complete Twig sandbox infrastructure with SecurityPolicy allowlist enforcement is present. The fix was shipped in upstream version 4.17.4 (released 2026-02-11), seven months before the target's base version 4.18.9 (released 2026-09-17)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. CVE-2026-31858 affects ElementSearchController::actionSearch(), which does not exist in Craft CMS 4.18.9. ElementSearchController was introduced in version 5.8.0 (April 2026), while the target is version 4.18.9 from the 4.x release line. The vulnerable component is not present in this version. Additionally, ElementIndexesController (the only controller in 4.18.9 that processes user-supplied criteria parameters from HTTP requests) applies the cleanseQueryCriteria() defense, which removes dangerous SQL-construction attributes (where, orderBy, select, join, having, union, params) before passing criteria to query configuration.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "CVE-2026-31858 affects ElementSearchController::actionSearch(), which does not exist in Craft CMS 4.18.9. ElementSearchController was introduced in version 5.8.0 (April 2026), while the target is version 4.18.9 from the 4.x release line. The vulnerable component is not present in this version. Additionally, ElementIndexesController (the only controller in 4.18.9 that processes user-supplied criteria parameters from HTTP requests) applies the cleanseQueryCriteria() defense, which removes dangerous SQL-construction attributes (where, orderBy, select, join, having, union, params) before passing criteria to query configuration." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-31859 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 4.18.9) is NOT affected by CVE-2026-31859. The vulnerability pattern (accepting dangerous URL schemes like `javascript:` in return URLs) is not present because the upstream vendor fixed it in commit cc9921c148 (Feb 6, 2026) before the 4.18.9 release. TuxCare onboarded version 4.18.9 on Oct 3, 2026, which already contained the fix. The setReturnUrl() method at sr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31859" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 4.18.9) is NOT affected by CVE-2026-31859. The vulnerability pattern (accepting dangerous URL schemes like `javascript:` in return URLs) is not present because the upstream vendor fixed it in commit cc9921c148 (Feb 6, 2026) before the 4.18.9 release. TuxCare onboarded version 4.18.9 on Oct 3, 2026, which already contained the fix. The setReturnUrl() method at sr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS version 4.18.9) is NOT affected by CVE-2026-32262. The vulnerability, a path traversal issue in the AssetsController->replaceFile() method allowing authenticated users to delete arbitrary files via the targetFilename parameter, was fixed in upstream version 4.17.5. The target version 4.18.9 is a later release that already contains the complete upstream fix. The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS version 4.18.9) is NOT affected by CVE-2026-32262. The vulnerability, a path traversal issue in the AssetsController->replaceFile() method allowing authenticated users to delete arbitrary files via the targetFilename parameter, was fixed in upstream version 4.17.5. The target version 4.18.9 is a later release that already contains the complete upstream fix. The ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. Version 4.18.9 is not affected by CVE-2026-32263. The vulnerability exists in EntryTypesController.php::actionApplyOverrideSettings(), which was introduced in Craft CMS version 5.0 (commit 0885de776b \"Globalize entry types\"). This file and method do not exist in version 4.x. In version 4.18.9, entry type functionality is handled in SectionsController.php using manual property assignment rather than bulk configuration via Craft::configure(). All uses of Craft::configure() with HTTP request data in version 4.x controllers are protected by Component::cleanseConfig(), preventing Yii2 behavior/event handler injection. The vulnerable architectural pattern (parse_str \u2192 unsanitized array \u2192 Craft::configure) that enables the attack does not exist in this version.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "Version 4.18.9 is not affected by CVE-2026-32263. The vulnerability exists in EntryTypesController.php::actionApplyOverrideSettings(), which was introduced in Craft CMS version 5.0 (commit 0885de776b \"Globalize entry types\"). This file and method do not exist in version 4.x. In version 4.18.9, entry type functionality is handled in SectionsController.php using manual property assignment rather than bulk configuration via Craft::configure(). All uses of Craft::configure() with HTTP request data in version 4.x controllers are protected by Component::cleanseConfig(), preventing Yii2 behavior/event handler injection. The vulnerable architectural pattern (parse_str \u2192 unsanitized array \u2192 Craft::configure) that enables the attack does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. Target version 4.18.9 is not affected by CVE-2026-32264 (GHSA-4484-8v2f-5748). The RCE vulnerability in ElementIndexesController and FieldsController was fixed by the upstream vendor (Pixel & Tonic) in version 4.17.5 (released February 2026). The target version 4.18.9 (released September 2026) already includes these security fixes as part of the upstream release that TuxCare onboarded. Both vulnerable code paths now properly sanitize configuration arrays with Component::cleanseConfig() before object instantiation, preventing the behavior injection attack.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "Target version 4.18.9 is not affected by CVE-2026-32264 (GHSA-4484-8v2f-5748). The RCE vulnerability in ElementIndexesController and FieldsController was fixed by the upstream vendor (Pixel & Tonic) in version 4.17.5 (released February 2026). The target version 4.18.9 (released September 2026) already includes these security fixes as part of the upstream release that TuxCare onboarded. Both vulnerable code paths now properly sanitize configuration arrays with Component::cleanseConfig() before object instantiation, preventing the behavior injection attack." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. Target version 4.18.9 is not affected by CVE-2026-32267. The vulnerability was fixed in upstream version 4.17.6, and the target version 4.18.9 (released after 4.17.6) already contains the complete security fix. The fix prevents privilege escalation by enforcing route-specific token validation: tokens are now bound to specific routes and cannot be reused to access unintended endpoints like UsersController->actionImpersonateWithToken.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "Target version 4.18.9 is not affected by CVE-2026-32267. The vulnerability was fixed in upstream version 4.17.6, and the target version 4.18.9 (released after 4.17.6) already contains the complete security fix. The fix prevents privilege escalation by enforcing route-specific token validation: tokens are now bound to specific routes and cannot be reused to access unintended endpoints like UsersController->actionImpersonateWithToken." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.9 is NOT affected by CVE-2026-33051. The vulnerability exists in versions 5.9.0-beta.1 through 5.9.10 due to Template::raw() bypassing Twig's auto-escaping when rendering unencoded creator names. Version 4.18.9 uses a fundamentally different architecture (Twig templates with automatic HTML escaping) that was refactored into the vulnerable PHP-generated approach starting in version ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Version 4.18.9 is NOT affected by CVE-2026-33051. The vulnerability exists in versions 5.9.0-beta.1 through 5.9.10 due to Template::raw() bypassing Twig's auto-escaping when rendering unencoded creator names. Version 4.18.9 uses a fundamentally different architecture (Twig templates with automatic HTML escaping) that was refactored into the vulnerable PHP-generated approach starting in version ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. Craft CMS version 4.18.9 is not affected by CVE-2026-33157. The specific vulnerability (unsanitized fieldLayouts parameter in ElementIndexesController::actionFilterHud() passed to FieldLayout::createFromConfig()) does not exist in this version. The actionFilterHud() method in 4.18.9 only processes conditionConfig parameters (which ARE sanitized at line 421), and has no fieldLayouts parameter handling at all. The vulnerable code path introduced in Craft 5.6.0 is architecturally absent from the 4.x branch. All HTTP-accessible entry points that process field layout configurations call Component::cleanseConfig() before passing data to object creation methods.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "Craft CMS version 4.18.9 is not affected by CVE-2026-33157. The specific vulnerability (unsanitized fieldLayouts parameter in ElementIndexesController::actionFilterHud() passed to FieldLayout::createFromConfig()) does not exist in this version. The actionFilterHud() method in 4.18.9 only processes conditionConfig parameters (which ARE sanitized at line 421), and has no fieldLayouts parameter handling at all. The vulnerable code path introduced in Craft 5.6.0 is architecturally absent from the 4.x branch. All HTTP-accessible entry points that process field layout configurations call Component::cleanseConfig() before passing data to object creation methods." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS version 4.18.9) is not affected by CVE-2026-33158. This vulnerability affects Craft CMS versions 4.0.0-RC1 through 4.17.7, allowing low-privileged authenticated users to read private asset content by calling the assets/edit-image endpoint with arbitrary assetIds without proper authorization checks. The vulnerability was fixed in upstream version 4.17.8 by adding...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS version 4.18.9) is not affected by CVE-2026-33158. This vulnerability affects Craft CMS versions 4.0.0-RC1 through 4.17.7, allowing low-privileged authenticated users to read private asset content by calling the assets/edit-image endpoint with arbitrary assetIds without proper authorization checks. The vulnerability was fixed in upstream version 4.17.8 by adding..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-33159 affects Craft CMS 4.0.0-RC1 to before 4.17.8, allowing unauthenticated users to execute privileged Config Sync operations. The target repository is at version 4.18.9, which includes the upstream fix released in 4.17.8. The ConfigSyncController contains the required authentication gates ($allowAnonymous=ALLOW_ANONYMOUS_NEVER and requireAdmin() in beforeAction hook) that block all ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 CVE-2026-33159 affects Craft CMS 4.0.0-RC1 to before 4.17.8, allowing unauthenticated users to execute privileged Config Sync operations. The target repository is at version 4.18.9, which includes the upstream fix released in 4.17.8. The ConfigSyncController contains the required authentication gates ($allowAnonymous=ALLOW_ANONYMOUS_NEVER and requireAdmin() in beforeAction hook) that block all ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-33160 affects Craft CMS versions 4.0.0-RC1 to before 4.17.8. The target version 4.18.9 already contains the upstream vendor's fix (requirePermission('accessCp') check at line 1205 of AssetsController.php) that prevents unauthorized access to asset transform generation. The fix was shipped in upstream release 4.18.9 before TuxCare onboarded this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 CVE-2026-33160 affects Craft CMS versions 4.0.0-RC1 to before 4.17.8. The target version 4.18.9 already contains the upstream vendor's fix (requirePermission('accessCp') check at line 1205 of AssetsController.php) that prevents unauthorized access to asset transform generation. The fix was shipped in upstream release 4.18.9 before TuxCare onboarded this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-33161 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 The target repository (craftcms/cms version 4.18.9, SHA 018c9bb626) is NOT AFFECTED by CVE-2026-33161. The vulnerability\u2014an authorization bypass allowing low-privileged users to access private asset metadata via the assets/image-editor endpoint\u2014was fixed by the upstream vendor (Craft CMS) in commit d30df31122 on February 25, 2026. This fix was included in version 4.17.8 and all subsequent relea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "not_affected \u2014 The target repository (craftcms/cms version 4.18.9, SHA 018c9bb626) is NOT AFFECTED by CVE-2026-33161. The vulnerability\u2014an authorization bypass allowing low-privileged users to access private asset metadata via the assets/image-editor endpoint\u2014was fixed by the upstream vendor (Craft CMS) in commit d30df31122 on February 25, 2026. This fix was included in version 4.17.8 and all subsequent relea..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 4.18.9 is NOT affected by CVE-2026-33162. The vulnerability concerns an authorization bypass in the \"move entry to section\" feature that allows users with only accessCp permission to move entries between sections without saveEntries permission. This feature was introduced in version 5.3.0 (commit e75a51a266) and does not exist in version 4.18.9. Git ancestry verification confi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 Craft CMS version 4.18.9 is NOT affected by CVE-2026-33162. The vulnerability concerns an authorization bypass in the \"move entry to section\" feature that allows users with only accessCp permission to move entries between sections without saveEntries permission. This feature was introduced in version 5.3.0 (commit e75a51a266) and does not exist in version 4.18.9. Git ancestry verification confi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.9 is not affected by CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset mutations). The upstream vendor refactored asset upload URL validation to use the craftcms/url-validator package (commit 26268c0210, June 2026), which validates URL schemes and blocks dangerous protocols (gopher, file, ftp, etc.) before any connection is opened. This fix was already present in the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "not_affected \u2014 Version 4.18.9 is not affected by CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset mutations). The upstream vendor refactored asset upload URL validation to use the craftcms/url-validator package (commit 26268c0210, June 2026), which validates URL schemes and blocks dangerous protocols (gopher, file, ftp, etc.) before any connection is opened. This fix was already present in the..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 The target version 4.18.9 is NOT AFFECTED by CVE-2026-41130 (GHSA-95wr-3f2v-v2wh). The vulnerable `actionResourceJs()` method in `src/controllers/AppController.php` does not exist in this version. Upstream Craft CMS removed this endpoint entirely in version 4.18.0 (released May 13, 2026), which predates TuxCare's onboarding of version 4.18.9. The SSRF attack chain is broken at the INPUT stage b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target version 4.18.9 is NOT AFFECTED by CVE-2026-41130 (GHSA-95wr-3f2v-v2wh). The vulnerable `actionResourceJs()` method in `src/controllers/AppController.php` does not exist in this version. Upstream Craft CMS removed this endpoint entirely in version 4.18.0 (released May 13, 2026), which predates TuxCare's onboarding of version 4.18.9. The SSRF attack chain is broken at the INPUT stage b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-55790 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. CVE-2026-55790 XSS vulnerability in CraftSupport widget is NOT present in target version 4.18.9. The fix was included in upstream release 4.17.16 (2026-05-11) and is present at both vulnerable locations: (1) line 382 uses Craft.escapeHtml() to escape GitHub issue titles before rendering, and (2) lines 555-557 use jQuery's text: option for error messages. The target version 4.18.9 (released 2026-09-17) includes this upstream vendor fix. TuxCare onboarded the already-fixed version via snapshot commit b1a16b0026.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55790" }, "impact_statement": "CVE-2026-55790 XSS vulnerability in CraftSupport widget is NOT present in target version 4.18.9. The fix was included in upstream release 4.17.16 (2026-05-11) and is present at both vulnerable locations: (1) line 382 uses Craft.escapeHtml() to escape GitHub issue titles before rendering, and (2) lines 555-557 use jQuery's text: option for error messages. The target version 4.18.9 (released 2026-09-17) includes this upstream vendor fix. TuxCare onboarded the already-fixed version via snapshot commit b1a16b0026." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-55793 is fixed in version 4.18.9-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55793" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.9 is not affected by CVE-2026-56381. While the code has missing |e filters in some Twig templates (src/templates/settings/users/groups/_index.twig line 29), three layers of ambient framework defenses provide comprehensive protection: (1) Twig's default HTML auto-escaping for server-side rendering, (2) JSON string escaping preventing JavaScript injection, and (3) Vue's mustache inte...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Version 4.18.9 is not affected by CVE-2026-56381. While the code has missing |e filters in some Twig templates (src/templates/settings/users/groups/_index.twig line 29), three layers of ambient framework defenses provide comprehensive protection: (1) Twig's default HTML auto-escaping for server-side rendering, (2) JSON string escaping preventing JavaScript injection, and (3) Vue's mustache inte..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-56382 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. Target version 4.18.9 is NOT affected by CVE-2026-56382. The vulnerable method actionRenderCardPreview() was introduced in version 5.5.0, after this version. The CVE's stated affected range (>= 5.5.0 and <= 5.9.13) correctly excludes version 4.18.9. No alternative vulnerable code path exists in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56382" }, "impact_statement": "Target version 4.18.9 is NOT affected by CVE-2026-56382. The vulnerable method actionRenderCardPreview() was introduced in version 5.5.0, after this version. The CVE's stated affected range (>= 5.5.0 and <= 5.9.13) correctly excludes version 4.18.9. No alternative vulnerable code path exists in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-56383 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 The target Craft CMS 4.18.9 is NOT AFFECTED by CVE-2026-56383 (stored XSS in Table field row headings). The vulnerability was fixed by the upstream vendor (Pixel & Tonic) in version 4.16.19, and this fix is present in version 4.18.9. The fix HTML-encodes heading cell values in _getInputHtml() before rendering, preventing XSS. The vulnerable pattern does not exist in the target because the upstr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56383" }, "impact_statement": "not_affected \u2014 The target Craft CMS 4.18.9 is NOT AFFECTED by CVE-2026-56383 (stored XSS in Table field row headings). The vulnerability was fixed by the upstream vendor (Pixel & Tonic) in version 4.16.19, and this fix is present in version 4.18.9. The fix HTML-encodes heading cell values in _getInputHtml() before rendering, preventing XSS. The vulnerable pattern does not exist in the target because the upstr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-56384 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-56384 affects Craft CMS versions >= 4.0.0-RC1, <= 4.17.7, and was fixed in 4.17.8. The target repository is at version 4.18.9, which already contains the upstream vendor fix. The vulnerability involved missing authorization checks in the assets/preview-thumb and assets/preview-file endpoints. Both methods now include requireVolumePermissionByAsset() and requirePeerVolumePermissionByAss...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56384" }, "impact_statement": "not_affected \u2014 CVE-2026-56384 affects Craft CMS versions >= 4.0.0-RC1, <= 4.17.7, and was fixed in 4.17.8. The target repository is at version 4.18.9, which already contains the upstream vendor fix. The vulnerability involved missing authorization checks in the assets/preview-thumb and assets/preview-file endpoints. Both methods now include requireVolumePermissionByAsset() and requirePeerVolumePermissionByAss..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-56385 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is not affected by CVE-2026-56385. The vulnerability affects Craft CMS versions <= 4.17.7, with the fix released in 4.17.8. Version 4.18.9 already includes the upstream fix (permission checks in actionPreviewFile method at lines 1258-1259) that was shipped in the upstream release before TuxCare onboarded this version. The authorization bypass vulnerability pattern is not p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56385" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is not affected by CVE-2026-56385. The vulnerability affects Craft CMS versions <= 4.17.7, with the fix released in 4.17.8. Version 4.18.9 already includes the upstream fix (permission checks in actionPreviewFile method at lines 1258-1259) that was shipped in the upstream release before TuxCare onboarded this version. The authorization bypass vulnerability pattern is not p..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-08T14:16:00.068422+00:00", "status_notes": "Vulnerability CVE-2026-56393 affects version 4.18.9-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56393" }, "action_statement": "Vulnerability CVE-2026-56393 affects version 4.18.9-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 4.18.9-p3+tuxcare of craftcms/cms. Target version 4.18.9 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint was fixed in upstream Craft CMS version 4.17.5 (released 2026-02-17), and version 4.18.9 (released 2026-09-17) inherits this fix. All three entry points (iconUrl, iconPath, iconSvg) validate the extension parameter using regex /^\\w+$/ to reject path traversal sequences before constructing file paths.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "Target version 4.18.9 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint was fixed in upstream Craft CMS version 4.17.5 (released 2026-02-17), and version 4.18.9 (released 2026-09-17) inherits this fix. All three entry points (iconUrl, iconPath, iconSvg) validate the extension parameter using regex /^\\w+$/ to reject path traversal sequences before constructing file paths." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p3+tuxcare" } } ], "timestamp": "2026-11-04T15:43:56.805169+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 4.18.9-p3+tuxcare of craftcms/cms. not_affected \u2014 The XSS vulnerability (GHSA-wf98-vxv9-jqfv) in the Feeds widget is NOT present in the target. The fix was already included in upstream Craft CMS 4.18.9 when TuxCare onboarded it. The vulnerability allowed malicious javascript: URLs in feed item permalinks to execute XSS. The upstream fix (originally applied in Craft 3.7.29 by brandon@pixelandtonic.com) adds a regex filter rejecting any permalin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The XSS vulnerability (GHSA-wf98-vxv9-jqfv) in the Feeds widget is NOT present in the target. The fix was already included in upstream Craft CMS 4.18.9 when TuxCare onboarded it. The vulnerability allowed malicious javascript: URLs in feed item permalinks to execute XSS. The upstream fix (originally applied in Craft 3.7.29 by brandon@pixelandtonic.com) adds a regex filter rejecting any permalin..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 is an XSS vulnerability in Craft CMS allowing malicious script execution via uploaded HTML files. The vendor patch (commit 8ee85a8f03c143fa2420e7d6f311d95cae3b19ce, Jan 2021) removed 'htm' and 'html' from the default allowedFileExtensions array in src/config/GeneralConfig.php. Analysis of the target repository (craftcms/cms 4.18.9-p1+tuxcare at SHA 9f8c824e72) confirms the allowe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 is an XSS vulnerability in Craft CMS allowing malicious script execution via uploaded HTML files. The vendor patch (commit 8ee85a8f03c143fa2420e7d6f311d95cae3b19ce, Jan 2021) removed 'htm' and 'html' from the default allowedFileExtensions array in src/config/GeneralConfig.php. Analysis of the target repository (craftcms/cms 4.18.9-p1+tuxcare at SHA 9f8c824e72) confirms the allowe..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 4.18.9-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 4.18.9-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is not affected by CVE-2021-32470. The vulnerability (XSS via unescaped prompt input in FieldLayoutDesigner.js) was fixed in upstream Craft CMS 3.6.13. Version 4.18.9 inherited this fix from upstream - the code at src/web/assets/cp/src/js/FieldLayoutDesigner.js:150-151 properly wraps the prompt() result with Craft.escapeHtml() before DOM insertion, preventing the XSS attac...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is not affected by CVE-2021-32470. The vulnerability (XSS via unescaped prompt input in FieldLayoutDesigner.js) was fixed in upstream Craft CMS 3.6.13. Version 4.18.9 inherited this fix from upstream - the code at src/web/assets/cp/src/js/FieldLayoutDesigner.js:150-151 properly wraps the prompt() result with Craft.escapeHtml() before DOM insertion, preventing the XSS attac..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 4.18.9-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 4.18.9-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is an XSS vulnerability in Craft CMS FeedWidget where malicious feed data with javascript: URLs in permalink fields could execute arbitrary JavaScript. The fix validates that permalinks start with http:// or https:// before processing. Target version 4.18.9 already contains this fix - it was present in the upstream release when TuxCare onboarded it. The vulnerable pattern (unvali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is an XSS vulnerability in Craft CMS FeedWidget where malicious feed data with javascript: URLs in permalink fields could execute arbitrary JavaScript. The fix validates that permalinks start with http:// or https:// before processing. Target version 4.18.9 already contains this fix - it was present in the upstream release when TuxCare onboarded it. The vulnerable pattern (unvali..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-11-04T15:44:49.610847+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 4.18.9-p2+tuxcare of craftcms/cms, and is fixed in 4.18.9-p3+tuxcare.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 4.18.9-p2+tuxcare of craftcms/cms, and is fixed in 4.18.9-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS version 4.2.0.1. The target is running version 4.18.9, which already contains all the XSS fixes from the upstream vendor. The vulnerability pattern (unescaped HTML rendering of user-controlled strings) is not present in the target because HTML encoding (`Html::encode()`, Twig `|e` filter, `Craft.escapeHtml()`) has been applied to all affected f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS version 4.2.0.1. The target is running version 4.18.9, which already contains all the XSS fixes from the upstream vendor. The vulnerability pattern (unescaped HTML rendering of user-controlled strings) is not present in the target because HTML encoding (`Html::encode()`, Twig `|e` filter, `Craft.escapeHtml()`) has been applied to all affected f..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 4.18.9-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 4.18.9-p2+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 4.18.9-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 4.18.9-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-30177 affects CraftCMS prior to version 3.7.68 due to XSS via unencoded volume name output. The target version 4.18.9-p1+tuxcare is NOT vulnerable. The fix was already present in the upstream 4.18.9 release when TuxCare onboarded it. Both output locations use HTML encoding: src/elements/Asset.php line 2804 applies Html::encode() directly, and line 1424 breadcrumbs are auto-encoded by t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 CVE-2023-30177 affects CraftCMS prior to version 3.7.68 due to XSS via unencoded volume name output. The target version 4.18.9-p1+tuxcare is NOT vulnerable. The fix was already present in the upstream 4.18.9 release when TuxCare onboarded it. Both output locations use HTML encoding: src/elements/Asset.php line 2804 applies Html::encode() directly, and line 1424 breadcrumbs are auto-encoded by t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:40:54.166658+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-31144 (XSS via malformed feed widget titles) is NOT present in CraftCMS 4.18.9-p1+tuxcare. The vulnerability required JSON_UNESCAPED_SLASHES flag to be set, allowing unescaped forward slashes in JSON output that could break out of script contexts (e.g., via \"\" in feed titles). The upstream vendor (Pixel & Tonic) fixed this by removing JSON_UNESCAPED_SLASHES from the default en...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "not_affected \u2014 CVE-2023-31144 (XSS via malformed feed widget titles) is NOT present in CraftCMS 4.18.9-p1+tuxcare. The vulnerability required JSON_UNESCAPED_SLASHES flag to be set, allowing unescaped forward slashes in JSON output that could break out of script contexts (e.g., via \"\" in feed titles). The upstream vendor (Pixel & Tonic) fixed this by removing JSON_UNESCAPED_SLASHES from the default en..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is not present in the target. The fix was authored by brandon@pixelandtonic.com (Pixel & Tonic - upstream vendor) on April 3, 2023 in commit 9d0cd0bda7, and shipped with upstream Craft CMS 4.18.9. TuxCare onboarded version 4.18.9 on October 3, 2026, which already contained the fix. The vulnerable pattern (HTML string concatenation) is...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is not present in the target. The fix was authored by brandon@pixelandtonic.com (Pixel & Tonic - upstream vendor) on April 3, 2023 in commit 9d0cd0bda7, and shipped with upstream Craft CMS 4.18.9. TuxCare onboarded version 4.18.9 on October 3, 2026, which already contained the fix. The vulnerable pattern (HTML string concatenation) is..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2023-33495 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33495 (HTML injection in Craft CMS through 4.4.9) is not present in version 4.18.9. The vulnerable pattern (unsafe HTML rendering of exporter names via `html: option.label` in UI.js) was fixed by upstream vendor Pixel & Tonic in commit 57334cd435 (2026-01-04). The fix uses jQuery's `.text()` method which safely escapes HTML. This fix was already present in the upstream 4.18.9 release w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33495" }, "impact_statement": "not_affected \u2014 CVE-2023-33495 (HTML injection in Craft CMS through 4.4.9) is not present in version 4.18.9. The vulnerable pattern (unsafe HTML rendering of exporter names via `html: option.label` in UI.js) was fixed by upstream vendor Pixel & Tonic in commit 57334cd435 (2026-01-04). The fix uses jQuery's `.text()` method which safely escapes HTML. This fix was already present in the upstream 4.18.9 release w..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:38:58.002135+00:00", "status_notes": "Vulnerability CVE-2023-36260 is a false positive for craftcms/cms 4.18.9-p2+tuxcare. CVE-2023-36260 is a false positive for this repository. The CVE describes a DoS vulnerability in the Feed-Me plugin (craftcms/feed-me) related to saving feeds with asset element types and no volume selected. This repository is craftcms/cms (Craft CMS core version 4.18.9), which does not include, vendor, or depend on the Feed-Me plugin. The Feed-Me plugin is a separate package for content import functionality. The core CMS contains only a simple Feed widget for displaying RSS feeds, which lacks the asset/volume functionality described in the CVE.", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "CVE-2023-36260 is a false positive for this repository. The CVE describes a DoS vulnerability in the Feed-Me plugin (craftcms/feed-me) related to saving feeds with asset element types and no volume selected. This repository is craftcms/cms (Craft CMS core version 4.18.9), which does not include, vendor, or depend on the Feed-Me plugin. The Feed-Me plugin is a separate package for content import functionality. The core CMS contains only a simple Feed widget for displaying RSS feeds, which lacks the asset/volume functionality described in the CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2023-40035 affects version 4.18.9-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-40035" }, "action_statement": "Vulnerability CVE-2023-40035 affects version 4.18.9-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2024-21622 describes a privilege escalation vulnerability in Craft CMS that was fixed in versions 4.4.16 and 3.9.6. The target is running Craft CMS 4.18.9, which is significantly newer than the fixed version. Analysis confirms both security patches are present in the target code: (1) ElementsController.php implements double authorization checks before and after applying POST parameters, and...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "not_affected \u2014 CVE-2024-21622 describes a privilege escalation vulnerability in Craft CMS that was fixed in versions 4.4.16 and 3.9.6. The target is running Craft CMS 4.18.9, which is significantly newer than the fixed version. Analysis confirms both security patches are present in the target code: (1) ElementsController.php implements double authorization checks before and after applying POST parameters, and..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 4.18.9-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 4.18.9-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 4.18.9 is not affected by CVE-2024-41800. The vulnerability concerns TOTP token reuse in Craft CMS 5's two-factor authentication system. TOTP authentication functionality was introduced in Craft CMS 5 and does not exist in Craft 4. The target repository contains no TOTP implementation code, no Google2FA dependency, no authenticator database tables, and no TOTP verification methods. Th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 4.18.9 is not affected by CVE-2024-41800. The vulnerability concerns TOTP token reuse in Craft CMS 5's two-factor authentication system. TOTP authentication functionality was introduced in Craft CMS 5 and does not exist in Craft 4. The target repository contains no TOTP implementation code, no Google2FA dependency, no authenticator database tables, and no TOTP verification methods. Th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2024-52291 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. CVE-2024-52291 is NOT present in CraftCMS 4.18.9. The vulnerability involved bypassing local filesystem validation using double file:// schemes (e.g., file://file:////), but the upstream fix was already included in version 4.18.9 when TuxCare onboarded it. The vulnerable code pattern (StringHelper::removeLeft) was replaced with a secure regex pattern that removes all consecutive file:// prefixes.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52291" }, "impact_statement": "CVE-2024-52291 is NOT present in CraftCMS 4.18.9. The vulnerability involved bypassing local filesystem validation using double file:// schemes (e.g., file://file:////), but the upstream fix was already included in version 4.18.9 when TuxCare onboarded it. The vulnerable code pattern (StringHelper::removeLeft) was replaced with a secure regex pattern that removes all consecutive file:// prefixes." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2024-52292 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. The target repository (Craft CMS 4.18.9) is NOT affected by CVE-2024-52292. The vulnerability pattern\u2014unrestricted absolute file path reading via the dataUrl() function\u2014is not present. The fix (path containment validation at src/helpers/Html.php:995-999) was included in upstream Craft CMS 4.18.9 before TuxCare onboarded the version on 2026-09-24. The snapshot commit imported the already-fixed codebase, and no subsequent modifications were made to the dataUrl() function on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52292" }, "impact_statement": "The target repository (Craft CMS 4.18.9) is NOT affected by CVE-2024-52292. The vulnerability pattern\u2014unrestricted absolute file path reading via the dataUrl() function\u2014is not present. The fix (path containment validation at src/helpers/Html.php:995-999) was included in upstream Craft CMS 4.18.9 before TuxCare onboarded the version on 2026-09-24. The snapshot commit imported the already-fixed codebase, and no subsequent modifications were made to the dataUrl() function on this branch." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. CVE-2024-52293 is NOT present in the target. The vulnerability (missing normalizePath in FileHelper::absolutePath) was fixed by upstream Craft CMS in version 4.12.2 (commit 123e48a696, 2024-09-11, author brandon@pixelandtonic.com). The target version 4.18.9 already includes this fix from the upstream release. Line 136 of FileHelper.php contains 'return static::normalizePath($from . $ds . $to, $ds);', which is the fixed version that prevents directory traversal attacks. The vulnerable pattern (raw concatenation without normalization) is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 is NOT present in the target. The vulnerability (missing normalizePath in FileHelper::absolutePath) was fixed by upstream Craft CMS in version 4.12.2 (commit 123e48a696, 2024-09-11, author brandon@pixelandtonic.com). The target version 4.18.9 already includes this fix from the upstream release. Line 136 of FileHelper.php contains 'return static::normalizePath($from . $ds . $to, $ds);', which is the fixed version that prevents directory traversal attacks. The vulnerable pattern (raw concatenation without normalization) is not present." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 4.18.9-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 4.18.9-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. The target repository (Craft CMS 4.18.9) is not affected by CVE-2025-23209. The vulnerable method UpdaterController::actionRestoreDb() has been completely disabled and now throws NotSupportedException, preventing any path traversal attack that could lead to RCE. This fix was already present in upstream Craft CMS 4.18.9 before TuxCare onboarded the version. The fixing commit a19d46be78 by brandon@pixelandtonic.com (upstream vendor) shipped in the 4.18.9 release, which TuxCare subsequently onboarded via snapshot commit b1a16b0026.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "The target repository (Craft CMS 4.18.9) is not affected by CVE-2025-23209. The vulnerable method UpdaterController::actionRestoreDb() has been completely disabled and now throws NotSupportedException, preventing any path traversal attack that could lead to RCE. This fix was already present in upstream Craft CMS 4.18.9 before TuxCare onboarded the version. The fixing commit a19d46be78 by brandon@pixelandtonic.com (upstream vendor) shipped in the 4.18.9 release, which TuxCare subsequently onboarded via snapshot commit b1a16b0026." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. The target repository (craftcms/cms version 4.18.9) is not affected by CVE-2025-32432. The RCE vulnerability, which exploited missing type validation on the transform handle parameter, was fixed in upstream version 4.14.15. The fix is present in the target's version 4.18.9, which was imported via snapshot commit b1a16b0026 on 2026-09-24. The type check at src/controllers/AssetsController.php:1208-1210 prevents non-string values (objects/arrays) from reaching the vulnerable ImageTransforms::normalizeTransform() method, blocking the RCE attack vector.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "The target repository (craftcms/cms version 4.18.9) is not affected by CVE-2025-32432. The RCE vulnerability, which exploited missing type validation on the transform handle parameter, was fixed in upstream version 4.14.15. The fix is present in the target's version 4.18.9, which was imported via snapshot commit b1a16b0026 on 2026-09-24. The type check at src/controllers/AssetsController.php:1208-1210 prevents non-string values (objects/arrays) from reaching the vulnerable ImageTransforms::normalizeTransform() method, blocking the RCE attack vector." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2025-35939 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is NOT affected by CVE-2025-35939. The vulnerability (storing unsanitized return URLs with arbitrary content/PHP code in session files) is absent because the upstream Craft CMS 4.18.9 release already included the fix. The target's src/web/User.php:473-480 contains a setReturnUrl() method that applies strip_tags() to remove HTML/PHP tags and validates URL schemes before sto...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-35939" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is NOT affected by CVE-2025-35939. The vulnerability (storing unsanitized return URLs with arbitrary content/PHP code in session files) is absent because the upstream Craft CMS 4.18.9 release already included the fix. The target's src/web/User.php:473-480 contains a setReturnUrl() method that applies strip_tags() to remove HTML/PHP tags and validates URL schemes before sto..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2025-46731 is fixed in version 4.18.9-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-46731" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2025-57811 is fixed in version 4.18.9-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-57811" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is NOT vulnerable to CVE-2025-68436. The fix that prevents mass assignment of the photoId attribute was released upstream in Craft CMS version 4.16.17 (December 2025). Version 4.18.9, released September 2026, inherits this fix. The defense code (safeAttributes() method removing 'photoId' from mass-assignable attributes) is present in the target at src/elements/User.php:924...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is NOT vulnerable to CVE-2025-68436. The fix that prevents mass assignment of the photoId attribute was released upstream in Craft CMS version 4.16.17 (December 2025). Version 4.18.9, released September 2026, inherits this fix. The defense code (safeAttributes() method removing 'photoId' from mass-assignable attributes) is present in the target at src/elements/User.php:924..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2025-68437 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 4.18.9 is not affected by CVE-2025-68437 (SSRF via GraphQL save__Asset mutation). The vulnerable pattern is not present because the upstream 4.18.9 release already includes comprehensive SSRF protection via the craftcms/url-validator package. The fix validates URLs and rejects those containing IP addresses or targeting internal resources before any connection is ma...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68437" }, "impact_statement": "not_affected \u2014 Craft CMS version 4.18.9 is not affected by CVE-2025-68437 (SSRF via GraphQL save__Asset mutation). The vulnerable pattern is not present because the upstream 4.18.9 release already includes comprehensive SSRF protection via the craftcms/url-validator package. The fix validates URLs and rejects those containing IP addresses or targeting internal resources before any connection is ma..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2025-68454 is fixed in version 4.18.9-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68454" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. The target version 4.18.9 is not affected by CVE-2025-68455. The vulnerability was fixed by the upstream vendor in version 4.16.17 (released 2025-12-04) via commits that add Component::cleanseConfig() calls to sanitize configuration arrays before object instantiation. Version 4.18.9 (released 2026-09-17) already contains these fixes from the upstream vendor. The fix prevents RCE via malicious Yii2 behaviors by removing \"on \" and \"as \" keys from user-provided configuration arrays, which would otherwise allow attackers to attach malicious behaviors or event handlers to dynamically configured objects.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "The target version 4.18.9 is not affected by CVE-2025-68455. The vulnerability was fixed by the upstream vendor in version 4.16.17 (released 2025-12-04) via commits that add Component::cleanseConfig() calls to sanitize configuration arrays before object instantiation. Version 4.18.9 (released 2026-09-17) already contains these fixes from the upstream vendor. The fix prevents RCE via malicious Yii2 behaviors by removing \"on \" and \"as \" keys from user-provided configuration arrays, which would otherwise allow attackers to attach malicious behaviors or event handlers to dynamically configured objects." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2025-68456 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. The target repository (craftcms/cms version 4.18.9) is NOT AFFECTED by CVE-2025-68456. The upstream vendor fix that prevents unauthenticated database backup triggering is already present in the codebase at src/controllers/UpdaterController.php lines 72-75. This fix was shipped in upstream release 4.18.9 (commit 1718011a5f by brandon@pixelandtonic.com) before TuxCare onboarded the version. The fix adds a precondition check that only allows the actionBackup() method to execute database backups when migrations are pending, effectively preventing the DoS attack via repeated arbitrary backup requests described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68456" }, "impact_statement": "The target repository (craftcms/cms version 4.18.9) is NOT AFFECTED by CVE-2025-68456. The upstream vendor fix that prevents unauthenticated database backup triggering is already present in the codebase at src/controllers/UpdaterController.php lines 72-75. This fix was shipped in upstream release 4.18.9 (commit 1718011a5f by brandon@pixelandtonic.com) before TuxCare onboarded the version. The fix adds a precondition check that only allows the actionBackup() method to execute database backups when migrations are pending, effectively preventing the DoS attack via repeated arbitrary backup requests described in the CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-11-09T23:03:00.035941+00:00", "status_notes": "Vulnerability CVE-2026-115934 affects version 4.18.9-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115934" }, "action_statement": "Vulnerability CVE-2026-115934 affects version 4.18.9-p2+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-11-02T14:56:09.367348+00:00", "status_notes": "Vulnerability CVE-2026-115935 affects version 4.18.9-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115935" }, "action_statement": "Vulnerability CVE-2026-115935 affects version 4.18.9-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-11-04T08:12:00.074517+00:00", "status_notes": "Vulnerability CVE-2026-115938 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 The target Craft CMS 4.18.9-p2+tuxcare is NOT AFFECTED by CVE-2026-115938. The vulnerability (Twig sandbox escape in element-search conditions leading to securityKey leakage and RCE) was fixed in upstream Craft CMS 4.17.4 (Feb 11, 2026) via commit 8d4903647d by brandon@pixelandtonic.com, which changed BaseElementSelectConditionRule.php to use renderSandboxedObjectTemplate() instead of the unsan...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-115938" }, "impact_statement": "not_affected \u2014 The target Craft CMS 4.18.9-p2+tuxcare is NOT AFFECTED by CVE-2026-115938. The vulnerability (Twig sandbox escape in element-search conditions leading to securityKey leakage and RCE) was fixed in upstream Craft CMS 4.17.4 (Feb 11, 2026) via commit 8d4903647d by brandon@pixelandtonic.com, which changed BaseElementSelectConditionRule.php to use renderSandboxedObjectTemplate() instead of the unsan..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 4.18.9 is not affected by CVE-2026-25491. While the Twig template does not apply the |e escape filter to entry type names (line 28 of _entrytypes/index.twig), the architecture uses Vue.js client-side rendering with automatic HTML escaping via {{ }} interpolation syntax (App.vue:115,120). Additionally, JSON encoding provides JavaScript context protection. The CVE affects versions 5.0.0...", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Craft CMS 4.18.9 is not affected by CVE-2026-25491. While the Twig template does not apply the |e escape filter to entry type names (line 28 of _entrytypes/index.twig), the architecture uses Vue.js client-side rendering with automatic HTML escaping via {{ }} interpolation syntax (App.vue:115,120). Additionally, JSON encoding provides JavaScript context protection. The CVE affects versions 5.0.0..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-25493 (SSRF via HTTP redirect bypass) is NOT present in craftcms/cms 4.18.9. The target version already contains the upstream vendor fix (RequestOptions::ALLOW_REDIRECTS => false) from Craft CMS 4.16.18+. The vulnerability affected versions 4.0.0-RC1 through 4.16.17; target version 4.18.9 is beyond the patched threshold. The fix was implemented by Pixel & Tonic (upstream vendor) in com...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 CVE-2026-25493 (SSRF via HTTP redirect bypass) is NOT present in craftcms/cms 4.18.9. The target version already contains the upstream vendor fix (RequestOptions::ALLOW_REDIRECTS => false) from Craft CMS 4.16.18+. The vulnerability affected versions 4.0.0-RC1 through 4.16.17; target version 4.18.9 is beyond the patched threshold. The fix was implemented by Pixel & Tonic (upstream vendor) in com..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-25494 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is not affected by CVE-2026-25494. The vulnerability (hex-encoded IP bypass in saveAsset GraphQL mutation) was fixed in upstream version 4.16.18 (Jan 2026). TuxCare's snapshot of 4.18.9 (Sep 2026) already includes the fix via the craftcms/url-validator package v1.0.0, which contains hex-to-decimal normalization and cloud metadata blocklists. The vulnerable pattern (relying...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is not affected by CVE-2026-25494. The vulnerability (hex-encoded IP bypass in saveAsset GraphQL mutation) was fixed in upstream version 4.16.18 (Jan 2026). TuxCare's snapshot of 4.18.9 (Sep 2026) already includes the fix via the craftcms/url-validator package v1.0.0, which contains hex-to-decimal normalization and cloud metadata blocklists. The vulnerable pattern (relying..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. The target (craftcms/cms v4.18.9) is NOT AFFECTED by CVE-2026-25495. The SQL injection vulnerability described in the CVE has been fixed by the upstream vendor (Pixel & Tonic) in version 4.17.4. The fix was already present when TuxCare onboarded version 4.18.9. The defense mechanism `ElementHelper::cleanseQueryCriteria()` removes dangerous SQL clause parameters (orderBy, where, select, from, groupBy, join, having, union, withQueries, params) from user-supplied criteria before database query construction, preventing arbitrary SQL injection. This is an upstream vendor fix, not a TuxCare backport, hence verdict is not_affected rather than already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "The target (craftcms/cms v4.18.9) is NOT AFFECTED by CVE-2026-25495. The SQL injection vulnerability described in the CVE has been fixed by the upstream vendor (Pixel & Tonic) in version 4.17.4. The fix was already present when TuxCare onboarded version 4.18.9. The defense mechanism `ElementHelper::cleanseQueryCriteria()` removes dangerous SQL clause parameters (orderBy, where, select, from, groupBy, join, having, union, withQueries, params) from user-supplied criteria before database query construction, preventing arbitrary SQL injection. This is an upstream vendor fix, not a TuxCare backport, hence verdict is not_affected rather than already_fixed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-25496 is NOT present in Craft CMS 4.18.9. The stored XSS vulnerability in Number field prefix/suffix rendering has been fixed by the upstream vendor. The target's Number/input.twig template includes the security fix (encode=true parameter added to the md filter on lines 28 and 43), which HTML-encodes prefix/suffix values before Markdown processing, preventing script injection. This fix...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 CVE-2026-25496 is NOT present in Craft CMS 4.18.9. The stored XSS vulnerability in Number field prefix/suffix rendering has been fixed by the upstream vendor. The target's Number/input.twig template includes the security fix (encode=true parameter added to the md filter on lines 28 and 43), which HTML-encodes prefix/suffix values before Markdown processing, preventing script injection. This fix..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. CVE-2026-25498 (GHSA-7jx7-3846-m7w7) is NOT present in the target. The vulnerability affects Craft CMS versions 4.0.0-RC1 through 4.16.17, where assembleLayoutFromPost() in src/services/Fields.php fails to sanitize user-supplied configuration data, allowing RCE via Yii2 behavior injection. The fix was released in upstream Craft CMS 4.16.18 (2026-01-09), adding ComponentHelper::cleanseConfig() to remove malicious \"on \" and \"as \" prefixed configuration keys. The target version 4.18.9 (released 2026-09-17) already includes this upstream fix. Analysis confirmed the fix is present at Fields.php:1286, and it was imported during the snapshot/onboarding of version 4.18.9, not added by TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "CVE-2026-25498 (GHSA-7jx7-3846-m7w7) is NOT present in the target. The vulnerability affects Craft CMS versions 4.0.0-RC1 through 4.16.17, where assembleLayoutFromPost() in src/services/Fields.php fails to sanitize user-supplied configuration data, allowing RCE via Yii2 behavior injection. The fix was released in upstream Craft CMS 4.16.18 (2026-01-09), adding ComponentHelper::cleanseConfig() to remove malicious \"on \" and \"as \" prefixed configuration keys. The target version 4.18.9 (released 2026-09-17) already includes this upstream fix. Analysis confirmed the fix is present at Fields.php:1286, and it was imported during the snapshot/onboarding of version 4.18.9, not added by TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 contains the complete XSS fix that was released upstream in Craft CMS 4.16.19. The fix includes three defenses: (1) a typeOptions() whitelist excluding 'html' as a valid column type, (2) validateColumns() that rejects unsupported column types and defaults them to 'singleline', and (3) HTML encoding of 'heading' column values in _getInputHtml(). All three fixes are present ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 contains the complete XSS fix that was released upstream in Craft CMS 4.16.19. The fix includes three defenses: (1) a typeOptions() whitelist excluding 'html' as a valid column type, (2) validateColumns() that rejects unsupported column types and defaults them to 'singleline', and (3) HTML encoding of 'heading' column values in _getInputHtml(). All three fixes are present ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-27127 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. Target version 4.18.9 is NOT AFFECTED by CVE-2026-27127 (DNS rebinding TOCTOU SSRF vulnerability). The upstream Craft CMS 4.18.9 release already contains the complete DNS pinning fix that prevents DNS rebinding attacks. The fix implements both CURLOPT_RESOLVE to pin DNS resolution and ON_STATS callback to validate the actual connected IP, eliminating the TOCTOU vulnerability between validation and request.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27127" }, "impact_statement": "Target version 4.18.9 is NOT AFFECTED by CVE-2026-27127 (DNS rebinding TOCTOU SSRF vulnerability). The upstream Craft CMS 4.18.9 release already contains the complete DNS pinning fix that prevents DNS rebinding attacks. The fix implements both CURLOPT_RESOLVE to pin DNS resolution and ON_STATS callback to validate the actual connected IP, eliminating the TOCTOU vulnerability between validation and request." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.9) is NOT AFFECTED by CVE-2026-27128. The TOCTOU race condition vulnerability in token validation has already been fixed by the upstream vendor. The fix (mutex-based synchronization wrapping the read-check-update sequence in getTokenRoute()) was included in upstream release 4.16.19 and is present in the target's version 4.18.9. TuxCare onboarded version 4.18.9 via sna...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.9) is NOT AFFECTED by CVE-2026-27128. The TOCTOU race condition vulnerability in token validation has already been fixed by the upstream vendor. The fix (mutex-based synchronization wrapping the read-check-update sequence in getTokenRoute()) was included in upstream release 4.16.19 and is present in the target's version 4.18.9. TuxCare onboarded version 4.18.9 via sna..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-27129 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-27129 describes an IPv6 bypass vulnerability in Craft CMS versions that use inline SSRF validation with gethostbyname(), which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, gethostbyname() returns the hostname string unchanged, bypassing IP blocklist checks. However, the target (version 4.18.9) uses a fundamentally different architecture: it delegates all ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27129" }, "impact_statement": "not_affected \u2014 CVE-2026-27129 describes an IPv6 bypass vulnerability in Craft CMS versions that use inline SSRF validation with gethostbyname(), which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, gethostbyname() returns the hostname string unchanged, bypassing IP blocklist checks. However, the target (version 4.18.9) uses a fundamentally different architecture: it delegates all ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. CVE-2026-31857 affects Craft CMS versions prior to 4.17.4 and 5.9.9. The target is version 4.18.9, which already contains the upstream fix. The vulnerable code in BaseElementSelectConditionRule::getElementId() that used unsandboxed renderObjectTemplate() has been replaced with renderSandboxedObjectTemplate(). The complete Twig sandbox infrastructure with SecurityPolicy allowlist enforcement is present. The fix was shipped in upstream version 4.17.4 (released 2026-02-11), seven months before the target's base version 4.18.9 (released 2026-09-17).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "CVE-2026-31857 affects Craft CMS versions prior to 4.17.4 and 5.9.9. The target is version 4.18.9, which already contains the upstream fix. The vulnerable code in BaseElementSelectConditionRule::getElementId() that used unsandboxed renderObjectTemplate() has been replaced with renderSandboxedObjectTemplate(). The complete Twig sandbox infrastructure with SecurityPolicy allowlist enforcement is present. The fix was shipped in upstream version 4.17.4 (released 2026-02-11), seven months before the target's base version 4.18.9 (released 2026-09-17)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. CVE-2026-31858 affects ElementSearchController::actionSearch(), which does not exist in Craft CMS 4.18.9. ElementSearchController was introduced in version 5.8.0 (April 2026), while the target is version 4.18.9 from the 4.x release line. The vulnerable component is not present in this version. Additionally, ElementIndexesController (the only controller in 4.18.9 that processes user-supplied criteria parameters from HTTP requests) applies the cleanseQueryCriteria() defense, which removes dangerous SQL-construction attributes (where, orderBy, select, join, having, union, params) before passing criteria to query configuration.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "CVE-2026-31858 affects ElementSearchController::actionSearch(), which does not exist in Craft CMS 4.18.9. ElementSearchController was introduced in version 5.8.0 (April 2026), while the target is version 4.18.9 from the 4.x release line. The vulnerable component is not present in this version. Additionally, ElementIndexesController (the only controller in 4.18.9 that processes user-supplied criteria parameters from HTTP requests) applies the cleanseQueryCriteria() defense, which removes dangerous SQL-construction attributes (where, orderBy, select, join, having, union, params) before passing criteria to query configuration." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-31859 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 4.18.9) is NOT affected by CVE-2026-31859. The vulnerability pattern (accepting dangerous URL schemes like `javascript:` in return URLs) is not present because the upstream vendor fixed it in commit cc9921c148 (Feb 6, 2026) before the 4.18.9 release. TuxCare onboarded version 4.18.9 on Oct 3, 2026, which already contained the fix. The setReturnUrl() method at sr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31859" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 4.18.9) is NOT affected by CVE-2026-31859. The vulnerability pattern (accepting dangerous URL schemes like `javascript:` in return URLs) is not present because the upstream vendor fixed it in commit cc9921c148 (Feb 6, 2026) before the 4.18.9 release. TuxCare onboarded version 4.18.9 on Oct 3, 2026, which already contained the fix. The setReturnUrl() method at sr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS version 4.18.9) is NOT affected by CVE-2026-32262. The vulnerability, a path traversal issue in the AssetsController->replaceFile() method allowing authenticated users to delete arbitrary files via the targetFilename parameter, was fixed in upstream version 4.17.5. The target version 4.18.9 is a later release that already contains the complete upstream fix. The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS version 4.18.9) is NOT affected by CVE-2026-32262. The vulnerability, a path traversal issue in the AssetsController->replaceFile() method allowing authenticated users to delete arbitrary files via the targetFilename parameter, was fixed in upstream version 4.17.5. The target version 4.18.9 is a later release that already contains the complete upstream fix. The ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. Version 4.18.9 is not affected by CVE-2026-32263. The vulnerability exists in EntryTypesController.php::actionApplyOverrideSettings(), which was introduced in Craft CMS version 5.0 (commit 0885de776b \"Globalize entry types\"). This file and method do not exist in version 4.x. In version 4.18.9, entry type functionality is handled in SectionsController.php using manual property assignment rather than bulk configuration via Craft::configure(). All uses of Craft::configure() with HTTP request data in version 4.x controllers are protected by Component::cleanseConfig(), preventing Yii2 behavior/event handler injection. The vulnerable architectural pattern (parse_str \u2192 unsanitized array \u2192 Craft::configure) that enables the attack does not exist in this version.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "Version 4.18.9 is not affected by CVE-2026-32263. The vulnerability exists in EntryTypesController.php::actionApplyOverrideSettings(), which was introduced in Craft CMS version 5.0 (commit 0885de776b \"Globalize entry types\"). This file and method do not exist in version 4.x. In version 4.18.9, entry type functionality is handled in SectionsController.php using manual property assignment rather than bulk configuration via Craft::configure(). All uses of Craft::configure() with HTTP request data in version 4.x controllers are protected by Component::cleanseConfig(), preventing Yii2 behavior/event handler injection. The vulnerable architectural pattern (parse_str \u2192 unsanitized array \u2192 Craft::configure) that enables the attack does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. Target version 4.18.9 is not affected by CVE-2026-32264 (GHSA-4484-8v2f-5748). The RCE vulnerability in ElementIndexesController and FieldsController was fixed by the upstream vendor (Pixel & Tonic) in version 4.17.5 (released February 2026). The target version 4.18.9 (released September 2026) already includes these security fixes as part of the upstream release that TuxCare onboarded. Both vulnerable code paths now properly sanitize configuration arrays with Component::cleanseConfig() before object instantiation, preventing the behavior injection attack.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "Target version 4.18.9 is not affected by CVE-2026-32264 (GHSA-4484-8v2f-5748). The RCE vulnerability in ElementIndexesController and FieldsController was fixed by the upstream vendor (Pixel & Tonic) in version 4.17.5 (released February 2026). The target version 4.18.9 (released September 2026) already includes these security fixes as part of the upstream release that TuxCare onboarded. Both vulnerable code paths now properly sanitize configuration arrays with Component::cleanseConfig() before object instantiation, preventing the behavior injection attack." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. Target version 4.18.9 is not affected by CVE-2026-32267. The vulnerability was fixed in upstream version 4.17.6, and the target version 4.18.9 (released after 4.17.6) already contains the complete security fix. The fix prevents privilege escalation by enforcing route-specific token validation: tokens are now bound to specific routes and cannot be reused to access unintended endpoints like UsersController->actionImpersonateWithToken.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "Target version 4.18.9 is not affected by CVE-2026-32267. The vulnerability was fixed in upstream version 4.17.6, and the target version 4.18.9 (released after 4.17.6) already contains the complete security fix. The fix prevents privilege escalation by enforcing route-specific token validation: tokens are now bound to specific routes and cannot be reused to access unintended endpoints like UsersController->actionImpersonateWithToken." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.9 is NOT affected by CVE-2026-33051. The vulnerability exists in versions 5.9.0-beta.1 through 5.9.10 due to Template::raw() bypassing Twig's auto-escaping when rendering unencoded creator names. Version 4.18.9 uses a fundamentally different architecture (Twig templates with automatic HTML escaping) that was refactored into the vulnerable PHP-generated approach starting in version ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Version 4.18.9 is NOT affected by CVE-2026-33051. The vulnerability exists in versions 5.9.0-beta.1 through 5.9.10 due to Template::raw() bypassing Twig's auto-escaping when rendering unencoded creator names. Version 4.18.9 uses a fundamentally different architecture (Twig templates with automatic HTML escaping) that was refactored into the vulnerable PHP-generated approach starting in version ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. Craft CMS version 4.18.9 is not affected by CVE-2026-33157. The specific vulnerability (unsanitized fieldLayouts parameter in ElementIndexesController::actionFilterHud() passed to FieldLayout::createFromConfig()) does not exist in this version. The actionFilterHud() method in 4.18.9 only processes conditionConfig parameters (which ARE sanitized at line 421), and has no fieldLayouts parameter handling at all. The vulnerable code path introduced in Craft 5.6.0 is architecturally absent from the 4.x branch. All HTTP-accessible entry points that process field layout configurations call Component::cleanseConfig() before passing data to object creation methods.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "Craft CMS version 4.18.9 is not affected by CVE-2026-33157. The specific vulnerability (unsanitized fieldLayouts parameter in ElementIndexesController::actionFilterHud() passed to FieldLayout::createFromConfig()) does not exist in this version. The actionFilterHud() method in 4.18.9 only processes conditionConfig parameters (which ARE sanitized at line 421), and has no fieldLayouts parameter handling at all. The vulnerable code path introduced in Craft 5.6.0 is architecturally absent from the 4.x branch. All HTTP-accessible entry points that process field layout configurations call Component::cleanseConfig() before passing data to object creation methods." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS version 4.18.9) is not affected by CVE-2026-33158. This vulnerability affects Craft CMS versions 4.0.0-RC1 through 4.17.7, allowing low-privileged authenticated users to read private asset content by calling the assets/edit-image endpoint with arbitrary assetIds without proper authorization checks. The vulnerability was fixed in upstream version 4.17.8 by adding...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS version 4.18.9) is not affected by CVE-2026-33158. This vulnerability affects Craft CMS versions 4.0.0-RC1 through 4.17.7, allowing low-privileged authenticated users to read private asset content by calling the assets/edit-image endpoint with arbitrary assetIds without proper authorization checks. The vulnerability was fixed in upstream version 4.17.8 by adding..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-33159 affects Craft CMS 4.0.0-RC1 to before 4.17.8, allowing unauthenticated users to execute privileged Config Sync operations. The target repository is at version 4.18.9, which includes the upstream fix released in 4.17.8. The ConfigSyncController contains the required authentication gates ($allowAnonymous=ALLOW_ANONYMOUS_NEVER and requireAdmin() in beforeAction hook) that block all ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 CVE-2026-33159 affects Craft CMS 4.0.0-RC1 to before 4.17.8, allowing unauthenticated users to execute privileged Config Sync operations. The target repository is at version 4.18.9, which includes the upstream fix released in 4.17.8. The ConfigSyncController contains the required authentication gates ($allowAnonymous=ALLOW_ANONYMOUS_NEVER and requireAdmin() in beforeAction hook) that block all ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-33160 affects Craft CMS versions 4.0.0-RC1 to before 4.17.8. The target version 4.18.9 already contains the upstream vendor's fix (requirePermission('accessCp') check at line 1205 of AssetsController.php) that prevents unauthorized access to asset transform generation. The fix was shipped in upstream release 4.18.9 before TuxCare onboarded this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 CVE-2026-33160 affects Craft CMS versions 4.0.0-RC1 to before 4.17.8. The target version 4.18.9 already contains the upstream vendor's fix (requirePermission('accessCp') check at line 1205 of AssetsController.php) that prevents unauthorized access to asset transform generation. The fix was shipped in upstream release 4.18.9 before TuxCare onboarded this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-33161 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 The target repository (craftcms/cms version 4.18.9, SHA 018c9bb626) is NOT AFFECTED by CVE-2026-33161. The vulnerability\u2014an authorization bypass allowing low-privileged users to access private asset metadata via the assets/image-editor endpoint\u2014was fixed by the upstream vendor (Craft CMS) in commit d30df31122 on February 25, 2026. This fix was included in version 4.17.8 and all subsequent relea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "not_affected \u2014 The target repository (craftcms/cms version 4.18.9, SHA 018c9bb626) is NOT AFFECTED by CVE-2026-33161. The vulnerability\u2014an authorization bypass allowing low-privileged users to access private asset metadata via the assets/image-editor endpoint\u2014was fixed by the upstream vendor (Craft CMS) in commit d30df31122 on February 25, 2026. This fix was included in version 4.17.8 and all subsequent relea..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 4.18.9 is NOT affected by CVE-2026-33162. The vulnerability concerns an authorization bypass in the \"move entry to section\" feature that allows users with only accessCp permission to move entries between sections without saveEntries permission. This feature was introduced in version 5.3.0 (commit e75a51a266) and does not exist in version 4.18.9. Git ancestry verification confi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 Craft CMS version 4.18.9 is NOT affected by CVE-2026-33162. The vulnerability concerns an authorization bypass in the \"move entry to section\" feature that allows users with only accessCp permission to move entries between sections without saveEntries permission. This feature was introduced in version 5.3.0 (commit e75a51a266) and does not exist in version 4.18.9. Git ancestry verification confi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.9 is not affected by CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset mutations). The upstream vendor refactored asset upload URL validation to use the craftcms/url-validator package (commit 26268c0210, June 2026), which validates URL schemes and blocks dangerous protocols (gopher, file, ftp, etc.) before any connection is opened. This fix was already present in the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "not_affected \u2014 Version 4.18.9 is not affected by CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset mutations). The upstream vendor refactored asset upload URL validation to use the craftcms/url-validator package (commit 26268c0210, June 2026), which validates URL schemes and blocks dangerous protocols (gopher, file, ftp, etc.) before any connection is opened. This fix was already present in the..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 The target version 4.18.9 is NOT AFFECTED by CVE-2026-41130 (GHSA-95wr-3f2v-v2wh). The vulnerable `actionResourceJs()` method in `src/controllers/AppController.php` does not exist in this version. Upstream Craft CMS removed this endpoint entirely in version 4.18.0 (released May 13, 2026), which predates TuxCare's onboarding of version 4.18.9. The SSRF attack chain is broken at the INPUT stage b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target version 4.18.9 is NOT AFFECTED by CVE-2026-41130 (GHSA-95wr-3f2v-v2wh). The vulnerable `actionResourceJs()` method in `src/controllers/AppController.php` does not exist in this version. Upstream Craft CMS removed this endpoint entirely in version 4.18.0 (released May 13, 2026), which predates TuxCare's onboarding of version 4.18.9. The SSRF attack chain is broken at the INPUT stage b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-55790 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. CVE-2026-55790 XSS vulnerability in CraftSupport widget is NOT present in target version 4.18.9. The fix was included in upstream release 4.17.16 (2026-05-11) and is present at both vulnerable locations: (1) line 382 uses Craft.escapeHtml() to escape GitHub issue titles before rendering, and (2) lines 555-557 use jQuery's text: option for error messages. The target version 4.18.9 (released 2026-09-17) includes this upstream vendor fix. TuxCare onboarded the already-fixed version via snapshot commit b1a16b0026.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55790" }, "impact_statement": "CVE-2026-55790 XSS vulnerability in CraftSupport widget is NOT present in target version 4.18.9. The fix was included in upstream release 4.17.16 (2026-05-11) and is present at both vulnerable locations: (1) line 382 uses Craft.escapeHtml() to escape GitHub issue titles before rendering, and (2) lines 555-557 use jQuery's text: option for error messages. The target version 4.18.9 (released 2026-09-17) includes this upstream vendor fix. TuxCare onboarded the already-fixed version via snapshot commit b1a16b0026." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-55793 is fixed in version 4.18.9-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55793" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.9 is not affected by CVE-2026-56381. While the code has missing |e filters in some Twig templates (src/templates/settings/users/groups/_index.twig line 29), three layers of ambient framework defenses provide comprehensive protection: (1) Twig's default HTML auto-escaping for server-side rendering, (2) JSON string escaping preventing JavaScript injection, and (3) Vue's mustache inte...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Version 4.18.9 is not affected by CVE-2026-56381. While the code has missing |e filters in some Twig templates (src/templates/settings/users/groups/_index.twig line 29), three layers of ambient framework defenses provide comprehensive protection: (1) Twig's default HTML auto-escaping for server-side rendering, (2) JSON string escaping preventing JavaScript injection, and (3) Vue's mustache inte..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-56382 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. Target version 4.18.9 is NOT affected by CVE-2026-56382. The vulnerable method actionRenderCardPreview() was introduced in version 5.5.0, after this version. The CVE's stated affected range (>= 5.5.0 and <= 5.9.13) correctly excludes version 4.18.9. No alternative vulnerable code path exists in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56382" }, "impact_statement": "Target version 4.18.9 is NOT affected by CVE-2026-56382. The vulnerable method actionRenderCardPreview() was introduced in version 5.5.0, after this version. The CVE's stated affected range (>= 5.5.0 and <= 5.9.13) correctly excludes version 4.18.9. No alternative vulnerable code path exists in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-56383 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 The target Craft CMS 4.18.9 is NOT AFFECTED by CVE-2026-56383 (stored XSS in Table field row headings). The vulnerability was fixed by the upstream vendor (Pixel & Tonic) in version 4.16.19, and this fix is present in version 4.18.9. The fix HTML-encodes heading cell values in _getInputHtml() before rendering, preventing XSS. The vulnerable pattern does not exist in the target because the upstr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56383" }, "impact_statement": "not_affected \u2014 The target Craft CMS 4.18.9 is NOT AFFECTED by CVE-2026-56383 (stored XSS in Table field row headings). The vulnerability was fixed by the upstream vendor (Pixel & Tonic) in version 4.16.19, and this fix is present in version 4.18.9. The fix HTML-encodes heading cell values in _getInputHtml() before rendering, preventing XSS. The vulnerable pattern does not exist in the target because the upstr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-56384 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-56384 affects Craft CMS versions >= 4.0.0-RC1, <= 4.17.7, and was fixed in 4.17.8. The target repository is at version 4.18.9, which already contains the upstream vendor fix. The vulnerability involved missing authorization checks in the assets/preview-thumb and assets/preview-file endpoints. Both methods now include requireVolumePermissionByAsset() and requirePeerVolumePermissionByAss...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56384" }, "impact_statement": "not_affected \u2014 CVE-2026-56384 affects Craft CMS versions >= 4.0.0-RC1, <= 4.17.7, and was fixed in 4.17.8. The target repository is at version 4.18.9, which already contains the upstream vendor fix. The vulnerability involved missing authorization checks in the assets/preview-thumb and assets/preview-file endpoints. Both methods now include requireVolumePermissionByAsset() and requirePeerVolumePermissionByAss..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-56385 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is not affected by CVE-2026-56385. The vulnerability affects Craft CMS versions <= 4.17.7, with the fix released in 4.17.8. Version 4.18.9 already includes the upstream fix (permission checks in actionPreviewFile method at lines 1258-1259) that was shipped in the upstream release before TuxCare onboarded this version. The authorization bypass vulnerability pattern is not p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56385" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is not affected by CVE-2026-56385. The vulnerability affects Craft CMS versions <= 4.17.7, with the fix released in 4.17.8. Version 4.18.9 already includes the upstream fix (permission checks in actionPreviewFile method at lines 1258-1259) that was shipped in the upstream release before TuxCare onboarded this version. The authorization bypass vulnerability pattern is not p..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-11-08T14:16:00.068422+00:00", "status_notes": "Vulnerability CVE-2026-56393 affects version 4.18.9-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56393" }, "action_statement": "Vulnerability CVE-2026-56393 affects version 4.18.9-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:38:31.809878+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 4.18.9-p2+tuxcare of craftcms/cms. Target version 4.18.9 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint was fixed in upstream Craft CMS version 4.17.5 (released 2026-02-17), and version 4.18.9 (released 2026-09-17) inherits this fix. All three entry points (iconUrl, iconPath, iconSvg) validate the extension parameter using regex /^\\w+$/ to reject path traversal sequences before constructing file paths.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "Target version 4.18.9 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint was fixed in upstream Craft CMS version 4.17.5 (released 2026-02-17), and version 4.18.9 (released 2026-09-17) inherits this fix. All three entry points (iconUrl, iconPath, iconSvg) validate the extension parameter using regex /^\\w+$/ to reject path traversal sequences before constructing file paths." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 4.18.9-p2+tuxcare of craftcms/cms. not_affected \u2014 The XSS vulnerability (GHSA-wf98-vxv9-jqfv) in the Feeds widget is NOT present in the target. The fix was already included in upstream Craft CMS 4.18.9 when TuxCare onboarded it. The vulnerability allowed malicious javascript: URLs in feed item permalinks to execute XSS. The upstream fix (originally applied in Craft 3.7.29 by brandon@pixelandtonic.com) adds a regex filter rejecting any permalin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The XSS vulnerability (GHSA-wf98-vxv9-jqfv) in the Feeds widget is NOT present in the target. The fix was already included in upstream Craft CMS 4.18.9 when TuxCare onboarded it. The vulnerability allowed malicious javascript: URLs in feed item permalinks to execute XSS. The upstream fix (originally applied in Craft 3.7.29 by brandon@pixelandtonic.com) adds a regex filter rejecting any permalin..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability AIKIDO-2025-10090 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability AIKIDO-2025-10859 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 3.9.15-p14+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 3.9.15-p14+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 3.9.15-p14+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 3.9.15-p14+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 3.9.15-p14+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2023-30179 is a false positive for craftcms/cms 3.9.15-p14+tuxcare.", "vulnerability": { "name": "CVE-2023-30179" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2023-33495 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 3.9.15-p14+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2024-52291 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52291" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2024-52292 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52292" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 3.9.15-p14+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. per review of Brhane", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "per review of Brhane" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2025-35939 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-35939" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2025-54417 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-54417" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2025-57811 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-57811" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ...", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2025-68437 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68437" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2025-68454 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68454" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2025-68456 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68456" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-09T23:08:00.049119+00:00", "status_notes": "Vulnerability CVE-2026-115934 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. not_affected \u2014 Target is Craft CMS 3.9.15 (TuxCare build). No vendor patch was supplied and the CVE text is vague. The only element-search SQL path is Search service, which builds SQL by string concatenation, but attacker input is neutralised before concatenation. The anonymous GraphQL endpoint's orderBy is allow-listed. No unauthenticated element-search endpoint injects raw input into SQL. Confidence is mode...", "vulnerability": { "name": "CVE-2026-115934" }, "impact_statement": "not_affected \u2014 Target is Craft CMS 3.9.15 (TuxCare build). No vendor patch was supplied and the CVE text is vague. The only element-search SQL path is Search service, which builds SQL by string concatenation, but attacker input is neutralised before concatenation. The anonymous GraphQL endpoint's orderBy is allow-listed. No unauthenticated element-search endpoint injects raw input into SQL. Confidence is mode..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-115935 affects version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115935" }, "action_statement": "Vulnerability CVE-2026-115935 affects version 3.9.15-p14+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-115938 affects version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115938" }, "action_statement": "Vulnerability CVE-2026-115938 affects version 3.9.15-p14+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-25493 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25493" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-25494 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25494" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-25495 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25495" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-25496 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25496" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-25498 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25498" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-27127 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27127" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-27128 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27128" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-27129 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27129" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-28783 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-28783" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-29069 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29069" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-29113 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29113" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-31859 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-31859" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-32262 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32262" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-32264 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32264" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-32267 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32267" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-33157 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33157" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-33158 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33158" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-33159 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33159" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-33160 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33160" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-33161 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33161" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-55790 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55790" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-55793 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55793" }, "impact_statement": "not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-56382 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56382" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-56383 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56383" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-56384 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56384" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-56385 is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56385" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-08T14:16:00.068422+00:00", "status_notes": "Vulnerability CVE-2026-56393 affects version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56393" }, "action_statement": "Vulnerability CVE-2026-56393 affects version 3.9.15-p14+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability GHSA-3m9m-24vh-39wx is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-3m9m-24vh-39wx" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability GHSA-44px-qjjc-xrhq is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-44px-qjjc-xrhq" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability GHSA-6j87-m5qx-9fqp is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-6j87-m5qx-9fqp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability GHSA-86vw-x4ww-x467 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-86vw-x4ww-x467" }, "impact_statement": "not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability GHSA-95wr-3f2v-v2wh does not affect version 3.9.15-p14+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "GHSA-95wr-3f2v-v2wh" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability GHSA-c43v-4cr8-6mvp does not affect version 3.9.15-p14+tuxcare of craftcms/cms. not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c43v-4cr8-6mvp" }, "impact_statement": "not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability GHSA-g3hp-vvqf-8vw6 does not affect version 3.9.15-p14+tuxcare of craftcms/cms. craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-g3hp-vvqf-8vw6" }, "impact_statement": "craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 3.9.15-p14+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p14+tuxcare" } } ], "timestamp": "2026-11-04T12:58:59.846901+00:00", "status_notes": "Vulnerability GHSA-x76w-8c62-48mg is fixed in version 3.9.15-p14+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-x76w-8c62-48mg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10090 is fixed in version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10859 is fixed in version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 3.9.15-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 3.9.15-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 3.9.15-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 3.9.15-p2+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 3.9.15-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2023-30179 is a false positive for craftcms/cms 3.9.15-p2+tuxcare.", "vulnerability": { "name": "CVE-2023-30179" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33495 is fixed in version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 3.9.15-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52291 is fixed in version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52291" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52292 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p8+tuxcare.", "vulnerability": { "name": "CVE-2024-52292" }, "action_statement": "Vulnerability CVE-2024-52292 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 3.9.15-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. per review of Brhane", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "per review of Brhane" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-35939 is fixed in version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-35939" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54417 is fixed in version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-54417" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2025-57811" }, "action_statement": "Vulnerability CVE-2025-57811 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ...", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68437 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p3+tuxcare.", "vulnerability": { "name": "CVE-2025-68437" }, "action_statement": "Vulnerability CVE-2025-68437 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2025-68454" }, "action_statement": "Vulnerability CVE-2025-68454 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68456 is fixed in version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68456" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-11-09T23:08:00.049119+00:00", "status_notes": "Vulnerability CVE-2026-115934 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 Target is Craft CMS 3.9.15 (TuxCare build). No vendor patch was supplied and the CVE text is vague. The only element-search SQL path is Search service, which builds SQL by string concatenation, but attacker input is neutralised before concatenation. The anonymous GraphQL endpoint's orderBy is allow-listed. No unauthenticated element-search endpoint injects raw input into SQL. Confidence is mode...", "vulnerability": { "name": "CVE-2026-115934" }, "impact_statement": "not_affected \u2014 Target is Craft CMS 3.9.15 (TuxCare build). No vendor patch was supplied and the CVE text is vague. The only element-search SQL path is Search service, which builds SQL by string concatenation, but attacker input is neutralised before concatenation. The anonymous GraphQL endpoint's orderBy is allow-listed. No unauthenticated element-search endpoint injects raw input into SQL. Confidence is mode..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-11-02T14:56:09.367348+00:00", "status_notes": "Vulnerability CVE-2026-115935 affects version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115935" }, "action_statement": "Vulnerability CVE-2026-115935 affects version 3.9.15-p2+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2026-115938 affects version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115938" }, "action_statement": "Vulnerability CVE-2026-115938 affects version 3.9.15-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 is fixed in version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25493" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-25494" }, "action_statement": "Vulnerability CVE-2026-25494 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 is fixed in version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25495" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-25496" }, "action_statement": "Vulnerability CVE-2026-25496 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-25498" }, "action_statement": "Vulnerability CVE-2026-25498 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27127 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-27127" }, "action_statement": "Vulnerability CVE-2026-27127 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 is fixed in version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27128" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27129 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-27129" }, "action_statement": "Vulnerability CVE-2026-27129 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28783 is fixed in version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-28783" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29069 is fixed in version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29069" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-29113" }, "action_statement": "Vulnerability CVE-2026-29113 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31859 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-31859" }, "action_statement": "Vulnerability CVE-2026-31859 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32262" }, "action_statement": "Vulnerability CVE-2026-32262 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32264" }, "action_statement": "Vulnerability CVE-2026-32264 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-32267" }, "action_statement": "Vulnerability CVE-2026-32267 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare.", "vulnerability": { "name": "CVE-2026-33157" }, "action_statement": "Vulnerability CVE-2026-33157 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33158" }, "action_statement": "Vulnerability CVE-2026-33158 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33159" }, "action_statement": "Vulnerability CVE-2026-33159 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33160" }, "action_statement": "Vulnerability CVE-2026-33160 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33161" }, "action_statement": "Vulnerability CVE-2026-33161 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55790 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-55790" }, "action_statement": "Vulnerability CVE-2026-55790 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55793 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55793" }, "impact_statement": "not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56382 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-56382" }, "action_statement": "Vulnerability CVE-2026-56382 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56383 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-56383" }, "action_statement": "Vulnerability CVE-2026-56383 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56384 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-56384" }, "action_statement": "Vulnerability CVE-2026-56384 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56385 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-56385" }, "action_statement": "Vulnerability CVE-2026-56385 affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-11-08T14:16:00.068422+00:00", "status_notes": "Vulnerability CVE-2026-56393 affects version 3.9.15-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56393" }, "action_statement": "Vulnerability CVE-2026-56393 affects version 3.9.15-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3m9m-24vh-39wx affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p4+tuxcare.", "vulnerability": { "name": "GHSA-3m9m-24vh-39wx" }, "action_statement": "Vulnerability GHSA-3m9m-24vh-39wx affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-44px-qjjc-xrhq affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "GHSA-44px-qjjc-xrhq" }, "action_statement": "Vulnerability GHSA-44px-qjjc-xrhq affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6j87-m5qx-9fqp affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "GHSA-6j87-m5qx-9fqp" }, "action_statement": "Vulnerability GHSA-6j87-m5qx-9fqp affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-86vw-x4ww-x467 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-86vw-x4ww-x467" }, "impact_statement": "not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-95wr-3f2v-v2wh does not affect version 3.9.15-p2+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "GHSA-95wr-3f2v-v2wh" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c43v-4cr8-6mvp does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c43v-4cr8-6mvp" }, "impact_statement": "not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-19T17:32:00.114420+00:00", "status_notes": "Vulnerability GHSA-g3hp-vvqf-8vw6 does not affect version 3.9.15-p2+tuxcare of craftcms/cms. craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-g3hp-vvqf-8vw6" }, "impact_statement": "craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 3.9.15-p2+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x76w-8c62-48mg affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "GHSA-x76w-8c62-48mg" }, "action_statement": "Vulnerability GHSA-x76w-8c62-48mg affects version 3.9.15-p2+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 is an XSS vulnerability in Craft CMS allowing malicious script execution via uploaded HTML files. The vendor patch (commit 8ee85a8f03c143fa2420e7d6f311d95cae3b19ce, Jan 2021) removed 'htm' and 'html' from the default allowedFileExtensions array in src/config/GeneralConfig.php. Analysis of the target repository (craftcms/cms 4.18.9-p1+tuxcare at SHA 9f8c824e72) confirms the allowe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 is an XSS vulnerability in Craft CMS allowing malicious script execution via uploaded HTML files. The vendor patch (commit 8ee85a8f03c143fa2420e7d6f311d95cae3b19ce, Jan 2021) removed 'htm' and 'html' from the default allowedFileExtensions array in src/config/GeneralConfig.php. Analysis of the target repository (craftcms/cms 4.18.9-p1+tuxcare at SHA 9f8c824e72) confirms the allowe..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 4.18.9-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 4.18.9-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is not affected by CVE-2021-32470. The vulnerability (XSS via unescaped prompt input in FieldLayoutDesigner.js) was fixed in upstream Craft CMS 3.6.13. Version 4.18.9 inherited this fix from upstream - the code at src/web/assets/cp/src/js/FieldLayoutDesigner.js:150-151 properly wraps the prompt() result with Craft.escapeHtml() before DOM insertion, preventing the XSS attac...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is not affected by CVE-2021-32470. The vulnerability (XSS via unescaped prompt input in FieldLayoutDesigner.js) was fixed in upstream Craft CMS 3.6.13. Version 4.18.9 inherited this fix from upstream - the code at src/web/assets/cp/src/js/FieldLayoutDesigner.js:150-151 properly wraps the prompt() result with Craft.escapeHtml() before DOM insertion, preventing the XSS attac..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 4.18.9-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 4.18.9-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is an XSS vulnerability in Craft CMS FeedWidget where malicious feed data with javascript: URLs in permalink fields could execute arbitrary JavaScript. The fix validates that permalinks start with http:// or https:// before processing. Target version 4.18.9 already contains this fix - it was present in the upstream release when TuxCare onboarded it. The vulnerable pattern (unvali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is an XSS vulnerability in Craft CMS FeedWidget where malicious feed data with javascript: URLs in permalink fields could execute arbitrary JavaScript. The fix validates that permalinks start with http:// or https:// before processing. Target version 4.18.9 already contains this fix - it was present in the upstream release when TuxCare onboarded it. The vulnerable pattern (unvali..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-11-04T15:44:49.610847+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 4.18.9-p1+tuxcare of craftcms/cms, and is fixed in 4.18.9-p3+tuxcare.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 4.18.9-p1+tuxcare of craftcms/cms, and is fixed in 4.18.9-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS version 4.2.0.1. The target is running version 4.18.9, which already contains all the XSS fixes from the upstream vendor. The vulnerability pattern (unescaped HTML rendering of user-controlled strings) is not present in the target because HTML encoding (`Html::encode()`, Twig `|e` filter, `Craft.escapeHtml()`) has been applied to all affected f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS version 4.2.0.1. The target is running version 4.18.9, which already contains all the XSS fixes from the upstream vendor. The vulnerability pattern (unescaped HTML rendering of user-controlled strings) is not present in the target because HTML encoding (`Html::encode()`, Twig `|e` filter, `Craft.escapeHtml()`) has been applied to all affected f..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 4.18.9-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 4.18.9-p1+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-28T19:32:51.945373+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 4.18.9-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 4.18.9-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-30177 affects CraftCMS prior to version 3.7.68 due to XSS via unencoded volume name output. The target version 4.18.9-p1+tuxcare is NOT vulnerable. The fix was already present in the upstream 4.18.9 release when TuxCare onboarded it. Both output locations use HTML encoding: src/elements/Asset.php line 2804 applies Html::encode() directly, and line 1424 breadcrumbs are auto-encoded by t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 CVE-2023-30177 affects CraftCMS prior to version 3.7.68 due to XSS via unencoded volume name output. The target version 4.18.9-p1+tuxcare is NOT vulnerable. The fix was already present in the upstream 4.18.9 release when TuxCare onboarded it. Both output locations use HTML encoding: src/elements/Asset.php line 2804 applies Html::encode() directly, and line 1424 breadcrumbs are auto-encoded by t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:40:54.166658+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-31144 (XSS via malformed feed widget titles) is NOT present in CraftCMS 4.18.9-p1+tuxcare. The vulnerability required JSON_UNESCAPED_SLASHES flag to be set, allowing unescaped forward slashes in JSON output that could break out of script contexts (e.g., via \"\" in feed titles). The upstream vendor (Pixel & Tonic) fixed this by removing JSON_UNESCAPED_SLASHES from the default en...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "not_affected \u2014 CVE-2023-31144 (XSS via malformed feed widget titles) is NOT present in CraftCMS 4.18.9-p1+tuxcare. The vulnerability required JSON_UNESCAPED_SLASHES flag to be set, allowing unescaped forward slashes in JSON output that could break out of script contexts (e.g., via \"\" in feed titles). The upstream vendor (Pixel & Tonic) fixed this by removing JSON_UNESCAPED_SLASHES from the default en..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is not present in the target. The fix was authored by brandon@pixelandtonic.com (Pixel & Tonic - upstream vendor) on April 3, 2023 in commit 9d0cd0bda7, and shipped with upstream Craft CMS 4.18.9. TuxCare onboarded version 4.18.9 on October 3, 2026, which already contained the fix. The vulnerable pattern (HTML string concatenation) is...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is not present in the target. The fix was authored by brandon@pixelandtonic.com (Pixel & Tonic - upstream vendor) on April 3, 2023 in commit 9d0cd0bda7, and shipped with upstream Craft CMS 4.18.9. TuxCare onboarded version 4.18.9 on October 3, 2026, which already contained the fix. The vulnerable pattern (HTML string concatenation) is..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2023-33495 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33495 (HTML injection in Craft CMS through 4.4.9) is not present in version 4.18.9. The vulnerable pattern (unsafe HTML rendering of exporter names via `html: option.label` in UI.js) was fixed by upstream vendor Pixel & Tonic in commit 57334cd435 (2026-01-04). The fix uses jQuery's `.text()` method which safely escapes HTML. This fix was already present in the upstream 4.18.9 release w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33495" }, "impact_statement": "not_affected \u2014 CVE-2023-33495 (HTML injection in Craft CMS through 4.4.9) is not present in version 4.18.9. The vulnerable pattern (unsafe HTML rendering of exporter names via `html: option.label` in UI.js) was fixed by upstream vendor Pixel & Tonic in commit 57334cd435 (2026-01-04). The fix uses jQuery's `.text()` method which safely escapes HTML. This fix was already present in the upstream 4.18.9 release w..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:38:58.002135+00:00", "status_notes": "Vulnerability CVE-2023-36260 is a false positive for craftcms/cms 4.18.9-p1+tuxcare. CVE-2023-36260 is a false positive for this repository. The CVE describes a DoS vulnerability in the Feed-Me plugin (craftcms/feed-me) related to saving feeds with asset element types and no volume selected. This repository is craftcms/cms (Craft CMS core version 4.18.9), which does not include, vendor, or depend on the Feed-Me plugin. The Feed-Me plugin is a separate package for content import functionality. The core CMS contains only a simple Feed widget for displaying RSS feeds, which lacks the asset/volume functionality described in the CVE.", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "CVE-2023-36260 is a false positive for this repository. The CVE describes a DoS vulnerability in the Feed-Me plugin (craftcms/feed-me) related to saving feeds with asset element types and no volume selected. This repository is craftcms/cms (Craft CMS core version 4.18.9), which does not include, vendor, or depend on the Feed-Me plugin. The Feed-Me plugin is a separate package for content import functionality. The core CMS contains only a simple Feed widget for displaying RSS feeds, which lacks the asset/volume functionality described in the CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2023-40035 affects version 4.18.9-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-40035" }, "action_statement": "Vulnerability CVE-2023-40035 affects version 4.18.9-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2024-21622 describes a privilege escalation vulnerability in Craft CMS that was fixed in versions 4.4.16 and 3.9.6. The target is running Craft CMS 4.18.9, which is significantly newer than the fixed version. Analysis confirms both security patches are present in the target code: (1) ElementsController.php implements double authorization checks before and after applying POST parameters, and...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "not_affected \u2014 CVE-2024-21622 describes a privilege escalation vulnerability in Craft CMS that was fixed in versions 4.4.16 and 3.9.6. The target is running Craft CMS 4.18.9, which is significantly newer than the fixed version. Analysis confirms both security patches are present in the target code: (1) ElementsController.php implements double authorization checks before and after applying POST parameters, and..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 4.18.9-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 4.18.9-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 4.18.9 is not affected by CVE-2024-41800. The vulnerability concerns TOTP token reuse in Craft CMS 5's two-factor authentication system. TOTP authentication functionality was introduced in Craft CMS 5 and does not exist in Craft 4. The target repository contains no TOTP implementation code, no Google2FA dependency, no authenticator database tables, and no TOTP verification methods. Th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 4.18.9 is not affected by CVE-2024-41800. The vulnerability concerns TOTP token reuse in Craft CMS 5's two-factor authentication system. TOTP authentication functionality was introduced in Craft CMS 5 and does not exist in Craft 4. The target repository contains no TOTP implementation code, no Google2FA dependency, no authenticator database tables, and no TOTP verification methods. Th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:48:00.109414+00:00", "status_notes": "Vulnerability CVE-2024-52291 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. CVE-2024-52291 is NOT present in CraftCMS 4.18.9. The vulnerability involved bypassing local filesystem validation using double file:// schemes (e.g., file://file:////), but the upstream fix was already included in version 4.18.9 when TuxCare onboarded it. The vulnerable code pattern (StringHelper::removeLeft) was replaced with a secure regex pattern that removes all consecutive file:// prefixes.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52291" }, "impact_statement": "CVE-2024-52291 is NOT present in CraftCMS 4.18.9. The vulnerability involved bypassing local filesystem validation using double file:// schemes (e.g., file://file:////), but the upstream fix was already included in version 4.18.9 when TuxCare onboarded it. The vulnerable code pattern (StringHelper::removeLeft) was replaced with a secure regex pattern that removes all consecutive file:// prefixes." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:48:00.109414+00:00", "status_notes": "Vulnerability CVE-2024-52292 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. The target repository (Craft CMS 4.18.9) is NOT affected by CVE-2024-52292. The vulnerability pattern\u2014unrestricted absolute file path reading via the dataUrl() function\u2014is not present. The fix (path containment validation at src/helpers/Html.php:995-999) was included in upstream Craft CMS 4.18.9 before TuxCare onboarded the version on 2026-09-24. The snapshot commit imported the already-fixed codebase, and no subsequent modifications were made to the dataUrl() function on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52292" }, "impact_statement": "The target repository (Craft CMS 4.18.9) is NOT affected by CVE-2024-52292. The vulnerability pattern\u2014unrestricted absolute file path reading via the dataUrl() function\u2014is not present. The fix (path containment validation at src/helpers/Html.php:995-999) was included in upstream Craft CMS 4.18.9 before TuxCare onboarded the version on 2026-09-24. The snapshot commit imported the already-fixed codebase, and no subsequent modifications were made to the dataUrl() function on this branch." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:48:00.109414+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. CVE-2024-52293 is NOT present in the target. The vulnerability (missing normalizePath in FileHelper::absolutePath) was fixed by upstream Craft CMS in version 4.12.2 (commit 123e48a696, 2024-09-11, author brandon@pixelandtonic.com). The target version 4.18.9 already includes this fix from the upstream release. Line 136 of FileHelper.php contains 'return static::normalizePath($from . $ds . $to, $ds);', which is the fixed version that prevents directory traversal attacks. The vulnerable pattern (raw concatenation without normalization) is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 is NOT present in the target. The vulnerability (missing normalizePath in FileHelper::absolutePath) was fixed by upstream Craft CMS in version 4.12.2 (commit 123e48a696, 2024-09-11, author brandon@pixelandtonic.com). The target version 4.18.9 already includes this fix from the upstream release. Line 136 of FileHelper.php contains 'return static::normalizePath($from . $ds . $to, $ds);', which is the fixed version that prevents directory traversal attacks. The vulnerable pattern (raw concatenation without normalization) is not present." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 4.18.9-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 4.18.9-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:49:00.133271+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. The target repository (Craft CMS 4.18.9) is not affected by CVE-2025-23209. The vulnerable method UpdaterController::actionRestoreDb() has been completely disabled and now throws NotSupportedException, preventing any path traversal attack that could lead to RCE. This fix was already present in upstream Craft CMS 4.18.9 before TuxCare onboarded the version. The fixing commit a19d46be78 by brandon@pixelandtonic.com (upstream vendor) shipped in the 4.18.9 release, which TuxCare subsequently onboarded via snapshot commit b1a16b0026.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "The target repository (Craft CMS 4.18.9) is not affected by CVE-2025-23209. The vulnerable method UpdaterController::actionRestoreDb() has been completely disabled and now throws NotSupportedException, preventing any path traversal attack that could lead to RCE. This fix was already present in upstream Craft CMS 4.18.9 before TuxCare onboarded the version. The fixing commit a19d46be78 by brandon@pixelandtonic.com (upstream vendor) shipped in the 4.18.9 release, which TuxCare subsequently onboarded via snapshot commit b1a16b0026." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:48:00.109414+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. The target repository (craftcms/cms version 4.18.9) is not affected by CVE-2025-32432. The RCE vulnerability, which exploited missing type validation on the transform handle parameter, was fixed in upstream version 4.14.15. The fix is present in the target's version 4.18.9, which was imported via snapshot commit b1a16b0026 on 2026-09-24. The type check at src/controllers/AssetsController.php:1208-1210 prevents non-string values (objects/arrays) from reaching the vulnerable ImageTransforms::normalizeTransform() method, blocking the RCE attack vector.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "The target repository (craftcms/cms version 4.18.9) is not affected by CVE-2025-32432. The RCE vulnerability, which exploited missing type validation on the transform handle parameter, was fixed in upstream version 4.14.15. The fix is present in the target's version 4.18.9, which was imported via snapshot commit b1a16b0026 on 2026-09-24. The type check at src/controllers/AssetsController.php:1208-1210 prevents non-string values (objects/arrays) from reaching the vulnerable ImageTransforms::normalizeTransform() method, blocking the RCE attack vector." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2025-35939 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is NOT affected by CVE-2025-35939. The vulnerability (storing unsanitized return URLs with arbitrary content/PHP code in session files) is absent because the upstream Craft CMS 4.18.9 release already included the fix. The target's src/web/User.php:473-480 contains a setReturnUrl() method that applies strip_tags() to remove HTML/PHP tags and validates URL schemes before sto...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-35939" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is NOT affected by CVE-2025-35939. The vulnerability (storing unsanitized return URLs with arbitrary content/PHP code in session files) is absent because the upstream Craft CMS 4.18.9 release already included the fix. The target's src/web/User.php:473-480 contains a setReturnUrl() method that applies strip_tags() to remove HTML/PHP tags and validates URL schemes before sto..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2025-46731 is fixed in version 4.18.9-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-46731" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2025-57811 is fixed in version 4.18.9-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-57811" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is NOT vulnerable to CVE-2025-68436. The fix that prevents mass assignment of the photoId attribute was released upstream in Craft CMS version 4.16.17 (December 2025). Version 4.18.9, released September 2026, inherits this fix. The defense code (safeAttributes() method removing 'photoId' from mass-assignable attributes) is present in the target at src/elements/User.php:924...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is NOT vulnerable to CVE-2025-68436. The fix that prevents mass assignment of the photoId attribute was released upstream in Craft CMS version 4.16.17 (December 2025). Version 4.18.9, released September 2026, inherits this fix. The defense code (safeAttributes() method removing 'photoId' from mass-assignable attributes) is present in the target at src/elements/User.php:924..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2025-68437 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 4.18.9 is not affected by CVE-2025-68437 (SSRF via GraphQL save__Asset mutation). The vulnerable pattern is not present because the upstream 4.18.9 release already includes comprehensive SSRF protection via the craftcms/url-validator package. The fix validates URLs and rejects those containing IP addresses or targeting internal resources before any connection is ma...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68437" }, "impact_statement": "not_affected \u2014 Craft CMS version 4.18.9 is not affected by CVE-2025-68437 (SSRF via GraphQL save__Asset mutation). The vulnerable pattern is not present because the upstream 4.18.9 release already includes comprehensive SSRF protection via the craftcms/url-validator package. The fix validates URLs and rejects those containing IP addresses or targeting internal resources before any connection is ma..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:34:15.412814+00:00", "status_notes": "Vulnerability CVE-2025-68454 affects version 4.18.9-p1+tuxcare of craftcms/cms, and is fixed in 4.18.9-p2+tuxcare.", "vulnerability": { "name": "CVE-2025-68454" }, "action_statement": "Vulnerability CVE-2025-68454 affects version 4.18.9-p1+tuxcare of craftcms/cms, and is fixed in 4.18.9-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:47:00.161204+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. The target version 4.18.9 is not affected by CVE-2025-68455. The vulnerability was fixed by the upstream vendor in version 4.16.17 (released 2025-12-04) via commits that add Component::cleanseConfig() calls to sanitize configuration arrays before object instantiation. Version 4.18.9 (released 2026-09-17) already contains these fixes from the upstream vendor. The fix prevents RCE via malicious Yii2 behaviors by removing \"on \" and \"as \" keys from user-provided configuration arrays, which would otherwise allow attackers to attach malicious behaviors or event handlers to dynamically configured objects.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "The target version 4.18.9 is not affected by CVE-2025-68455. The vulnerability was fixed by the upstream vendor in version 4.16.17 (released 2025-12-04) via commits that add Component::cleanseConfig() calls to sanitize configuration arrays before object instantiation. Version 4.18.9 (released 2026-09-17) already contains these fixes from the upstream vendor. The fix prevents RCE via malicious Yii2 behaviors by removing \"on \" and \"as \" keys from user-provided configuration arrays, which would otherwise allow attackers to attach malicious behaviors or event handlers to dynamically configured objects." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:49:00.133271+00:00", "status_notes": "Vulnerability CVE-2025-68456 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. The target repository (craftcms/cms version 4.18.9) is NOT AFFECTED by CVE-2025-68456. The upstream vendor fix that prevents unauthenticated database backup triggering is already present in the codebase at src/controllers/UpdaterController.php lines 72-75. This fix was shipped in upstream release 4.18.9 (commit 1718011a5f by brandon@pixelandtonic.com) before TuxCare onboarded the version. The fix adds a precondition check that only allows the actionBackup() method to execute database backups when migrations are pending, effectively preventing the DoS attack via repeated arbitrary backup requests described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68456" }, "impact_statement": "The target repository (craftcms/cms version 4.18.9) is NOT AFFECTED by CVE-2025-68456. The upstream vendor fix that prevents unauthenticated database backup triggering is already present in the codebase at src/controllers/UpdaterController.php lines 72-75. This fix was shipped in upstream release 4.18.9 (commit 1718011a5f by brandon@pixelandtonic.com) before TuxCare onboarded the version. The fix adds a precondition check that only allows the actionBackup() method to execute database backups when migrations are pending, effectively preventing the DoS attack via repeated arbitrary backup requests described in the CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-11-09T23:03:00.035941+00:00", "status_notes": "Vulnerability CVE-2026-115934 affects version 4.18.9-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115934" }, "action_statement": "Vulnerability CVE-2026-115934 affects version 4.18.9-p1+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-11-02T14:56:09.367348+00:00", "status_notes": "Vulnerability CVE-2026-115935 affects version 4.18.9-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115935" }, "action_statement": "Vulnerability CVE-2026-115935 affects version 4.18.9-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-11-04T08:12:00.074517+00:00", "status_notes": "Vulnerability CVE-2026-115938 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 The target Craft CMS 4.18.9-p2+tuxcare is NOT AFFECTED by CVE-2026-115938. The vulnerability (Twig sandbox escape in element-search conditions leading to securityKey leakage and RCE) was fixed in upstream Craft CMS 4.17.4 (Feb 11, 2026) via commit 8d4903647d by brandon@pixelandtonic.com, which changed BaseElementSelectConditionRule.php to use renderSandboxedObjectTemplate() instead of the unsan...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-115938" }, "impact_statement": "not_affected \u2014 The target Craft CMS 4.18.9-p2+tuxcare is NOT AFFECTED by CVE-2026-115938. The vulnerability (Twig sandbox escape in element-search conditions leading to securityKey leakage and RCE) was fixed in upstream Craft CMS 4.17.4 (Feb 11, 2026) via commit 8d4903647d by brandon@pixelandtonic.com, which changed BaseElementSelectConditionRule.php to use renderSandboxedObjectTemplate() instead of the unsan..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 4.18.9 is not affected by CVE-2026-25491. While the Twig template does not apply the |e escape filter to entry type names (line 28 of _entrytypes/index.twig), the architecture uses Vue.js client-side rendering with automatic HTML escaping via {{ }} interpolation syntax (App.vue:115,120). Additionally, JSON encoding provides JavaScript context protection. The CVE affects versions 5.0.0...", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Craft CMS 4.18.9 is not affected by CVE-2026-25491. While the Twig template does not apply the |e escape filter to entry type names (line 28 of _entrytypes/index.twig), the architecture uses Vue.js client-side rendering with automatic HTML escaping via {{ }} interpolation syntax (App.vue:115,120). Additionally, JSON encoding provides JavaScript context protection. The CVE affects versions 5.0.0..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-25493 (SSRF via HTTP redirect bypass) is NOT present in craftcms/cms 4.18.9. The target version already contains the upstream vendor fix (RequestOptions::ALLOW_REDIRECTS => false) from Craft CMS 4.16.18+. The vulnerability affected versions 4.0.0-RC1 through 4.16.17; target version 4.18.9 is beyond the patched threshold. The fix was implemented by Pixel & Tonic (upstream vendor) in com...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 CVE-2026-25493 (SSRF via HTTP redirect bypass) is NOT present in craftcms/cms 4.18.9. The target version already contains the upstream vendor fix (RequestOptions::ALLOW_REDIRECTS => false) from Craft CMS 4.16.18+. The vulnerability affected versions 4.0.0-RC1 through 4.16.17; target version 4.18.9 is beyond the patched threshold. The fix was implemented by Pixel & Tonic (upstream vendor) in com..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-25494 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is not affected by CVE-2026-25494. The vulnerability (hex-encoded IP bypass in saveAsset GraphQL mutation) was fixed in upstream version 4.16.18 (Jan 2026). TuxCare's snapshot of 4.18.9 (Sep 2026) already includes the fix via the craftcms/url-validator package v1.0.0, which contains hex-to-decimal normalization and cloud metadata blocklists. The vulnerable pattern (relying...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is not affected by CVE-2026-25494. The vulnerability (hex-encoded IP bypass in saveAsset GraphQL mutation) was fixed in upstream version 4.16.18 (Jan 2026). TuxCare's snapshot of 4.18.9 (Sep 2026) already includes the fix via the craftcms/url-validator package v1.0.0, which contains hex-to-decimal normalization and cloud metadata blocklists. The vulnerable pattern (relying..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:49:00.133271+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. The target (craftcms/cms v4.18.9) is NOT AFFECTED by CVE-2026-25495. The SQL injection vulnerability described in the CVE has been fixed by the upstream vendor (Pixel & Tonic) in version 4.17.4. The fix was already present when TuxCare onboarded version 4.18.9. The defense mechanism `ElementHelper::cleanseQueryCriteria()` removes dangerous SQL clause parameters (orderBy, where, select, from, groupBy, join, having, union, withQueries, params) from user-supplied criteria before database query construction, preventing arbitrary SQL injection. This is an upstream vendor fix, not a TuxCare backport, hence verdict is not_affected rather than already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "The target (craftcms/cms v4.18.9) is NOT AFFECTED by CVE-2026-25495. The SQL injection vulnerability described in the CVE has been fixed by the upstream vendor (Pixel & Tonic) in version 4.17.4. The fix was already present when TuxCare onboarded version 4.18.9. The defense mechanism `ElementHelper::cleanseQueryCriteria()` removes dangerous SQL clause parameters (orderBy, where, select, from, groupBy, join, having, union, withQueries, params) from user-supplied criteria before database query construction, preventing arbitrary SQL injection. This is an upstream vendor fix, not a TuxCare backport, hence verdict is not_affected rather than already_fixed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-25496 is NOT present in Craft CMS 4.18.9. The stored XSS vulnerability in Number field prefix/suffix rendering has been fixed by the upstream vendor. The target's Number/input.twig template includes the security fix (encode=true parameter added to the md filter on lines 28 and 43), which HTML-encodes prefix/suffix values before Markdown processing, preventing script injection. This fix...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 CVE-2026-25496 is NOT present in Craft CMS 4.18.9. The stored XSS vulnerability in Number field prefix/suffix rendering has been fixed by the upstream vendor. The target's Number/input.twig template includes the security fix (encode=true parameter added to the md filter on lines 28 and 43), which HTML-encodes prefix/suffix values before Markdown processing, preventing script injection. This fix..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:47:00.161204+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. CVE-2026-25498 (GHSA-7jx7-3846-m7w7) is NOT present in the target. The vulnerability affects Craft CMS versions 4.0.0-RC1 through 4.16.17, where assembleLayoutFromPost() in src/services/Fields.php fails to sanitize user-supplied configuration data, allowing RCE via Yii2 behavior injection. The fix was released in upstream Craft CMS 4.16.18 (2026-01-09), adding ComponentHelper::cleanseConfig() to remove malicious \"on \" and \"as \" prefixed configuration keys. The target version 4.18.9 (released 2026-09-17) already includes this upstream fix. Analysis confirmed the fix is present at Fields.php:1286, and it was imported during the snapshot/onboarding of version 4.18.9, not added by TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "CVE-2026-25498 (GHSA-7jx7-3846-m7w7) is NOT present in the target. The vulnerability affects Craft CMS versions 4.0.0-RC1 through 4.16.17, where assembleLayoutFromPost() in src/services/Fields.php fails to sanitize user-supplied configuration data, allowing RCE via Yii2 behavior injection. The fix was released in upstream Craft CMS 4.16.18 (2026-01-09), adding ComponentHelper::cleanseConfig() to remove malicious \"on \" and \"as \" prefixed configuration keys. The target version 4.18.9 (released 2026-09-17) already includes this upstream fix. Analysis confirmed the fix is present at Fields.php:1286, and it was imported during the snapshot/onboarding of version 4.18.9, not added by TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 contains the complete XSS fix that was released upstream in Craft CMS 4.16.19. The fix includes three defenses: (1) a typeOptions() whitelist excluding 'html' as a valid column type, (2) validateColumns() that rejects unsupported column types and defaults them to 'singleline', and (3) HTML encoding of 'heading' column values in _getInputHtml(). All three fixes are present ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 contains the complete XSS fix that was released upstream in Craft CMS 4.16.19. The fix includes three defenses: (1) a typeOptions() whitelist excluding 'html' as a valid column type, (2) validateColumns() that rejects unsupported column types and defaults them to 'singleline', and (3) HTML encoding of 'heading' column values in _getInputHtml(). All three fixes are present ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:47:00.161204+00:00", "status_notes": "Vulnerability CVE-2026-27127 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. Target version 4.18.9 is NOT AFFECTED by CVE-2026-27127 (DNS rebinding TOCTOU SSRF vulnerability). The upstream Craft CMS 4.18.9 release already contains the complete DNS pinning fix that prevents DNS rebinding attacks. The fix implements both CURLOPT_RESOLVE to pin DNS resolution and ON_STATS callback to validate the actual connected IP, eliminating the TOCTOU vulnerability between validation and request.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27127" }, "impact_statement": "Target version 4.18.9 is NOT AFFECTED by CVE-2026-27127 (DNS rebinding TOCTOU SSRF vulnerability). The upstream Craft CMS 4.18.9 release already contains the complete DNS pinning fix that prevents DNS rebinding attacks. The fix implements both CURLOPT_RESOLVE to pin DNS resolution and ON_STATS callback to validate the actual connected IP, eliminating the TOCTOU vulnerability between validation and request." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.9) is NOT AFFECTED by CVE-2026-27128. The TOCTOU race condition vulnerability in token validation has already been fixed by the upstream vendor. The fix (mutex-based synchronization wrapping the read-check-update sequence in getTokenRoute()) was included in upstream release 4.16.19 and is present in the target's version 4.18.9. TuxCare onboarded version 4.18.9 via sna...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.9) is NOT AFFECTED by CVE-2026-27128. The TOCTOU race condition vulnerability in token validation has already been fixed by the upstream vendor. The fix (mutex-based synchronization wrapping the read-check-update sequence in getTokenRoute()) was included in upstream release 4.16.19 and is present in the target's version 4.18.9. TuxCare onboarded version 4.18.9 via sna..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-27129 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-27129 describes an IPv6 bypass vulnerability in Craft CMS versions that use inline SSRF validation with gethostbyname(), which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, gethostbyname() returns the hostname string unchanged, bypassing IP blocklist checks. However, the target (version 4.18.9) uses a fundamentally different architecture: it delegates all ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27129" }, "impact_statement": "not_affected \u2014 CVE-2026-27129 describes an IPv6 bypass vulnerability in Craft CMS versions that use inline SSRF validation with gethostbyname(), which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, gethostbyname() returns the hostname string unchanged, bypassing IP blocklist checks. However, the target (version 4.18.9) uses a fundamentally different architecture: it delegates all ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T12:41:00.266160+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. CVE-2026-31857 affects Craft CMS versions prior to 4.17.4 and 5.9.9. The target is version 4.18.9, which already contains the upstream fix. The vulnerable code in BaseElementSelectConditionRule::getElementId() that used unsandboxed renderObjectTemplate() has been replaced with renderSandboxedObjectTemplate(). The complete Twig sandbox infrastructure with SecurityPolicy allowlist enforcement is present. The fix was shipped in upstream version 4.17.4 (released 2026-02-11), seven months before the target's base version 4.18.9 (released 2026-09-17).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "CVE-2026-31857 affects Craft CMS versions prior to 4.17.4 and 5.9.9. The target is version 4.18.9, which already contains the upstream fix. The vulnerable code in BaseElementSelectConditionRule::getElementId() that used unsandboxed renderObjectTemplate() has been replaced with renderSandboxedObjectTemplate(). The complete Twig sandbox infrastructure with SecurityPolicy allowlist enforcement is present. The fix was shipped in upstream version 4.17.4 (released 2026-02-11), seven months before the target's base version 4.18.9 (released 2026-09-17)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:48:00.109414+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. CVE-2026-31858 affects ElementSearchController::actionSearch(), which does not exist in Craft CMS 4.18.9. ElementSearchController was introduced in version 5.8.0 (April 2026), while the target is version 4.18.9 from the 4.x release line. The vulnerable component is not present in this version. Additionally, ElementIndexesController (the only controller in 4.18.9 that processes user-supplied criteria parameters from HTTP requests) applies the cleanseQueryCriteria() defense, which removes dangerous SQL-construction attributes (where, orderBy, select, join, having, union, params) before passing criteria to query configuration.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "CVE-2026-31858 affects ElementSearchController::actionSearch(), which does not exist in Craft CMS 4.18.9. ElementSearchController was introduced in version 5.8.0 (April 2026), while the target is version 4.18.9 from the 4.x release line. The vulnerable component is not present in this version. Additionally, ElementIndexesController (the only controller in 4.18.9 that processes user-supplied criteria parameters from HTTP requests) applies the cleanseQueryCriteria() defense, which removes dangerous SQL-construction attributes (where, orderBy, select, join, having, union, params) before passing criteria to query configuration." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-31859 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 4.18.9) is NOT affected by CVE-2026-31859. The vulnerability pattern (accepting dangerous URL schemes like `javascript:` in return URLs) is not present because the upstream vendor fixed it in commit cc9921c148 (Feb 6, 2026) before the 4.18.9 release. TuxCare onboarded version 4.18.9 on Oct 3, 2026, which already contained the fix. The setReturnUrl() method at sr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31859" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 4.18.9) is NOT affected by CVE-2026-31859. The vulnerability pattern (accepting dangerous URL schemes like `javascript:` in return URLs) is not present because the upstream vendor fixed it in commit cc9921c148 (Feb 6, 2026) before the 4.18.9 release. TuxCare onboarded version 4.18.9 on Oct 3, 2026, which already contained the fix. The setReturnUrl() method at sr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS version 4.18.9) is NOT affected by CVE-2026-32262. The vulnerability, a path traversal issue in the AssetsController->replaceFile() method allowing authenticated users to delete arbitrary files via the targetFilename parameter, was fixed in upstream version 4.17.5. The target version 4.18.9 is a later release that already contains the complete upstream fix. The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS version 4.18.9) is NOT affected by CVE-2026-32262. The vulnerability, a path traversal issue in the AssetsController->replaceFile() method allowing authenticated users to delete arbitrary files via the targetFilename parameter, was fixed in upstream version 4.17.5. The target version 4.18.9 is a later release that already contains the complete upstream fix. The ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:49:00.133271+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. Version 4.18.9 is not affected by CVE-2026-32263. The vulnerability exists in EntryTypesController.php::actionApplyOverrideSettings(), which was introduced in Craft CMS version 5.0 (commit 0885de776b \"Globalize entry types\"). This file and method do not exist in version 4.x. In version 4.18.9, entry type functionality is handled in SectionsController.php using manual property assignment rather than bulk configuration via Craft::configure(). All uses of Craft::configure() with HTTP request data in version 4.x controllers are protected by Component::cleanseConfig(), preventing Yii2 behavior/event handler injection. The vulnerable architectural pattern (parse_str \u2192 unsanitized array \u2192 Craft::configure) that enables the attack does not exist in this version.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "Version 4.18.9 is not affected by CVE-2026-32263. The vulnerability exists in EntryTypesController.php::actionApplyOverrideSettings(), which was introduced in Craft CMS version 5.0 (commit 0885de776b \"Globalize entry types\"). This file and method do not exist in version 4.x. In version 4.18.9, entry type functionality is handled in SectionsController.php using manual property assignment rather than bulk configuration via Craft::configure(). All uses of Craft::configure() with HTTP request data in version 4.x controllers are protected by Component::cleanseConfig(), preventing Yii2 behavior/event handler injection. The vulnerable architectural pattern (parse_str \u2192 unsanitized array \u2192 Craft::configure) that enables the attack does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:47:00.161204+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. Target version 4.18.9 is not affected by CVE-2026-32264 (GHSA-4484-8v2f-5748). The RCE vulnerability in ElementIndexesController and FieldsController was fixed by the upstream vendor (Pixel & Tonic) in version 4.17.5 (released February 2026). The target version 4.18.9 (released September 2026) already includes these security fixes as part of the upstream release that TuxCare onboarded. Both vulnerable code paths now properly sanitize configuration arrays with Component::cleanseConfig() before object instantiation, preventing the behavior injection attack.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "Target version 4.18.9 is not affected by CVE-2026-32264 (GHSA-4484-8v2f-5748). The RCE vulnerability in ElementIndexesController and FieldsController was fixed by the upstream vendor (Pixel & Tonic) in version 4.17.5 (released February 2026). The target version 4.18.9 (released September 2026) already includes these security fixes as part of the upstream release that TuxCare onboarded. Both vulnerable code paths now properly sanitize configuration arrays with Component::cleanseConfig() before object instantiation, preventing the behavior injection attack." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:47:00.161204+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. Target version 4.18.9 is not affected by CVE-2026-32267. The vulnerability was fixed in upstream version 4.17.6, and the target version 4.18.9 (released after 4.17.6) already contains the complete security fix. The fix prevents privilege escalation by enforcing route-specific token validation: tokens are now bound to specific routes and cannot be reused to access unintended endpoints like UsersController->actionImpersonateWithToken.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "Target version 4.18.9 is not affected by CVE-2026-32267. The vulnerability was fixed in upstream version 4.17.6, and the target version 4.18.9 (released after 4.17.6) already contains the complete security fix. The fix prevents privilege escalation by enforcing route-specific token validation: tokens are now bound to specific routes and cannot be reused to access unintended endpoints like UsersController->actionImpersonateWithToken." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.9 is NOT affected by CVE-2026-33051. The vulnerability exists in versions 5.9.0-beta.1 through 5.9.10 due to Template::raw() bypassing Twig's auto-escaping when rendering unencoded creator names. Version 4.18.9 uses a fundamentally different architecture (Twig templates with automatic HTML escaping) that was refactored into the vulnerable PHP-generated approach starting in version ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Version 4.18.9 is NOT affected by CVE-2026-33051. The vulnerability exists in versions 5.9.0-beta.1 through 5.9.10 due to Template::raw() bypassing Twig's auto-escaping when rendering unencoded creator names. Version 4.18.9 uses a fundamentally different architecture (Twig templates with automatic HTML escaping) that was refactored into the vulnerable PHP-generated approach starting in version ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:48:00.109414+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. Craft CMS version 4.18.9 is not affected by CVE-2026-33157. The specific vulnerability (unsanitized fieldLayouts parameter in ElementIndexesController::actionFilterHud() passed to FieldLayout::createFromConfig()) does not exist in this version. The actionFilterHud() method in 4.18.9 only processes conditionConfig parameters (which ARE sanitized at line 421), and has no fieldLayouts parameter handling at all. The vulnerable code path introduced in Craft 5.6.0 is architecturally absent from the 4.x branch. All HTTP-accessible entry points that process field layout configurations call Component::cleanseConfig() before passing data to object creation methods.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "Craft CMS version 4.18.9 is not affected by CVE-2026-33157. The specific vulnerability (unsanitized fieldLayouts parameter in ElementIndexesController::actionFilterHud() passed to FieldLayout::createFromConfig()) does not exist in this version. The actionFilterHud() method in 4.18.9 only processes conditionConfig parameters (which ARE sanitized at line 421), and has no fieldLayouts parameter handling at all. The vulnerable code path introduced in Craft 5.6.0 is architecturally absent from the 4.x branch. All HTTP-accessible entry points that process field layout configurations call Component::cleanseConfig() before passing data to object creation methods." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS version 4.18.9) is not affected by CVE-2026-33158. This vulnerability affects Craft CMS versions 4.0.0-RC1 through 4.17.7, allowing low-privileged authenticated users to read private asset content by calling the assets/edit-image endpoint with arbitrary assetIds without proper authorization checks. The vulnerability was fixed in upstream version 4.17.8 by adding...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS version 4.18.9) is not affected by CVE-2026-33158. This vulnerability affects Craft CMS versions 4.0.0-RC1 through 4.17.7, allowing low-privileged authenticated users to read private asset content by calling the assets/edit-image endpoint with arbitrary assetIds without proper authorization checks. The vulnerability was fixed in upstream version 4.17.8 by adding..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-33159 affects Craft CMS 4.0.0-RC1 to before 4.17.8, allowing unauthenticated users to execute privileged Config Sync operations. The target repository is at version 4.18.9, which includes the upstream fix released in 4.17.8. The ConfigSyncController contains the required authentication gates ($allowAnonymous=ALLOW_ANONYMOUS_NEVER and requireAdmin() in beforeAction hook) that block all ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 CVE-2026-33159 affects Craft CMS 4.0.0-RC1 to before 4.17.8, allowing unauthenticated users to execute privileged Config Sync operations. The target repository is at version 4.18.9, which includes the upstream fix released in 4.17.8. The ConfigSyncController contains the required authentication gates ($allowAnonymous=ALLOW_ANONYMOUS_NEVER and requireAdmin() in beforeAction hook) that block all ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-33160 affects Craft CMS versions 4.0.0-RC1 to before 4.17.8. The target version 4.18.9 already contains the upstream vendor's fix (requirePermission('accessCp') check at line 1205 of AssetsController.php) that prevents unauthorized access to asset transform generation. The fix was shipped in upstream release 4.18.9 before TuxCare onboarded this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 CVE-2026-33160 affects Craft CMS versions 4.0.0-RC1 to before 4.17.8. The target version 4.18.9 already contains the upstream vendor's fix (requirePermission('accessCp') check at line 1205 of AssetsController.php) that prevents unauthorized access to asset transform generation. The fix was shipped in upstream release 4.18.9 before TuxCare onboarded this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-33161 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 The target repository (craftcms/cms version 4.18.9, SHA 018c9bb626) is NOT AFFECTED by CVE-2026-33161. The vulnerability\u2014an authorization bypass allowing low-privileged users to access private asset metadata via the assets/image-editor endpoint\u2014was fixed by the upstream vendor (Craft CMS) in commit d30df31122 on February 25, 2026. This fix was included in version 4.17.8 and all subsequent relea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "not_affected \u2014 The target repository (craftcms/cms version 4.18.9, SHA 018c9bb626) is NOT AFFECTED by CVE-2026-33161. The vulnerability\u2014an authorization bypass allowing low-privileged users to access private asset metadata via the assets/image-editor endpoint\u2014was fixed by the upstream vendor (Craft CMS) in commit d30df31122 on February 25, 2026. This fix was included in version 4.17.8 and all subsequent relea..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 4.18.9 is NOT affected by CVE-2026-33162. The vulnerability concerns an authorization bypass in the \"move entry to section\" feature that allows users with only accessCp permission to move entries between sections without saveEntries permission. This feature was introduced in version 5.3.0 (commit e75a51a266) and does not exist in version 4.18.9. Git ancestry verification confi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 Craft CMS version 4.18.9 is NOT affected by CVE-2026-33162. The vulnerability concerns an authorization bypass in the \"move entry to section\" feature that allows users with only accessCp permission to move entries between sections without saveEntries permission. This feature was introduced in version 5.3.0 (commit e75a51a266) and does not exist in version 4.18.9. Git ancestry verification confi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.9 is not affected by CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset mutations). The upstream vendor refactored asset upload URL validation to use the craftcms/url-validator package (commit 26268c0210, June 2026), which validates URL schemes and blocks dangerous protocols (gopher, file, ftp, etc.) before any connection is opened. This fix was already present in the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "not_affected \u2014 Version 4.18.9 is not affected by CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset mutations). The upstream vendor refactored asset upload URL validation to use the craftcms/url-validator package (commit 26268c0210, June 2026), which validates URL schemes and blocks dangerous protocols (gopher, file, ftp, etc.) before any connection is opened. This fix was already present in the..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 The target version 4.18.9 is NOT AFFECTED by CVE-2026-41130 (GHSA-95wr-3f2v-v2wh). The vulnerable `actionResourceJs()` method in `src/controllers/AppController.php` does not exist in this version. Upstream Craft CMS removed this endpoint entirely in version 4.18.0 (released May 13, 2026), which predates TuxCare's onboarding of version 4.18.9. The SSRF attack chain is broken at the INPUT stage b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target version 4.18.9 is NOT AFFECTED by CVE-2026-41130 (GHSA-95wr-3f2v-v2wh). The vulnerable `actionResourceJs()` method in `src/controllers/AppController.php` does not exist in this version. Upstream Craft CMS removed this endpoint entirely in version 4.18.0 (released May 13, 2026), which predates TuxCare's onboarding of version 4.18.9. The SSRF attack chain is broken at the INPUT stage b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:47:00.161204+00:00", "status_notes": "Vulnerability CVE-2026-55790 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. CVE-2026-55790 XSS vulnerability in CraftSupport widget is NOT present in target version 4.18.9. The fix was included in upstream release 4.17.16 (2026-05-11) and is present at both vulnerable locations: (1) line 382 uses Craft.escapeHtml() to escape GitHub issue titles before rendering, and (2) lines 555-557 use jQuery's text: option for error messages. The target version 4.18.9 (released 2026-09-17) includes this upstream vendor fix. TuxCare onboarded the already-fixed version via snapshot commit b1a16b0026.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55790" }, "impact_statement": "CVE-2026-55790 XSS vulnerability in CraftSupport widget is NOT present in target version 4.18.9. The fix was included in upstream release 4.17.16 (2026-05-11) and is present at both vulnerable locations: (1) line 382 uses Craft.escapeHtml() to escape GitHub issue titles before rendering, and (2) lines 555-557 use jQuery's text: option for error messages. The target version 4.18.9 (released 2026-09-17) includes this upstream vendor fix. TuxCare onboarded the already-fixed version via snapshot commit b1a16b0026." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-55793 is fixed in version 4.18.9-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55793" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.9 is not affected by CVE-2026-56381. While the code has missing |e filters in some Twig templates (src/templates/settings/users/groups/_index.twig line 29), three layers of ambient framework defenses provide comprehensive protection: (1) Twig's default HTML auto-escaping for server-side rendering, (2) JSON string escaping preventing JavaScript injection, and (3) Vue's mustache inte...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Version 4.18.9 is not affected by CVE-2026-56381. While the code has missing |e filters in some Twig templates (src/templates/settings/users/groups/_index.twig line 29), three layers of ambient framework defenses provide comprehensive protection: (1) Twig's default HTML auto-escaping for server-side rendering, (2) JSON string escaping preventing JavaScript injection, and (3) Vue's mustache inte..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:47:00.161204+00:00", "status_notes": "Vulnerability CVE-2026-56382 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. Target version 4.18.9 is NOT affected by CVE-2026-56382. The vulnerable method actionRenderCardPreview() was introduced in version 5.5.0, after this version. The CVE's stated affected range (>= 5.5.0 and <= 5.9.13) correctly excludes version 4.18.9. No alternative vulnerable code path exists in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56382" }, "impact_statement": "Target version 4.18.9 is NOT affected by CVE-2026-56382. The vulnerable method actionRenderCardPreview() was introduced in version 5.5.0, after this version. The CVE's stated affected range (>= 5.5.0 and <= 5.9.13) correctly excludes version 4.18.9. No alternative vulnerable code path exists in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-56383 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 The target Craft CMS 4.18.9 is NOT AFFECTED by CVE-2026-56383 (stored XSS in Table field row headings). The vulnerability was fixed by the upstream vendor (Pixel & Tonic) in version 4.16.19, and this fix is present in version 4.18.9. The fix HTML-encodes heading cell values in _getInputHtml() before rendering, preventing XSS. The vulnerable pattern does not exist in the target because the upstr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56383" }, "impact_statement": "not_affected \u2014 The target Craft CMS 4.18.9 is NOT AFFECTED by CVE-2026-56383 (stored XSS in Table field row headings). The vulnerability was fixed by the upstream vendor (Pixel & Tonic) in version 4.16.19, and this fix is present in version 4.18.9. The fix HTML-encodes heading cell values in _getInputHtml() before rendering, preventing XSS. The vulnerable pattern does not exist in the target because the upstr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-56384 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-56384 affects Craft CMS versions >= 4.0.0-RC1, <= 4.17.7, and was fixed in 4.17.8. The target repository is at version 4.18.9, which already contains the upstream vendor fix. The vulnerability involved missing authorization checks in the assets/preview-thumb and assets/preview-file endpoints. Both methods now include requireVolumePermissionByAsset() and requirePeerVolumePermissionByAss...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56384" }, "impact_statement": "not_affected \u2014 CVE-2026-56384 affects Craft CMS versions >= 4.0.0-RC1, <= 4.17.7, and was fixed in 4.17.8. The target repository is at version 4.18.9, which already contains the upstream vendor fix. The vulnerability involved missing authorization checks in the assets/preview-thumb and assets/preview-file endpoints. Both methods now include requireVolumePermissionByAsset() and requirePeerVolumePermissionByAss..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-56385 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is not affected by CVE-2026-56385. The vulnerability affects Craft CMS versions <= 4.17.7, with the fix released in 4.17.8. Version 4.18.9 already includes the upstream fix (permission checks in actionPreviewFile method at lines 1258-1259) that was shipped in the upstream release before TuxCare onboarded this version. The authorization bypass vulnerability pattern is not p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56385" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is not affected by CVE-2026-56385. The vulnerability affects Craft CMS versions <= 4.17.7, with the fix released in 4.17.8. Version 4.18.9 already includes the upstream fix (permission checks in actionPreviewFile method at lines 1258-1259) that was shipped in the upstream release before TuxCare onboarded this version. The authorization bypass vulnerability pattern is not p..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-11-08T14:16:00.068422+00:00", "status_notes": "Vulnerability CVE-2026-56393 affects version 4.18.9-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56393" }, "action_statement": "Vulnerability CVE-2026-56393 affects version 4.18.9-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:49:00.133271+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. Target version 4.18.9 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint was fixed in upstream Craft CMS version 4.17.5 (released 2026-02-17), and version 4.18.9 (released 2026-09-17) inherits this fix. All three entry points (iconUrl, iconPath, iconSvg) validate the extension parameter using regex /^\\w+$/ to reject path traversal sequences before constructing file paths.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "Target version 4.18.9 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint was fixed in upstream Craft CMS version 4.17.5 (released 2026-02-17), and version 4.18.9 (released 2026-09-17) inherits this fix. All three entry points (iconUrl, iconPath, iconSvg) validate the extension parameter using regex /^\\w+$/ to reject path traversal sequences before constructing file paths." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 The XSS vulnerability (GHSA-wf98-vxv9-jqfv) in the Feeds widget is NOT present in the target. The fix was already included in upstream Craft CMS 4.18.9 when TuxCare onboarded it. The vulnerability allowed malicious javascript: URLs in feed item permalinks to execute XSS. The upstream fix (originally applied in Craft 3.7.29 by brandon@pixelandtonic.com) adds a regex filter rejecting any permalin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The XSS vulnerability (GHSA-wf98-vxv9-jqfv) in the Feeds widget is NOT present in the target. The fix was already included in upstream Craft CMS 4.18.9 when TuxCare onboarded it. The vulnerability allowed malicious javascript: URLs in feed item permalinks to execute XSS. The upstream fix (originally applied in Craft 3.7.29 by brandon@pixelandtonic.com) adds a regex filter rejecting any permalin..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is not affected by CVE-2021-27902. The vulnerability allowed XSS via uploaded .htm/.html files in versions before 3.6.0. The fix (commit 8ee85a8f03) removed 'htm' and 'html' from the default allowedFileExtensions list. This fix was already present in the upstream Craft CMS 4.18.7 release that TuxCare onboarded, authored by Brandon Kelly (brandon@pixelandto...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is not affected by CVE-2021-27902. The vulnerability allowed XSS via uploaded .htm/.html files in versions before 3.6.0. The fix (commit 8ee85a8f03) removed 'htm' and 'html' from the default allowedFileExtensions list. This fix was already present in the upstream Craft CMS 4.18.7 release that TuxCare onboarded, authored by Brandon Kelly (brandon@pixelandto..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 4.18.7-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 4.18.7-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-32470 (XSS in tab name prompt) is NOT present in the target. The upstream vendor fixed this vulnerability in commit f9378aa154 (April 2021) by wrapping the prompt() result with Craft.escapeHtml() in FieldLayoutDesigner.js:150. This fix was already included in the upstream release before TuxCare onboarded version 4.18.7. The vulnerable code pattern (unescaped user input from prompt dire...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 CVE-2021-32470 (XSS in tab name prompt) is NOT present in the target. The upstream vendor fixed this vulnerability in commit f9378aa154 (April 2021) by wrapping the prompt() result with Craft.escapeHtml() in FieldLayoutDesigner.js:150. This fix was already included in the upstream release before TuxCare onboarded version 4.18.7. The vulnerable code pattern (unescaped user input from prompt dire..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 4.18.7-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 4.18.7-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 (XSS in Craft CMS before 3.7.29) is not present in target version 4.18.7. The vulnerability allowed JavaScript execution via malicious feed item permalinks (e.g., javascript: URIs) in the FeedWidget. The fix (commit 7ca2b2d2cc) adds permalink URL scheme validation to reject non-HTTP(S) URIs. This fix was shipped in upstream release 3.7.29 (Jan 2022) and is present in the target c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 (XSS in Craft CMS before 3.7.29) is not present in target version 4.18.7. The vulnerability allowed JavaScript execution via malicious feed item permalinks (e.g., javascript: URIs) in the FeedWidget. The fix (commit 7ca2b2d2cc) adds permalink URL scheme validation to reject non-HTTP(S) URIs. This fix was shipped in upstream release 3.7.29 (Jan 2022) and is present in the target c..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 4.18.7-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 4.18.7-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS 4.2.0.1 due to missing HTML encoding on user-controllable content (revision notes, tab names, group names, address titles). The vulnerability was fixed by upstream Craft CMS developers (Pixel & Tonic) in version 4.2.1 (released 2022-08-09) via commits that added Html::encode() to all affected output locations. Target version 4.18.7 inherits the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS 4.2.0.1 due to missing HTML encoding on user-controllable content (revision notes, tab names, group names, address titles). The vulnerability was fixed by upstream Craft CMS developers (Pixel & Tonic) in version 4.2.1 (released 2022-08-09) via commits that added Html::encode() to all affected output locations. Target version 4.18.7 inherits the..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 4.18.7-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 4.18.7-p2+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 4.18.7-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 4.18.7-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-30177 (XSS in Volume Name) is not present in target version 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream Craft CMS in version 4.4.0-beta.1 (commit 1381993c81, Dec 22, 2022) by adding Html::encode() to the volume name display in asset metadata. The fix was already present in the upstream release when TuxCare onboarded version 4.18.7. Both identified volume name d...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 CVE-2023-30177 (XSS in Volume Name) is not present in target version 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream Craft CMS in version 4.4.0-beta.1 (commit 1381993c81, Dec 22, 2022) by adding Html::encode() to the volume name display in asset metadata. The fix was already present in the upstream release when TuxCare onboarded version 4.18.7. Both identified volume name d..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-31144 is not present in target craftcms/cms 4.18.7. The vulnerability involved XSS through unescaped forward slashes in JSON encoding when feed titles containing malicious sequences like `` were embedded in HTML script tags. The upstream vendor (Pixel & Tonic) fixed this in commit e2f7e7b7d86a0afa54ce855375d13c7760670764 by removing JSON_UNESCAPED_SLASHES from the default enco...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "not_affected \u2014 CVE-2023-31144 is not present in target craftcms/cms 4.18.7. The vulnerability involved XSS through unescaped forward slashes in JSON encoding when feed titles containing malicious sequences like `` were embedded in HTML script tags. The upstream vendor (Pixel & Tonic) fixed this in commit e2f7e7b7d86a0afa54ce855375d13c7760670764 by removing JSON_UNESCAPED_SLASHES from the default enco..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in craftcms/cms 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream vendor (Pixel & Tonic) in commit 9d0cd0bd (April 2023) and shipped in version 3.8.10. The target version 4.18.7 includes this upstream fix. The vulnerable pattern ($('
  • ' + error + '
    • ')) does not exist; instead, the safe pattern (...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in craftcms/cms 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream vendor (Pixel & Tonic) in commit 9d0cd0bd (April 2023) and shipped in version 3.8.10. The target version 4.18.7 includes this upstream fix. The vulnerable pattern ($('
  • ' + error + '
    • ')) does not exist; instead, the safe pattern (..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-11-03T08:53:00.046847+00:00", "status_notes": "Vulnerability CVE-2023-33495 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. craftcms/cms 4.18.7 already contains upstream commit 57334cd435 (released in 4.17.0, 'Escape checkbox labels by default in JS'): Craft.ui.createSelect sets option labels via $option.text() with opt-in labelHtml, so the export-modal exporter-name HTML injection (GHSA-m3v5-gjj9-rg24, affected <= 4.4.9) is not exploitable. The TuxCare 3.9.15 fix (PHPELSCVE-271, b7d336d299) is not needed and would double-escape. Jira: PHPELSCVE-992.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33495" }, "impact_statement": "craftcms/cms 4.18.7 already contains upstream commit 57334cd435 (released in 4.17.0, 'Escape checkbox labels by default in JS'): Craft.ui.createSelect sets option labels via $option.text() with opt-in labelHtml, so the export-modal exporter-name HTML injection (GHSA-m3v5-gjj9-rg24, affected <= 4.4.9) is not exploitable. The TuxCare 3.9.15 fix (PHPELSCVE-271, b7d336d299) is not needed and would double-escape. Jira: PHPELSCVE-992." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:37:57.469921+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. CVE-2023-36260 describes a DoS vulnerability triggered via the Feed Me plugin when saving a feed with Asset element type but no volume selected. The vulnerable code pattern exists in craftcms/cms at src/elements/Asset.php:2938 (calling getFolderById($folderId)->getVolume() without null check), which would cause a fatal error if folderId is null. However, analysis of all Craft CMS's own entry points (GraphQL mutations, HTTP upload controllers, validation rules) shows they properly validate and set folderId before saving Assets. The vulnerable code path is not reachable through craftcms/cms's own production code - it requires a third-party plugin like Feed Me that creates Assets without properly setting folderId. Verdict: not_affected (Rule 5 Type A2 - code_not_reachable).", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "CVE-2023-36260 describes a DoS vulnerability triggered via the Feed Me plugin when saving a feed with Asset element type but no volume selected. The vulnerable code pattern exists in craftcms/cms at src/elements/Asset.php:2938 (calling getFolderById($folderId)->getVolume() without null check), which would cause a fatal error if folderId is null. However, analysis of all Craft CMS's own entry points (GraphQL mutations, HTTP upload controllers, validation rules) shows they properly validate and set folderId before saving Assets. The vulnerable code path is not reachable through craftcms/cms's own production code - it requires a third-party plugin like Feed Me that creates Assets without properly setting folderId. Verdict: not_affected (Rule 5 Type A2 - code_not_reachable)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2023-40035 affects version 4.18.7-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-40035" }, "action_statement": "Vulnerability CVE-2023-40035 affects version 4.18.7-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2024-21622 describes privilege escalation vulnerabilities in Craft CMS fixed by two upstream commits: ca0576b3ed (UsersController username parameter restriction) and 42f929e777 (ElementsController TOCTOU authorization fix). Both fixes were authored by Pixel & Tonic developers (brad@pixelandtonic.com) in November 2023 and were already present in the upstream Craft CMS 4.18.7 release that Tux...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "not_affected \u2014 CVE-2024-21622 describes privilege escalation vulnerabilities in Craft CMS fixed by two upstream commits: ca0576b3ed (UsersController username parameter restriction) and 42f929e777 (ElementsController TOCTOU authorization fix). Both fixes were authored by Pixel & Tonic developers (brad@pixelandtonic.com) in November 2023 and were already present in the upstream Craft CMS 4.18.7 release that Tux..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 4.18.7-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 4.18.7-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS version 4.18.7, while CVE-2024-41800 specifically affects Craft CMS 5's TOTP (Time-based One-Time Password) two-factor authentication feature. The TOTP 2FA functionality does not exist in Craft CMS 4.x at all. Exhaustive searches across the entire codebase found no TOTP-related code, no Google2FA library dependency, no auth/methods directory structure, no Auth...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS version 4.18.7, while CVE-2024-41800 specifically affects Craft CMS 5's TOTP (Time-based One-Time Password) two-factor authentication feature. The TOTP 2FA functionality does not exist in Craft CMS 4.x at all. Exhaustive searches across the entire codebase found no TOTP-related code, no Google2FA library dependency, no auth/methods directory structure, no Auth..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-19T17:43:00.093682+00:00", "status_notes": "Vulnerability CVE-2024-52291 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. craftcms/cms 4.18.7 is not affected by CVE-2024-52291 (GHSA-jrh5-vhr9-qh7q). The advisory affects 4.x only up to <= 4.12.4.1 (patched 4.12.5). The upstream fix 1bc4eaa40a (Fixed GHSA-jrh5-vhr9-qh7q, first tagged 4.12.5) replaced the single-prefix StringHelper::removeLeft($path, 'file://') in FileHelper::normalizePath() with a regex that strips all consecutive file:// prefixes, closing the file://file://// local filesystem validation bypass. The fixed code is present on tuxcare-current/4.18.7.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52291" }, "impact_statement": "craftcms/cms 4.18.7 is not affected by CVE-2024-52291 (GHSA-jrh5-vhr9-qh7q). The advisory affects 4.x only up to <= 4.12.4.1 (patched 4.12.5). The upstream fix 1bc4eaa40a (Fixed GHSA-jrh5-vhr9-qh7q, first tagged 4.12.5) replaced the single-prefix StringHelper::removeLeft($path, 'file://') in FileHelper::normalizePath() with a regex that strips all consecutive file:// prefixes, closing the file://file://// local filesystem validation bypass. The fixed code is present on tuxcare-current/4.18.7." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-13T11:38:04.564831+00:00", "status_notes": "Vulnerability CVE-2024-52292 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. The target repository (Craft CMS 4.18.7-p1+tuxcare) is NOT AFFECTED by CVE-2024-52292. The upstream vendor (Craft CMS / Pixel & Tonic) already fixed the arbitrary file read vulnerability in commit 3ee85a48c1 (Oct 21, 2024) by adding path containment validation to the Html::dataUrl() function. This fix was already present in the upstream codebase when TuxCare onboarded version 4.18.7 (PHPELS-197). The defense restricts file access to within the project root directory, preventing the attack vector described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52292" }, "impact_statement": "The target repository (Craft CMS 4.18.7-p1+tuxcare) is NOT AFFECTED by CVE-2024-52292. The upstream vendor (Craft CMS / Pixel & Tonic) already fixed the arbitrary file read vulnerability in commit 3ee85a48c1 (Oct 21, 2024) by adding path containment validation to the Html::dataUrl() function. This fix was already present in the upstream codebase when TuxCare onboarded version 4.18.7 (PHPELS-197). The defense restricts file access to within the project root directory, preventing the attack vector described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. CVE-2024-52293 is NOT present in the target. The vulnerability required missing normalizePath() in FileHelper::absolutePath() line 136, allowing path traversal sequences like `../templates/poc` to bypass system directory security checks. The target code contains the upstream vendor's fix: `return static::normalizePath($from . $ds . $to, $ds);` which resolves traversal sequences before the path is used in security validations. This fix was introduced in upstream Craft CMS version 4.12.2 (commit 123e48a696 by brandon@pixelandtonic.com on 2024-09-11). The target version 4.18.7 naturally includes all fixes from 4.12.2. TuxCare onboarded the pre-fixed version 4.18.7; there is no separate TuxCare backport for this CVE on this version line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 is NOT present in the target. The vulnerability required missing normalizePath() in FileHelper::absolutePath() line 136, allowing path traversal sequences like `../templates/poc` to bypass system directory security checks. The target code contains the upstream vendor's fix: `return static::normalizePath($from . $ds . $to, $ds);` which resolves traversal sequences before the path is used in security validations. This fix was introduced in upstream Craft CMS version 4.12.2 (commit 123e48a696 by brandon@pixelandtonic.com on 2024-09-11). The target version 4.18.7 naturally includes all fixes from 4.12.2. TuxCare onboarded the pre-fixed version 4.18.7; there is no separate TuxCare backport for this CVE on this version line." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 4.18.7-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 4.18.7-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-23209 fix a19d46be78a9 by brandon@pixelandtonic.com (2025-07-07) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-23209 fix a19d46be78a9 by brandon@pixelandtonic.com (2025-07-07) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. CVE-2025-32432 RCE vulnerability is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this type confusion vulnerability in commit e1c85441 (2025-04-10) by adding string type validation for the 'handle' parameter in AssetsController::actionGenerateTransform(). This fix was included in upstream release 4.18.7 (2026-08-18), which TuxCare subsequently onboarded to ELS on 2026-09-07. The target code at HEAD (b16f3f8a9b) contains the complete fix: lines 1208-1210 validate that $handle is a string before use, exactly matching the vendor patch. The CVE affects versions 4.0.0-RC1 to before 4.14.15; target version 4.18.7 is after the fixed version. Attribution: upstream vendor fix (no TuxCare authorship signal).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "CVE-2025-32432 RCE vulnerability is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this type confusion vulnerability in commit e1c85441 (2025-04-10) by adding string type validation for the 'handle' parameter in AssetsController::actionGenerateTransform(). This fix was included in upstream release 4.18.7 (2026-08-18), which TuxCare subsequently onboarded to ELS on 2026-09-07. The target code at HEAD (b16f3f8a9b) contains the complete fix: lines 1208-1210 validate that $handle is a string before use, exactly matching the vendor patch. The CVE affects versions 4.0.0-RC1 to before 4.14.15; target version 4.18.7 is after the fixed version. Attribution: upstream vendor fix (no TuxCare authorship signal)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2025-35939 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2025-35939 is not present in the target. The vulnerability involves storing unsanitized return URLs containing arbitrary HTML/PHP code in session files. The upstream vendor (Craft CMS) shipped the fix in version 4.18.7, which strips HTML/PHP tags via strip_tags() and validates URL schemes before storing return URLs in the session. TuxCare onboarded this version with the fix already present....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-35939" }, "impact_statement": "not_affected \u2014 CVE-2025-35939 is not present in the target. The vulnerability involves storing unsanitized return URLs containing arbitrary HTML/PHP code in session files. The upstream vendor (Craft CMS) shipped the fix in version 4.18.7, which strips HTML/PHP tags via strip_tags() and validates URL schemes before storing return URLs in the session. TuxCare onboarded this version with the fix already present...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. Not affected: CVE-2025-46731 affects Craft CMS 4.x prior to 4.14.13 and is fixed upstream in 4.14.13; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (c3f75107a4b4d00f802a56f23aa57cde134df838).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "Not affected: CVE-2025-46731 affects Craft CMS 4.x prior to 4.14.13 and is fixed upstream in 4.14.13; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (c3f75107a4b4d00f802a56f23aa57cde134df838)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2025-57811 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. Not affected: CVE-2025-57811 affects Craft CMS 4.0.0-RC1 through 4.16.5 and is fixed upstream in 4.16.6; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (e77f8a287dcdda41f1724f525d03542f18566cbc).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-57811" }, "impact_statement": "Not affected: CVE-2025-57811 affects Craft CMS 4.0.0-RC1 through 4.16.5 and is fixed upstream in 4.16.6; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (e77f8a287dcdda41f1724f525d03542f18566cbc)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68436 fix 4bcb0db554e2 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68436 fix 4bcb0db554e2 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2025-68437 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68437 fix 013db636fdb3 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68437" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68437 fix 013db636fdb3 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2025-68454 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. Not affected: CVE-2025-68454 affects Craft CMS 4.0.0-RC1 through 4.16.16 and is fixed upstream in 4.16.17; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (d82680f4a05f9576883bb83c3f6243d33ca73ebe).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68454" }, "impact_statement": "Not affected: CVE-2025-68454 affects Craft CMS 4.0.0-RC1 through 4.16.16 and is fixed upstream in 4.16.17; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (d82680f4a05f9576883bb83c3f6243d33ca73ebe)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. Version 4.18.7 is not affected by CVE-2025-68455. The vulnerability was fixed by upstream vendor (Craft CMS/Pixel & Tonic) in version 4.16.17 via commit ec43c497ed (released 2025-12-04). Target version 4.18.7 (released 2026-08-18) is newer and includes this fix plus additional hardening. The fix adds Component::cleanseConfig() to remove dangerous config keys (\"on \" event handlers and \"as \" behaviors) before object instantiation, preventing malicious behavior attachment and RCE. TuxCare later adopted version 4.18.7 into their ELS program, inheriting the upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Version 4.18.7 is not affected by CVE-2025-68455. The vulnerability was fixed by upstream vendor (Craft CMS/Pixel & Tonic) in version 4.16.17 via commit ec43c497ed (released 2025-12-04). Target version 4.18.7 (released 2026-08-18) is newer and includes this fix plus additional hardening. The fix adds Component::cleanseConfig() to remove dangerous config keys (\"on \" event handlers and \"as \" behaviors) before object instantiation, preventing malicious behavior attachment and RCE. TuxCare later adopted version 4.18.7 into their ELS program, inheriting the upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2025-68456 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68456 fix 1718011a5faa by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68456" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68456 fix 1718011a5faa by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-11-09T23:08:00.049119+00:00", "status_notes": "Vulnerability CVE-2026-115934 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 4.18.7 builds search SQL by string interpolation (src/services/Search.php), but every user-controlled fragment is sanitized first. Search terms go through SearchHelper::normalizeKeywords, which strips quotes, backslashes, semicolons and other punctuation. Attribute names are limited to \\w+. Field IDs are integers. I found no unauthenticated element search endpoint in the target. No ve...", "vulnerability": { "name": "CVE-2026-115934" }, "impact_statement": "not_affected \u2014 Craft CMS 4.18.7 builds search SQL by string interpolation (src/services/Search.php), but every user-controlled fragment is sanitized first. Search terms go through SearchHelper::normalizeKeywords, which strips quotes, backslashes, semicolons and other punctuation. Attribute names are limited to \\w+. Field IDs are integers. I found no unauthenticated element search endpoint in the target. No ve..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T13:01:41.506821+00:00", "status_notes": "Vulnerability CVE-2026-115935 affects version 4.18.7-p2+tuxcare of craftcms/cms, and is fixed in 4.18.7-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-115935" }, "action_statement": "Vulnerability CVE-2026-115935 affects version 4.18.7-p2+tuxcare of craftcms/cms, and is fixed in 4.18.7-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-28T13:01:41.506821+00:00", "status_notes": "Vulnerability CVE-2026-115938 affects version 4.18.7-p2+tuxcare of craftcms/cms, and is fixed in 4.18.7-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-115938" }, "action_statement": "Vulnerability CVE-2026-115938 affects version 4.18.7-p2+tuxcare of craftcms/cms, and is fixed in 4.18.7-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.7 is NOT AFFECTED by CVE-2026-25491. The vulnerability (stored XSS via unescaped entry type names) affects Craft CMS 5.0.0-RC1 through 5.8.21, where the architecture changed from Vue.js client-side rendering to PHP server-side rendering. In version 4.18.7, entry type names are rendered through Vue.js's default {{ }} interpolation (App.vue:115,120), which automatically applies HTML ...", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 4.18.7 is NOT AFFECTED by CVE-2026-25491. The vulnerability (stored XSS via unescaped entry type names) affects Craft CMS 5.0.0-RC1 through 5.8.21, where the architecture changed from Vue.js client-side rendering to PHP server-side rendering. In version 4.18.7, entry type names are rendered through Vue.js's default {{ }} interpolation (App.vue:115,120), which automatically applies HTML ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-25493. The upstream vendor fixed this SSRF redirect bypass vulnerability in commit 26268c0210 (June 2026), which was included in the 4.18.7 release (August 2026). The target code disables HTTP redirects at line 318 (`RequestOptions::ALLOW_REDIRECTS => false`) in the downloadUrl method, preventing attackers from bypassing validation ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-25493. The upstream vendor fixed this SSRF redirect bypass vulnerability in commit 26268c0210 (June 2026), which was included in the 4.18.7 release (August 2026). The target code disables HTTP redirects at line 318 (`RequestOptions::ALLOW_REDIRECTS => false`) in the downloadUrl method, preventing attackers from bypassing validation ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-25494 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-25494 describes a hex IP notation bypass of filter_var() validation in the saveAsset GraphQL mutation. The target (4.18.7) is NOT AFFECTED because the vulnerable code pattern has been completely replaced by an upstream vendor refactoring. On June 15, 2026, upstream author brandon@pixelandtonic.com (commit 26268c0210) replaced the inline filter_var() validation with the craftcms/url-val...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "not_affected \u2014 CVE-2026-25494 describes a hex IP notation bypass of filter_var() validation in the saveAsset GraphQL mutation. The target (4.18.7) is NOT AFFECTED because the vulnerable code pattern has been completely replaced by an upstream vendor refactoring. On June 15, 2026, upstream author brandon@pixelandtonic.com (commit 26268c0210) replaced the inline filter_var() validation with the craftcms/url-val..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. Craft CMS 4.18.7 is not affected by CVE-2026-25495. The upstream vendor (Pixel & Tonic) fixed this SQL injection vulnerability in version 4.16.18 (released 2026-01-09) by removing dangerous SQL query construction parameters from user-provided criteria before database query configuration. The fix was refactored into ElementHelper::cleanseQueryCriteria() in version 4.17.4 (released 2026-02-11). The target version 4.18.7 (released 2026-08-18) inherits this upstream fix. The vulnerable pattern is not present in the target because an upstream-authored fix is already applied in the shipped version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "Craft CMS 4.18.7 is not affected by CVE-2026-25495. The upstream vendor (Pixel & Tonic) fixed this SQL injection vulnerability in version 4.16.18 (released 2026-01-09) by removing dangerous SQL query construction parameters from user-provided criteria before database query configuration. The fix was refactored into ElementHelper::cleanseQueryCriteria() in version 4.17.4 (released 2026-02-11). The target version 4.18.7 (released 2026-08-18) inherits this upstream fix. The vulnerable pattern is not present in the target because an upstream-authored fix is already applied in the shipped version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is not affected by CVE-2026-25496. The upstream vendor (Craft CMS / Pixel & Tonic) fixed the stored XSS vulnerability in commit 93837b626f on 2026-01-05 by adding HTML encoding to the Number field's Prefix and Suffix rendering. This fix was included in the upstream 4.18.7 release (finalized 2026-08-18), which TuxCare inherited when onboarding this version. The vulnerable p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is not affected by CVE-2026-25496. The upstream vendor (Craft CMS / Pixel & Tonic) fixed the stored XSS vulnerability in commit 93837b626f on 2026-01-05 by adding HTML encoding to the Number field's Prefix and Suffix rendering. This fix was included in the upstream 4.18.7 release (finalized 2026-08-18), which TuxCare inherited when onboarding this version. The vulnerable p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. Target version 4.18.7 is not vulnerable to CVE-2026-25498. The upstream vendor (Pixel & Tonic) fixed the RCE vulnerability in commit 395c64f0b8 on 2026-01-09 by adding ComponentHelper::cleanseConfig() sanitization before passing user-supplied field layout configuration to object creation. This fix was included in the upstream 4.18.7 release (2026-08-18) which TuxCare subsequently onboarded for Extended Lifecycle Support. The vulnerable pattern (unsanitized config data passed directly to createLayout) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "Target version 4.18.7 is not vulnerable to CVE-2026-25498. The upstream vendor (Pixel & Tonic) fixed the RCE vulnerability in commit 395c64f0b8 on 2026-01-09 by adding ComponentHelper::cleanseConfig() sanitization before passing user-supplied field layout configuration to object creation. This fix was included in the upstream 4.18.7 release (2026-08-18) which TuxCare subsequently onboarded for Extended Lifecycle Support. The vulnerable pattern (unsanitized config data passed directly to createLayout) is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (CVE-2026-27126) affecting versions 4.5.0-RC1 through 4.16.18 was patched in upstream version 4.16.19. The target version 4.18.7 inherited the complete fix from upstream commit f5d488d9bb (authored by brandon@pixelandtonic.com on 2026-01-14). The fix validates table column types against a whitelist and converts unsupported types (includin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (CVE-2026-27126) affecting versions 4.5.0-RC1 through 4.16.18 was patched in upstream version 4.16.19. The target version 4.18.7 inherited the complete fix from upstream commit f5d488d9bb (authored by brandon@pixelandtonic.com on 2026-01-14). The fix validates table column types against a whitelist and converts unsupported types (includin..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-27127 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-27127 (DNS rebinding TOCTOU SSRF). The upstream vendor (Pixel & Tonic) deployed a comprehensive fix in commit 26268c0210 (June 15, 2026) that implements DNS pinning via CURLOPT_RESOLVE and pre-validates IPs through the craftcms/url-validator package. This fix was naturally included in version 4.18.7 (released August 18, 2026). The vulnerable pattern (separate DNS lookups without pinning) has been completely removed from the codebase. This is a vendor-authored fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27127" }, "impact_statement": "The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-27127 (DNS rebinding TOCTOU SSRF). The upstream vendor (Pixel & Tonic) deployed a comprehensive fix in commit 26268c0210 (June 15, 2026) that implements DNS pinning via CURLOPT_RESOLVE and pre-validates IPs through the craftcms/url-validator package. This fix was naturally included in version 4.18.7 (released August 18, 2026). The vulnerable pattern (separate DNS lookups without pinning) has been completely removed from the codebase. This is a vendor-authored fix, not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 The target repository at version 4.18.7 is NOT vulnerable to CVE-2026-27128. The TOCTOU race condition fix was applied by the upstream vendor (Pixel & Tonic) in commit 3e4afe1827 as part of version 4.16.19 (released 2026-01-15). Version 4.18.7, being newer than 4.16.19, naturally includes this fix. The getTokenRoute() method in src/services/Tokens.php correctly uses mutex locking to ensure atom...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target repository at version 4.18.7 is NOT vulnerable to CVE-2026-27128. The TOCTOU race condition fix was applied by the upstream vendor (Pixel & Tonic) in commit 3e4afe1827 as part of version 4.16.19 (released 2026-01-15). Version 4.18.7, being newer than 4.16.19, naturally includes this fix. The getTokenRoute() method in src/services/Tokens.php correctly uses mutex locking to ensure atom..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-27129 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) is NOT AFFECTED by CVE-2026-27129. The vulnerable pattern (using gethostbyname() which only resolves IPv4) is absent because the upstream vendor refactored the code to use the craftcms/url-validator library (commit 26268c0210, Jun 2026). This library uses dns_get_record() with both DNS_A and DNS_AAAA records, and includes comprehensive IPv6 validation via FILTER_FL...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27129" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.7) is NOT AFFECTED by CVE-2026-27129. The vulnerable pattern (using gethostbyname() which only resolves IPv4) is absent because the upstream vendor refactored the code to use the craftcms/url-validator library (commit 26268c0210, Jun 2026). This library uses dns_get_record() with both DNS_A and DNS_AAAA records, and includes comprehensive IPv6 validation via FILTER_FL..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. The target craftcms/cms 4.18.7 contains the upstream vendor fix for CVE-2026-31857. The vulnerable unsandboxed Twig rendering call has been replaced with the sandboxed version in BaseElementSelectConditionRule.php line 88. Fix commit 8d4903647d was authored by brandon@pixelandtonic.com (Craft CMS upstream vendor) as part of the 4.17.4 release, and is included in the 4.18.7 version onboarded by TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "The target craftcms/cms 4.18.7 contains the upstream vendor fix for CVE-2026-31857. The vulnerable unsandboxed Twig rendering call has been replaced with the sandboxed version in BaseElementSelectConditionRule.php line 88. Fix commit 8d4903647d was authored by brandon@pixelandtonic.com (Craft CMS upstream vendor) as part of the 4.17.4 release, and is included in the 4.18.7 version onboarded by TuxCare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. CVE-2026-31858 does not affect Craft CMS version 4.18.7. The vulnerable component ElementSearchController was introduced in Craft CMS 5.x and does not exist in version 4.x. The target repository is running version 4.18.7, which predates the introduction of this controller. The only controller in version 4.18.7 that processes user query criteria (ElementIndexesController) already contains the proper defense mechanism (ElementHelper::cleanseQueryCriteria()) that was added for CVE-2026-25495. No alternative code path exists in version 4.18.7 that exhibits the same SQL injection vulnerability pattern.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "CVE-2026-31858 does not affect Craft CMS version 4.18.7. The vulnerable component ElementSearchController was introduced in Craft CMS 5.x and does not exist in version 4.x. The target repository is running version 4.18.7, which predates the introduction of this controller. The only controller in version 4.18.7 that processes user query criteria (ElementIndexesController) already contains the proper defense mechanism (ElementHelper::cleanseQueryCriteria()) that was added for CVE-2026-25495. No alternative code path exists in version 4.18.7 that exhibits the same SQL injection vulnerability pattern." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-31859 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (XSS via javascript: URLs bypassing strip_tags()) was fixed by upstream vendor commit cc9921c14897ee2b592a431c2356af8a04ce4cfe, which added URL scheme validation before strip_tags() in src/web/User.php::setReturnUrl(). This fix was already present in upstream version 4.18.7 (released 2026-08-18) when TuxCare onboarded it (commit 4a22c9d3d...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31859" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (XSS via javascript: URLs bypassing strip_tags()) was fixed by upstream vendor commit cc9921c14897ee2b592a431c2356af8a04ce4cfe, which added URL scheme validation before strip_tags() in src/web/User.php::setReturnUrl(). This fix was already present in upstream version 4.18.7 (released 2026-08-18) when TuxCare onboarded it (commit 4a22c9d3d..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 The target (craftcms/cms 4.18.7) is not affected by CVE-2026-32262. The vulnerability (path traversal via unsanitized targetFilename parameter in AssetsController->replaceFile() allowing arbitrary file deletion) was fixed by upstream vendor Pixel & Tonic in version 4.17.5 (commit c997efbe4c, Feb 16 2026). The target version 4.18.7 inherits this fix from upstream. The validation code rejecting f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The target (craftcms/cms 4.18.7) is not affected by CVE-2026-32262. The vulnerability (path traversal via unsanitized targetFilename parameter in AssetsController->replaceFile() allowing arbitrary file deletion) was fixed by upstream vendor Pixel & Tonic in version 4.17.5 (commit c997efbe4c, Feb 16 2026). The target version 4.18.7 inherits this fix from upstream. The validation code rejecting f..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. CVE-2026-32263 affects Craft CMS versions 5.6.0 to before 5.9.11, specifically in src/controllers/EntryTypesController.php. The target version 4.18.7 is not affected because: (1) EntryTypesController.php does not exist in version 4.x; (2) Entry type management in 4.x is handled by SectionsController.php which does not use parse_str; (3) All 4 instances of parse_str in version 4.18.7 controllers (FieldsController.php and ElementIndexesController.php) are protected with Component::cleanseConfig() before passing data to Craft::configure(). The vulnerable code pattern described in the CVE does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "CVE-2026-32263 affects Craft CMS versions 5.6.0 to before 5.9.11, specifically in src/controllers/EntryTypesController.php. The target version 4.18.7 is not affected because: (1) EntryTypesController.php does not exist in version 4.x; (2) Entry type management in 4.x is handled by SectionsController.php which does not use parse_str; (3) All 4 instances of parse_str in version 4.18.7 controllers (FieldsController.php and ElementIndexesController.php) are protected with Component::cleanseConfig() before passing data to Craft::configure(). The vulnerable code pattern described in the CVE does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32264 fix dfec46362fcb by brandon@pixelandtonic.com (2026-02-16) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32264 fix dfec46362fcb by brandon@pixelandtonic.com (2026-02-16) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32267 fix 6301e217c5f1 by brandon@pixelandtonic.com (2026-02-18) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32267 fix 6301e217c5f1 by brandon@pixelandtonic.com (2026-02-18) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 4.18.7 is not affected by CVE-2026-33051. The CVE describes an XSS vulnerability specific to versions 5.9.0-beta.1 through 5.9.10 where the creator's fullName is rendered as raw HTML due to Template::raw() combined with Craft::t() in the revision/draft context menu. While the target version 4.18.7 does display creator names in the revision menu (src/templates/_includes/revisionmenu.tw...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 4.18.7 is not affected by CVE-2026-33051. The CVE describes an XSS vulnerability specific to versions 5.9.0-beta.1 through 5.9.10 where the creator's fullName is rendered as raw HTML due to Template::raw() combined with Craft::t() in the revision/draft context menu. While the target version 4.18.7 does display creator names in the revision menu (src/templates/_includes/revisionmenu.tw..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. Version 4.18.7 is NOT affected by CVE-2026-33157. The vulnerability exists in Craft CMS 5.6.0-5.9.12 where a NEW code path (fieldLayouts parameter in ElementIndexesController::actionFilterHud) bypasses existing sanitization. This specific code path does NOT exist in version 4.x. Version 4.18.7 only processes conditionConfig in actionFilterHud(), which is properly sanitized via Component::cleanseConfig() at line 421. The setFieldLayouts() method and fieldLayouts parameter handling were introduced in version 5.x and are completely absent from version 4.18.7's codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "Version 4.18.7 is NOT affected by CVE-2026-33157. The vulnerability exists in Craft CMS 5.6.0-5.9.12 where a NEW code path (fieldLayouts parameter in ElementIndexesController::actionFilterHud) bypasses existing sanitization. This specific code path does NOT exist in version 4.x. Version 4.18.7 only processes conditionConfig in actionFilterHud(), which is properly sanitized via Component::cleanseConfig() at line 421. The setFieldLayouts() method and fieldLayouts parameter handling were introduced in version 5.x and are completely absent from version 4.18.7's codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-33158 is NOT present in Craft CMS 4.18.7. The vulnerability described an authorization bypass in the assets/edit-image endpoint allowing low-privileged users to read private asset content. The upstream vendor (Pixel & Tonic) fixed this in version 4.17.8 (commit e674bbbd30, Feb 25 2026) by adding requireVolumePermissionByAsset() and requirePeerVolumePermissionByAsset() checks. Version 4...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 CVE-2026-33158 is NOT present in Craft CMS 4.18.7. The vulnerability described an authorization bypass in the assets/edit-image endpoint allowing low-privileged users to read private asset content. The upstream vendor (Pixel & Tonic) fixed this in version 4.17.8 (commit e674bbbd30, Feb 25 2026) by adding requireVolumePermissionByAsset() and requirePeerVolumePermissionByAsset() checks. Version 4..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) contains the complete fix for CVE-2026-33159. The upstream vendor (Pixel & Tonic) fixed the vulnerability in commit 7f0ead833f (2026-02-25), included it in their 4.18.7 release (2026-08-18), and TuxCare onboarded that pre-fixed version (2026-09-07). The vulnerable pattern\u2014missing authentication/authorization on ConfigSyncController\u2014is not present at HEAD. Verdict: ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.7) contains the complete fix for CVE-2026-33159. The upstream vendor (Pixel & Tonic) fixed the vulnerability in commit 7f0ead833f (2026-02-25), included it in their 4.18.7 release (2026-08-18), and TuxCare onboarded that pre-fixed version (2026-09-07). The vulnerable pattern\u2014missing authentication/authorization on ConfigSyncController\u2014is not present at HEAD. Verdict: ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-33160 fix 83fd398c12a3 by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-33160 fix 83fd398c12a3 by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-33161 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 4.18.7) contains the upstream vendor's fix for the asset information disclosure vulnerability. The CVE describes an authorization bypass where the assets/image-editor endpoint (actionImageEditor method) returns focalPoint and other editor metadata without validating user permissions. The fix (commit 1f91f9b7aa, GHSA-vgjg-248p-rfm2) added requireVolumePermissionB...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 4.18.7) contains the upstream vendor's fix for the asset information disclosure vulnerability. The CVE describes an authorization bypass where the assets/image-editor endpoint (actionImageEditor method) returns focalPoint and other editor metadata without validating user permissions. The fix (commit 1f91f9b7aa, GHSA-vgjg-248p-rfm2) added requireVolumePermissionB..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS v4.18.7 is not affected by CVE-2026-33162. The vulnerability affects the `/actions/entries/move-to-section` endpoint and Entry::canMove() authorization method, which were introduced in Craft CMS v5.x. Version 4.18.7 does not have the move-entries-between-sections feature at all. The GraphQL resolver explicitly prevents section changes with the error \"Impossible to change the section o...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 Craft CMS v4.18.7 is not affected by CVE-2026-33162. The vulnerability affects the `/actions/entries/move-to-section` endpoint and Entry::canMove() authorization method, which were introduced in Craft CMS v5.x. Version 4.18.7 does not have the move-entries-between-sections feature at all. The GraphQL resolver explicitly prevents section changes with the error \"Impossible to change the section o..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset upload) is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit d20aecfaa0 (March 4, 2026) by adding scheme validation that blocks non-HTTP/HTTPS protocols (gopher, file, ftp, etc.). This fix was later refactored into the craftcms/url-validator library (commit 26268c0210, Jun...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "not_affected \u2014 CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset upload) is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit d20aecfaa0 (March 4, 2026) by adding scheme validation that blocks non-HTTP/HTTPS protocols (gopher, file, ftp, etc.). This fix was later refactored into the craftcms/url-validator library (commit 26268c0210, Jun..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) is not affected by CVE-2026-41130. The SSRF vulnerability in the resource-js endpoint was fixed by upstream vendor (Pixel & Tonic) in commit ebe7e85f1c, which is present in the target. The vulnerable code that made HTTP requests via Guzzle client has been replaced with local filesystem serving using App::resourcePathByUri() with path traversal protection. Additiona...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.7) is not affected by CVE-2026-41130. The SSRF vulnerability in the resource-js endpoint was fixed by upstream vendor (Pixel & Tonic) in commit ebe7e85f1c, which is present in the target. The vulnerable code that made HTTP requests via Guzzle client has been replaced with local filesystem serving using App::resourcePathByUri() with path traversal protection. Additiona..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-55790 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. CVE-2026-55790 (GHSA-24x4-j6x9-rfw5): The XSS vulnerability in the CraftSupport widget is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit 6bbb66038a (May 2026) by adding HTML escaping via Craft.escapeHtml() and using jQuery's text: option for error messages. This fix was included in upstream's 4.18.7 release (August 2026), which TuxCare subsequently adopted for ELS support (September 2026). TuxCare did not backport this specific fix; they inherited an already-fixed upstream release. Both defense mechanisms from the patch are present and correctly implemented at lines 382 and 555-557 of CraftSupportWidget.js.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55790" }, "impact_statement": "CVE-2026-55790 (GHSA-24x4-j6x9-rfw5): The XSS vulnerability in the CraftSupport widget is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit 6bbb66038a (May 2026) by adding HTML escaping via Craft.escapeHtml() and using jQuery's text: option for error messages. This fix was included in upstream's 4.18.7 release (August 2026), which TuxCare subsequently adopted for ELS support (September 2026). TuxCare did not backport this specific fix; they inherited an already-fixed upstream release. Both defense mechanisms from the patch are present and correctly implemented at lines 382 and 555-557 of CraftSupportWidget.js." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-55793 is fixed in version 4.18.7-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55793" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is not affected. The CVE describes a vulnerability in version 5.0.0-RC1+, but analysis of 4.18.7 code shows user group names are protected by Twig's default HTML auto-escaping and Vue's text interpolation escaping. All rendering paths include runtime defenses that transform script content before display, preventing execution in administrators' browsers.", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is not affected. The CVE describes a vulnerability in version 5.0.0-RC1+, but analysis of 4.18.7 code shows user group names are protected by Twig's default HTML auto-escaping and Vue's text interpolation escaping. All rendering paths include runtime defenses that transform script content before display, preventing execution in administrators' browsers." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-56382 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. Target version 4.18.7 is not affected by CVE-2026-56382. The vulnerable method `actionRenderCardPreview()` from the v5.x patch does not exist in v4.18.7's codebase. The CVE affects Craft CMS versions >= 5.5.0 and <= 5.9.13, while this target is v4.18.7. Although TuxCare backported this CVE to v3.9.15 (fixing a different vulnerable method `actionRenderLayoutElementSelector()`), v4.18.7 contains neither the v5.x vulnerable method nor the v3.x vulnerable method. The methods that do exist in v4.18.7 and handle layout configurations (`actionApplyLayoutTabSettings()`, `actionApplyLayoutElementSettings()`) properly sanitize all config parameters via `Component::cleanseConfig()` before passing them to layout creation functions.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56382" }, "impact_statement": "Target version 4.18.7 is not affected by CVE-2026-56382. The vulnerable method `actionRenderCardPreview()` from the v5.x patch does not exist in v4.18.7's codebase. The CVE affects Craft CMS versions >= 5.5.0 and <= 5.9.13, while this target is v4.18.7. Although TuxCare backported this CVE to v3.9.15 (fixing a different vulnerable method `actionRenderLayoutElementSelector()`), v4.18.7 contains neither the v5.x vulnerable method nor the v3.x vulnerable method. The methods that do exist in v4.18.7 and handle layout configurations (`actionApplyLayoutTabSettings()`, `actionApplyLayoutElementSettings()`) properly sanitize all config parameters via `Component::cleanseConfig()` before passing them to layout creation functions." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-56383 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The upstream vendor fix (commit 7b372de262b8) is present in HEAD, applying HTML encoding to heading-type cell values before rendering. The fix was authored by brandon@pixelandtonic.com (Craft CMS upstream) and shipped in version 4.16.19. TuxCare onboarded version 4.18.7 (released 2026-08-18) which already contained this fix. No TuxCare attribution signals ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56383" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The upstream vendor fix (commit 7b372de262b8) is present in HEAD, applying HTML encoding to heading-type cell values before rendering. The fix was authored by brandon@pixelandtonic.com (Craft CMS upstream) and shipped in version 4.16.19. TuxCare onboarded version 4.18.7 (released 2026-08-18) which already contained this fix. No TuxCare attribution signals ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-56384 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-56384 fix ed56049c9d3f by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56384" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-56384 fix ed56049c9d3f by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-56385 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 contains the upstream vendor's authorization fix for CVE-2026-56385. The vulnerability (authorization bypass in assets/preview-file endpoint) was fixed by Pixel & Tonic in commit d30df31122 (Feb 2026) which added requireVolumePermissionByAsset and requirePeerVolumePermissionByAsset checks to actionPreviewFile(). This fix was included in upstream Craft CMS 4.17.8 and 4.18.7...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56385" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 contains the upstream vendor's authorization fix for CVE-2026-56385. The vulnerability (authorization bypass in assets/preview-file endpoint) was fixed by Pixel & Tonic in commit d30df31122 (Feb 2026) which added requireVolumePermissionByAsset and requirePeerVolumePermissionByAsset checks to actionPreviewFile(). This fix was included in upstream Craft CMS 4.17.8 and 4.18.7..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-11-08T14:16:00.068422+00:00", "status_notes": "Vulnerability CVE-2026-56393 affects version 4.18.7-p2+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56393" }, "action_statement": "Vulnerability CVE-2026-56393 affects version 4.18.7-p2+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-12T15:10:19.664567+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 4.18.7-p2+tuxcare of craftcms/cms. Target Craft CMS 4.18.7 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint has been fixed by upstream vendor commit 30f5f1a8d6 (authored by brandon@pixelandtonic.com), which added regex validation to reject extension parameters containing traversal sequences. The fix validates extensions with /^\\w+$/ before filesystem operations, preventing the attack chain described in the CVE. TuxCare adopted this fix when onboarding version 4.18.7 to ELS support.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "Target Craft CMS 4.18.7 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint has been fixed by upstream vendor commit 30f5f1a8d6 (authored by brandon@pixelandtonic.com), which added regex validation to reject extension parameters containing traversal sequences. The fix validates extensions with /^\\w+$/ before filesystem operations, preventing the attack chain described in the CVE. TuxCare adopted this fix when onboarding version 4.18.7 to ELS support." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 4.18.7-p2+tuxcare of craftcms/cms. not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was fixed in upstream Craft CMS 3.7.29 (commit 7ca2b2d2c by brandon@pixelandtonic.com, Jan 2022) and was already present in the 4.18.7 release that TuxCare onboarded. The fix adds a filter validating feed item permalinks match /^https?:\\/\\// before creating anchor elements, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was fixed in upstream Craft CMS 3.7.29 (commit 7ca2b2d2c by brandon@pixelandtonic.com, Jan 2022) and was already present in the 4.18.7 release that TuxCare onboarded. The fix adds a filter validating feed item permalinks match /^https?:\\/\\// before creating anchor elements, pre..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability AIKIDO-2025-10090 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability AIKIDO-2025-10859 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 3.9.15-p13+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 3.9.15-p13+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 3.9.15-p13+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 3.9.15-p13+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 3.9.15-p13+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2023-30179 is a false positive for craftcms/cms 3.9.15-p13+tuxcare.", "vulnerability": { "name": "CVE-2023-30179" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2023-33495 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 3.9.15-p13+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2024-52291 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52291" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2024-52292 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52292" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 3.9.15-p13+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. per review of Brhane", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "per review of Brhane" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2025-35939 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-35939" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2025-54417 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-54417" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2025-57811 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-57811" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ...", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2025-68437 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68437" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2025-68454 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68454" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2025-68456 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68456" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-11-09T23:08:00.049119+00:00", "status_notes": "Vulnerability CVE-2026-115934 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 Target is Craft CMS 3.9.15 (TuxCare build). No vendor patch was supplied and the CVE text is vague. The only element-search SQL path is Search service, which builds SQL by string concatenation, but attacker input is neutralised before concatenation. The anonymous GraphQL endpoint's orderBy is allow-listed. No unauthenticated element-search endpoint injects raw input into SQL. Confidence is mode...", "vulnerability": { "name": "CVE-2026-115934" }, "impact_statement": "not_affected \u2014 Target is Craft CMS 3.9.15 (TuxCare build). No vendor patch was supplied and the CVE text is vague. The only element-search SQL path is Search service, which builds SQL by string concatenation, but attacker input is neutralised before concatenation. The anonymous GraphQL endpoint's orderBy is allow-listed. No unauthenticated element-search endpoint injects raw input into SQL. Confidence is mode..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-11-02T14:56:09.367348+00:00", "status_notes": "Vulnerability CVE-2026-115935 affects version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115935" }, "action_statement": "Vulnerability CVE-2026-115935 affects version 3.9.15-p13+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2026-115938 affects version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115938" }, "action_statement": "Vulnerability CVE-2026-115938 affects version 3.9.15-p13+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-25493 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25493" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-25494 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25494" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-25495 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25495" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-25496 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25496" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-25498 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25498" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-27127 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27127" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-27128 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27128" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-27129 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27129" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-28783 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-28783" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-29069 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29069" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-29113 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29113" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-31859 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-31859" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-32262 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32262" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-32264 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32264" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-32267 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32267" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-33157 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33157" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-33158 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33158" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-33159 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33159" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-33160 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33160" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-33161 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33161" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-55790 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55790" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-55793 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55793" }, "impact_statement": "not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-56382 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56382" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-56383 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56383" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-56384 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56384" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-56385 is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56385" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-11-08T14:16:00.068422+00:00", "status_notes": "Vulnerability CVE-2026-56393 affects version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56393" }, "action_statement": "Vulnerability CVE-2026-56393 affects version 3.9.15-p13+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability GHSA-3m9m-24vh-39wx is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-3m9m-24vh-39wx" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability GHSA-44px-qjjc-xrhq is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-44px-qjjc-xrhq" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability GHSA-6j87-m5qx-9fqp is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-6j87-m5qx-9fqp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability GHSA-86vw-x4ww-x467 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-86vw-x4ww-x467" }, "impact_statement": "not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability GHSA-95wr-3f2v-v2wh does not affect version 3.9.15-p13+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "GHSA-95wr-3f2v-v2wh" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability GHSA-c43v-4cr8-6mvp does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c43v-4cr8-6mvp" }, "impact_statement": "not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability GHSA-g3hp-vvqf-8vw6 does not affect version 3.9.15-p13+tuxcare of craftcms/cms. craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-g3hp-vvqf-8vw6" }, "impact_statement": "craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 3.9.15-p13+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p13+tuxcare" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability GHSA-x76w-8c62-48mg is fixed in version 3.9.15-p13+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-x76w-8c62-48mg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is not affected by CVE-2021-27902. The vulnerability allowed XSS via uploaded .htm/.html files in versions before 3.6.0. The fix (commit 8ee85a8f03) removed 'htm' and 'html' from the default allowedFileExtensions list. This fix was already present in the upstream Craft CMS 4.18.7 release that TuxCare onboarded, authored by Brandon Kelly (brandon@pixelandto...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is not affected by CVE-2021-27902. The vulnerability allowed XSS via uploaded .htm/.html files in versions before 3.6.0. The fix (commit 8ee85a8f03) removed 'htm' and 'html' from the default allowedFileExtensions list. This fix was already present in the upstream Craft CMS 4.18.7 release that TuxCare onboarded, authored by Brandon Kelly (brandon@pixelandto..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 4.18.7-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 4.18.7-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-32470 (XSS in tab name prompt) is NOT present in the target. The upstream vendor fixed this vulnerability in commit f9378aa154 (April 2021) by wrapping the prompt() result with Craft.escapeHtml() in FieldLayoutDesigner.js:150. This fix was already included in the upstream release before TuxCare onboarded version 4.18.7. The vulnerable code pattern (unescaped user input from prompt dire...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 CVE-2021-32470 (XSS in tab name prompt) is NOT present in the target. The upstream vendor fixed this vulnerability in commit f9378aa154 (April 2021) by wrapping the prompt() result with Craft.escapeHtml() in FieldLayoutDesigner.js:150. This fix was already included in the upstream release before TuxCare onboarded version 4.18.7. The vulnerable code pattern (unescaped user input from prompt dire..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 4.18.7-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 4.18.7-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 (XSS in Craft CMS before 3.7.29) is not present in target version 4.18.7. The vulnerability allowed JavaScript execution via malicious feed item permalinks (e.g., javascript: URIs) in the FeedWidget. The fix (commit 7ca2b2d2cc) adds permalink URL scheme validation to reject non-HTTP(S) URIs. This fix was shipped in upstream release 3.7.29 (Jan 2022) and is present in the target c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 (XSS in Craft CMS before 3.7.29) is not present in target version 4.18.7. The vulnerability allowed JavaScript execution via malicious feed item permalinks (e.g., javascript: URIs) in the FeedWidget. The fix (commit 7ca2b2d2cc) adds permalink URL scheme validation to reject non-HTTP(S) URIs. This fix was shipped in upstream release 3.7.29 (Jan 2022) and is present in the target c..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 4.18.7-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 4.18.7-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS 4.2.0.1 due to missing HTML encoding on user-controllable content (revision notes, tab names, group names, address titles). The vulnerability was fixed by upstream Craft CMS developers (Pixel & Tonic) in version 4.2.1 (released 2022-08-09) via commits that added Html::encode() to all affected output locations. Target version 4.18.7 inherits the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS 4.2.0.1 due to missing HTML encoding on user-controllable content (revision notes, tab names, group names, address titles). The vulnerability was fixed by upstream Craft CMS developers (Pixel & Tonic) in version 4.2.1 (released 2022-08-09) via commits that added Html::encode() to all affected output locations. Target version 4.18.7 inherits the..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 4.18.7-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 4.18.7-p1+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 4.18.7-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 4.18.7-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-30177 (XSS in Volume Name) is not present in target version 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream Craft CMS in version 4.4.0-beta.1 (commit 1381993c81, Dec 22, 2022) by adding Html::encode() to the volume name display in asset metadata. The fix was already present in the upstream release when TuxCare onboarded version 4.18.7. Both identified volume name d...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 CVE-2023-30177 (XSS in Volume Name) is not present in target version 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream Craft CMS in version 4.4.0-beta.1 (commit 1381993c81, Dec 22, 2022) by adding Html::encode() to the volume name display in asset metadata. The fix was already present in the upstream release when TuxCare onboarded version 4.18.7. Both identified volume name d..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-31144 is not present in target craftcms/cms 4.18.7. The vulnerability involved XSS through unescaped forward slashes in JSON encoding when feed titles containing malicious sequences like `` were embedded in HTML script tags. The upstream vendor (Pixel & Tonic) fixed this in commit e2f7e7b7d86a0afa54ce855375d13c7760670764 by removing JSON_UNESCAPED_SLASHES from the default enco...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "not_affected \u2014 CVE-2023-31144 is not present in target craftcms/cms 4.18.7. The vulnerability involved XSS through unescaped forward slashes in JSON encoding when feed titles containing malicious sequences like `` were embedded in HTML script tags. The upstream vendor (Pixel & Tonic) fixed this in commit e2f7e7b7d86a0afa54ce855375d13c7760670764 by removing JSON_UNESCAPED_SLASHES from the default enco..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in craftcms/cms 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream vendor (Pixel & Tonic) in commit 9d0cd0bd (April 2023) and shipped in version 3.8.10. The target version 4.18.7 includes this upstream fix. The vulnerable pattern ($('
  • ' + error + '
    • ')) does not exist; instead, the safe pattern (...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in craftcms/cms 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream vendor (Pixel & Tonic) in commit 9d0cd0bd (April 2023) and shipped in version 3.8.10. The target version 4.18.7 includes this upstream fix. The vulnerable pattern ($('
  • ' + error + '
    • ')) does not exist; instead, the safe pattern (..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-11-03T08:53:00.046847+00:00", "status_notes": "Vulnerability CVE-2023-33495 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. craftcms/cms 4.18.7 already contains upstream commit 57334cd435 (released in 4.17.0, 'Escape checkbox labels by default in JS'): Craft.ui.createSelect sets option labels via $option.text() with opt-in labelHtml, so the export-modal exporter-name HTML injection (GHSA-m3v5-gjj9-rg24, affected <= 4.4.9) is not exploitable. The TuxCare 3.9.15 fix (PHPELSCVE-271, b7d336d299) is not needed and would double-escape. Jira: PHPELSCVE-992.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33495" }, "impact_statement": "craftcms/cms 4.18.7 already contains upstream commit 57334cd435 (released in 4.17.0, 'Escape checkbox labels by default in JS'): Craft.ui.createSelect sets option labels via $option.text() with opt-in labelHtml, so the export-modal exporter-name HTML injection (GHSA-m3v5-gjj9-rg24, affected <= 4.4.9) is not exploitable. The TuxCare 3.9.15 fix (PHPELSCVE-271, b7d336d299) is not needed and would double-escape. Jira: PHPELSCVE-992." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:37:57.469921+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. CVE-2023-36260 describes a DoS vulnerability triggered via the Feed Me plugin when saving a feed with Asset element type but no volume selected. The vulnerable code pattern exists in craftcms/cms at src/elements/Asset.php:2938 (calling getFolderById($folderId)->getVolume() without null check), which would cause a fatal error if folderId is null. However, analysis of all Craft CMS's own entry points (GraphQL mutations, HTTP upload controllers, validation rules) shows they properly validate and set folderId before saving Assets. The vulnerable code path is not reachable through craftcms/cms's own production code - it requires a third-party plugin like Feed Me that creates Assets without properly setting folderId. Verdict: not_affected (Rule 5 Type A2 - code_not_reachable).", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "CVE-2023-36260 describes a DoS vulnerability triggered via the Feed Me plugin when saving a feed with Asset element type but no volume selected. The vulnerable code pattern exists in craftcms/cms at src/elements/Asset.php:2938 (calling getFolderById($folderId)->getVolume() without null check), which would cause a fatal error if folderId is null. However, analysis of all Craft CMS's own entry points (GraphQL mutations, HTTP upload controllers, validation rules) shows they properly validate and set folderId before saving Assets. The vulnerable code path is not reachable through craftcms/cms's own production code - it requires a third-party plugin like Feed Me that creates Assets without properly setting folderId. Verdict: not_affected (Rule 5 Type A2 - code_not_reachable)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2023-40035 affects version 4.18.7-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-40035" }, "action_statement": "Vulnerability CVE-2023-40035 affects version 4.18.7-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2024-21622 describes privilege escalation vulnerabilities in Craft CMS fixed by two upstream commits: ca0576b3ed (UsersController username parameter restriction) and 42f929e777 (ElementsController TOCTOU authorization fix). Both fixes were authored by Pixel & Tonic developers (brad@pixelandtonic.com) in November 2023 and were already present in the upstream Craft CMS 4.18.7 release that Tux...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "not_affected \u2014 CVE-2024-21622 describes privilege escalation vulnerabilities in Craft CMS fixed by two upstream commits: ca0576b3ed (UsersController username parameter restriction) and 42f929e777 (ElementsController TOCTOU authorization fix). Both fixes were authored by Pixel & Tonic developers (brad@pixelandtonic.com) in November 2023 and were already present in the upstream Craft CMS 4.18.7 release that Tux..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 4.18.7-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 4.18.7-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS version 4.18.7, while CVE-2024-41800 specifically affects Craft CMS 5's TOTP (Time-based One-Time Password) two-factor authentication feature. The TOTP 2FA functionality does not exist in Craft CMS 4.x at all. Exhaustive searches across the entire codebase found no TOTP-related code, no Google2FA library dependency, no auth/methods directory structure, no Auth...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS version 4.18.7, while CVE-2024-41800 specifically affects Craft CMS 5's TOTP (Time-based One-Time Password) two-factor authentication feature. The TOTP 2FA functionality does not exist in Craft CMS 4.x at all. Exhaustive searches across the entire codebase found no TOTP-related code, no Google2FA library dependency, no auth/methods directory structure, no Auth..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-19T17:43:00.093682+00:00", "status_notes": "Vulnerability CVE-2024-52291 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. craftcms/cms 4.18.7 is not affected by CVE-2024-52291 (GHSA-jrh5-vhr9-qh7q). The advisory affects 4.x only up to <= 4.12.4.1 (patched 4.12.5). The upstream fix 1bc4eaa40a (Fixed GHSA-jrh5-vhr9-qh7q, first tagged 4.12.5) replaced the single-prefix StringHelper::removeLeft($path, 'file://') in FileHelper::normalizePath() with a regex that strips all consecutive file:// prefixes, closing the file://file://// local filesystem validation bypass. The fixed code is present on tuxcare-current/4.18.7.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52291" }, "impact_statement": "craftcms/cms 4.18.7 is not affected by CVE-2024-52291 (GHSA-jrh5-vhr9-qh7q). The advisory affects 4.x only up to <= 4.12.4.1 (patched 4.12.5). The upstream fix 1bc4eaa40a (Fixed GHSA-jrh5-vhr9-qh7q, first tagged 4.12.5) replaced the single-prefix StringHelper::removeLeft($path, 'file://') in FileHelper::normalizePath() with a regex that strips all consecutive file:// prefixes, closing the file://file://// local filesystem validation bypass. The fixed code is present on tuxcare-current/4.18.7." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-13T11:38:04.564831+00:00", "status_notes": "Vulnerability CVE-2024-52292 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. The target repository (Craft CMS 4.18.7-p1+tuxcare) is NOT AFFECTED by CVE-2024-52292. The upstream vendor (Craft CMS / Pixel & Tonic) already fixed the arbitrary file read vulnerability in commit 3ee85a48c1 (Oct 21, 2024) by adding path containment validation to the Html::dataUrl() function. This fix was already present in the upstream codebase when TuxCare onboarded version 4.18.7 (PHPELS-197). The defense restricts file access to within the project root directory, preventing the attack vector described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52292" }, "impact_statement": "The target repository (Craft CMS 4.18.7-p1+tuxcare) is NOT AFFECTED by CVE-2024-52292. The upstream vendor (Craft CMS / Pixel & Tonic) already fixed the arbitrary file read vulnerability in commit 3ee85a48c1 (Oct 21, 2024) by adding path containment validation to the Html::dataUrl() function. This fix was already present in the upstream codebase when TuxCare onboarded version 4.18.7 (PHPELS-197). The defense restricts file access to within the project root directory, preventing the attack vector described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. CVE-2024-52293 is NOT present in the target. The vulnerability required missing normalizePath() in FileHelper::absolutePath() line 136, allowing path traversal sequences like `../templates/poc` to bypass system directory security checks. The target code contains the upstream vendor's fix: `return static::normalizePath($from . $ds . $to, $ds);` which resolves traversal sequences before the path is used in security validations. This fix was introduced in upstream Craft CMS version 4.12.2 (commit 123e48a696 by brandon@pixelandtonic.com on 2024-09-11). The target version 4.18.7 naturally includes all fixes from 4.12.2. TuxCare onboarded the pre-fixed version 4.18.7; there is no separate TuxCare backport for this CVE on this version line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 is NOT present in the target. The vulnerability required missing normalizePath() in FileHelper::absolutePath() line 136, allowing path traversal sequences like `../templates/poc` to bypass system directory security checks. The target code contains the upstream vendor's fix: `return static::normalizePath($from . $ds . $to, $ds);` which resolves traversal sequences before the path is used in security validations. This fix was introduced in upstream Craft CMS version 4.12.2 (commit 123e48a696 by brandon@pixelandtonic.com on 2024-09-11). The target version 4.18.7 naturally includes all fixes from 4.12.2. TuxCare onboarded the pre-fixed version 4.18.7; there is no separate TuxCare backport for this CVE on this version line." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 4.18.7-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 4.18.7-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-23209 fix a19d46be78a9 by brandon@pixelandtonic.com (2025-07-07) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-23209 fix a19d46be78a9 by brandon@pixelandtonic.com (2025-07-07) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. CVE-2025-32432 RCE vulnerability is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this type confusion vulnerability in commit e1c85441 (2025-04-10) by adding string type validation for the 'handle' parameter in AssetsController::actionGenerateTransform(). This fix was included in upstream release 4.18.7 (2026-08-18), which TuxCare subsequently onboarded to ELS on 2026-09-07. The target code at HEAD (b16f3f8a9b) contains the complete fix: lines 1208-1210 validate that $handle is a string before use, exactly matching the vendor patch. The CVE affects versions 4.0.0-RC1 to before 4.14.15; target version 4.18.7 is after the fixed version. Attribution: upstream vendor fix (no TuxCare authorship signal).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "CVE-2025-32432 RCE vulnerability is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this type confusion vulnerability in commit e1c85441 (2025-04-10) by adding string type validation for the 'handle' parameter in AssetsController::actionGenerateTransform(). This fix was included in upstream release 4.18.7 (2026-08-18), which TuxCare subsequently onboarded to ELS on 2026-09-07. The target code at HEAD (b16f3f8a9b) contains the complete fix: lines 1208-1210 validate that $handle is a string before use, exactly matching the vendor patch. The CVE affects versions 4.0.0-RC1 to before 4.14.15; target version 4.18.7 is after the fixed version. Attribution: upstream vendor fix (no TuxCare authorship signal)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2025-35939 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2025-35939 is not present in the target. The vulnerability involves storing unsanitized return URLs containing arbitrary HTML/PHP code in session files. The upstream vendor (Craft CMS) shipped the fix in version 4.18.7, which strips HTML/PHP tags via strip_tags() and validates URL schemes before storing return URLs in the session. TuxCare onboarded this version with the fix already present....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-35939" }, "impact_statement": "not_affected \u2014 CVE-2025-35939 is not present in the target. The vulnerability involves storing unsanitized return URLs containing arbitrary HTML/PHP code in session files. The upstream vendor (Craft CMS) shipped the fix in version 4.18.7, which strips HTML/PHP tags via strip_tags() and validates URL schemes before storing return URLs in the session. TuxCare onboarded this version with the fix already present...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. Not affected: CVE-2025-46731 affects Craft CMS 4.x prior to 4.14.13 and is fixed upstream in 4.14.13; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (c3f75107a4b4d00f802a56f23aa57cde134df838).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "Not affected: CVE-2025-46731 affects Craft CMS 4.x prior to 4.14.13 and is fixed upstream in 4.14.13; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (c3f75107a4b4d00f802a56f23aa57cde134df838)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. Not affected: CVE-2025-57811 affects Craft CMS 4.0.0-RC1 through 4.16.5 and is fixed upstream in 4.16.6; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (e77f8a287dcdda41f1724f525d03542f18566cbc).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-57811" }, "impact_statement": "Not affected: CVE-2025-57811 affects Craft CMS 4.0.0-RC1 through 4.16.5 and is fixed upstream in 4.16.6; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (e77f8a287dcdda41f1724f525d03542f18566cbc)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68436 fix 4bcb0db554e2 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68436 fix 4bcb0db554e2 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68437 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68437 fix 013db636fdb3 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68437" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68437 fix 013db636fdb3 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. Not affected: CVE-2025-68454 affects Craft CMS 4.0.0-RC1 through 4.16.16 and is fixed upstream in 4.16.17; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (d82680f4a05f9576883bb83c3f6243d33ca73ebe).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68454" }, "impact_statement": "Not affected: CVE-2025-68454 affects Craft CMS 4.0.0-RC1 through 4.16.16 and is fixed upstream in 4.16.17; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (d82680f4a05f9576883bb83c3f6243d33ca73ebe)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. Version 4.18.7 is not affected by CVE-2025-68455. The vulnerability was fixed by upstream vendor (Craft CMS/Pixel & Tonic) in version 4.16.17 via commit ec43c497ed (released 2025-12-04). Target version 4.18.7 (released 2026-08-18) is newer and includes this fix plus additional hardening. The fix adds Component::cleanseConfig() to remove dangerous config keys (\"on \" event handlers and \"as \" behaviors) before object instantiation, preventing malicious behavior attachment and RCE. TuxCare later adopted version 4.18.7 into their ELS program, inheriting the upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Version 4.18.7 is not affected by CVE-2025-68455. The vulnerability was fixed by upstream vendor (Craft CMS/Pixel & Tonic) in version 4.16.17 via commit ec43c497ed (released 2025-12-04). Target version 4.18.7 (released 2026-08-18) is newer and includes this fix plus additional hardening. The fix adds Component::cleanseConfig() to remove dangerous config keys (\"on \" event handlers and \"as \" behaviors) before object instantiation, preventing malicious behavior attachment and RCE. TuxCare later adopted version 4.18.7 into their ELS program, inheriting the upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68456 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68456 fix 1718011a5faa by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68456" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68456 fix 1718011a5faa by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-11-09T23:08:00.049119+00:00", "status_notes": "Vulnerability CVE-2026-115934 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 4.18.7 builds search SQL by string interpolation (src/services/Search.php), but every user-controlled fragment is sanitized first. Search terms go through SearchHelper::normalizeKeywords, which strips quotes, backslashes, semicolons and other punctuation. Attribute names are limited to \\w+. Field IDs are integers. I found no unauthenticated element search endpoint in the target. No ve...", "vulnerability": { "name": "CVE-2026-115934" }, "impact_statement": "not_affected \u2014 Craft CMS 4.18.7 builds search SQL by string interpolation (src/services/Search.php), but every user-controlled fragment is sanitized first. Search terms go through SearchHelper::normalizeKeywords, which strips quotes, backslashes, semicolons and other punctuation. Attribute names are limited to \\w+. Field IDs are integers. I found no unauthenticated element search endpoint in the target. No ve..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T13:01:41.506821+00:00", "status_notes": "Vulnerability CVE-2026-115935 affects version 4.18.7-p1+tuxcare of craftcms/cms, and is fixed in 4.18.7-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-115935" }, "action_statement": "Vulnerability CVE-2026-115935 affects version 4.18.7-p1+tuxcare of craftcms/cms, and is fixed in 4.18.7-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-28T13:01:41.506821+00:00", "status_notes": "Vulnerability CVE-2026-115938 affects version 4.18.7-p1+tuxcare of craftcms/cms, and is fixed in 4.18.7-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-115938" }, "action_statement": "Vulnerability CVE-2026-115938 affects version 4.18.7-p1+tuxcare of craftcms/cms, and is fixed in 4.18.7-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.7 is NOT AFFECTED by CVE-2026-25491. The vulnerability (stored XSS via unescaped entry type names) affects Craft CMS 5.0.0-RC1 through 5.8.21, where the architecture changed from Vue.js client-side rendering to PHP server-side rendering. In version 4.18.7, entry type names are rendered through Vue.js's default {{ }} interpolation (App.vue:115,120), which automatically applies HTML ...", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 4.18.7 is NOT AFFECTED by CVE-2026-25491. The vulnerability (stored XSS via unescaped entry type names) affects Craft CMS 5.0.0-RC1 through 5.8.21, where the architecture changed from Vue.js client-side rendering to PHP server-side rendering. In version 4.18.7, entry type names are rendered through Vue.js's default {{ }} interpolation (App.vue:115,120), which automatically applies HTML ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-25493. The upstream vendor fixed this SSRF redirect bypass vulnerability in commit 26268c0210 (June 2026), which was included in the 4.18.7 release (August 2026). The target code disables HTTP redirects at line 318 (`RequestOptions::ALLOW_REDIRECTS => false`) in the downloadUrl method, preventing attackers from bypassing validation ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-25493. The upstream vendor fixed this SSRF redirect bypass vulnerability in commit 26268c0210 (June 2026), which was included in the 4.18.7 release (August 2026). The target code disables HTTP redirects at line 318 (`RequestOptions::ALLOW_REDIRECTS => false`) in the downloadUrl method, preventing attackers from bypassing validation ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-25494 describes a hex IP notation bypass of filter_var() validation in the saveAsset GraphQL mutation. The target (4.18.7) is NOT AFFECTED because the vulnerable code pattern has been completely replaced by an upstream vendor refactoring. On June 15, 2026, upstream author brandon@pixelandtonic.com (commit 26268c0210) replaced the inline filter_var() validation with the craftcms/url-val...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "not_affected \u2014 CVE-2026-25494 describes a hex IP notation bypass of filter_var() validation in the saveAsset GraphQL mutation. The target (4.18.7) is NOT AFFECTED because the vulnerable code pattern has been completely replaced by an upstream vendor refactoring. On June 15, 2026, upstream author brandon@pixelandtonic.com (commit 26268c0210) replaced the inline filter_var() validation with the craftcms/url-val..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. Craft CMS 4.18.7 is not affected by CVE-2026-25495. The upstream vendor (Pixel & Tonic) fixed this SQL injection vulnerability in version 4.16.18 (released 2026-01-09) by removing dangerous SQL query construction parameters from user-provided criteria before database query configuration. The fix was refactored into ElementHelper::cleanseQueryCriteria() in version 4.17.4 (released 2026-02-11). The target version 4.18.7 (released 2026-08-18) inherits this upstream fix. The vulnerable pattern is not present in the target because an upstream-authored fix is already applied in the shipped version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "Craft CMS 4.18.7 is not affected by CVE-2026-25495. The upstream vendor (Pixel & Tonic) fixed this SQL injection vulnerability in version 4.16.18 (released 2026-01-09) by removing dangerous SQL query construction parameters from user-provided criteria before database query configuration. The fix was refactored into ElementHelper::cleanseQueryCriteria() in version 4.17.4 (released 2026-02-11). The target version 4.18.7 (released 2026-08-18) inherits this upstream fix. The vulnerable pattern is not present in the target because an upstream-authored fix is already applied in the shipped version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is not affected by CVE-2026-25496. The upstream vendor (Craft CMS / Pixel & Tonic) fixed the stored XSS vulnerability in commit 93837b626f on 2026-01-05 by adding HTML encoding to the Number field's Prefix and Suffix rendering. This fix was included in the upstream 4.18.7 release (finalized 2026-08-18), which TuxCare inherited when onboarding this version. The vulnerable p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is not affected by CVE-2026-25496. The upstream vendor (Craft CMS / Pixel & Tonic) fixed the stored XSS vulnerability in commit 93837b626f on 2026-01-05 by adding HTML encoding to the Number field's Prefix and Suffix rendering. This fix was included in the upstream 4.18.7 release (finalized 2026-08-18), which TuxCare inherited when onboarding this version. The vulnerable p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. Target version 4.18.7 is not vulnerable to CVE-2026-25498. The upstream vendor (Pixel & Tonic) fixed the RCE vulnerability in commit 395c64f0b8 on 2026-01-09 by adding ComponentHelper::cleanseConfig() sanitization before passing user-supplied field layout configuration to object creation. This fix was included in the upstream 4.18.7 release (2026-08-18) which TuxCare subsequently onboarded for Extended Lifecycle Support. The vulnerable pattern (unsanitized config data passed directly to createLayout) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "Target version 4.18.7 is not vulnerable to CVE-2026-25498. The upstream vendor (Pixel & Tonic) fixed the RCE vulnerability in commit 395c64f0b8 on 2026-01-09 by adding ComponentHelper::cleanseConfig() sanitization before passing user-supplied field layout configuration to object creation. This fix was included in the upstream 4.18.7 release (2026-08-18) which TuxCare subsequently onboarded for Extended Lifecycle Support. The vulnerable pattern (unsanitized config data passed directly to createLayout) is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (CVE-2026-27126) affecting versions 4.5.0-RC1 through 4.16.18 was patched in upstream version 4.16.19. The target version 4.18.7 inherited the complete fix from upstream commit f5d488d9bb (authored by brandon@pixelandtonic.com on 2026-01-14). The fix validates table column types against a whitelist and converts unsupported types (includin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (CVE-2026-27126) affecting versions 4.5.0-RC1 through 4.16.18 was patched in upstream version 4.16.19. The target version 4.18.7 inherited the complete fix from upstream commit f5d488d9bb (authored by brandon@pixelandtonic.com on 2026-01-14). The fix validates table column types against a whitelist and converts unsupported types (includin..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27127 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-27127 (DNS rebinding TOCTOU SSRF). The upstream vendor (Pixel & Tonic) deployed a comprehensive fix in commit 26268c0210 (June 15, 2026) that implements DNS pinning via CURLOPT_RESOLVE and pre-validates IPs through the craftcms/url-validator package. This fix was naturally included in version 4.18.7 (released August 18, 2026). The vulnerable pattern (separate DNS lookups without pinning) has been completely removed from the codebase. This is a vendor-authored fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27127" }, "impact_statement": "The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-27127 (DNS rebinding TOCTOU SSRF). The upstream vendor (Pixel & Tonic) deployed a comprehensive fix in commit 26268c0210 (June 15, 2026) that implements DNS pinning via CURLOPT_RESOLVE and pre-validates IPs through the craftcms/url-validator package. This fix was naturally included in version 4.18.7 (released August 18, 2026). The vulnerable pattern (separate DNS lookups without pinning) has been completely removed from the codebase. This is a vendor-authored fix, not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 The target repository at version 4.18.7 is NOT vulnerable to CVE-2026-27128. The TOCTOU race condition fix was applied by the upstream vendor (Pixel & Tonic) in commit 3e4afe1827 as part of version 4.16.19 (released 2026-01-15). Version 4.18.7, being newer than 4.16.19, naturally includes this fix. The getTokenRoute() method in src/services/Tokens.php correctly uses mutex locking to ensure atom...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target repository at version 4.18.7 is NOT vulnerable to CVE-2026-27128. The TOCTOU race condition fix was applied by the upstream vendor (Pixel & Tonic) in commit 3e4afe1827 as part of version 4.16.19 (released 2026-01-15). Version 4.18.7, being newer than 4.16.19, naturally includes this fix. The getTokenRoute() method in src/services/Tokens.php correctly uses mutex locking to ensure atom..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27129 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) is NOT AFFECTED by CVE-2026-27129. The vulnerable pattern (using gethostbyname() which only resolves IPv4) is absent because the upstream vendor refactored the code to use the craftcms/url-validator library (commit 26268c0210, Jun 2026). This library uses dns_get_record() with both DNS_A and DNS_AAAA records, and includes comprehensive IPv6 validation via FILTER_FL...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27129" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.7) is NOT AFFECTED by CVE-2026-27129. The vulnerable pattern (using gethostbyname() which only resolves IPv4) is absent because the upstream vendor refactored the code to use the craftcms/url-validator library (commit 26268c0210, Jun 2026). This library uses dns_get_record() with both DNS_A and DNS_AAAA records, and includes comprehensive IPv6 validation via FILTER_FL..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. The target craftcms/cms 4.18.7 contains the upstream vendor fix for CVE-2026-31857. The vulnerable unsandboxed Twig rendering call has been replaced with the sandboxed version in BaseElementSelectConditionRule.php line 88. Fix commit 8d4903647d was authored by brandon@pixelandtonic.com (Craft CMS upstream vendor) as part of the 4.17.4 release, and is included in the 4.18.7 version onboarded by TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "The target craftcms/cms 4.18.7 contains the upstream vendor fix for CVE-2026-31857. The vulnerable unsandboxed Twig rendering call has been replaced with the sandboxed version in BaseElementSelectConditionRule.php line 88. Fix commit 8d4903647d was authored by brandon@pixelandtonic.com (Craft CMS upstream vendor) as part of the 4.17.4 release, and is included in the 4.18.7 version onboarded by TuxCare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. CVE-2026-31858 does not affect Craft CMS version 4.18.7. The vulnerable component ElementSearchController was introduced in Craft CMS 5.x and does not exist in version 4.x. The target repository is running version 4.18.7, which predates the introduction of this controller. The only controller in version 4.18.7 that processes user query criteria (ElementIndexesController) already contains the proper defense mechanism (ElementHelper::cleanseQueryCriteria()) that was added for CVE-2026-25495. No alternative code path exists in version 4.18.7 that exhibits the same SQL injection vulnerability pattern.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "CVE-2026-31858 does not affect Craft CMS version 4.18.7. The vulnerable component ElementSearchController was introduced in Craft CMS 5.x and does not exist in version 4.x. The target repository is running version 4.18.7, which predates the introduction of this controller. The only controller in version 4.18.7 that processes user query criteria (ElementIndexesController) already contains the proper defense mechanism (ElementHelper::cleanseQueryCriteria()) that was added for CVE-2026-25495. No alternative code path exists in version 4.18.7 that exhibits the same SQL injection vulnerability pattern." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31859 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (XSS via javascript: URLs bypassing strip_tags()) was fixed by upstream vendor commit cc9921c14897ee2b592a431c2356af8a04ce4cfe, which added URL scheme validation before strip_tags() in src/web/User.php::setReturnUrl(). This fix was already present in upstream version 4.18.7 (released 2026-08-18) when TuxCare onboarded it (commit 4a22c9d3d...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31859" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (XSS via javascript: URLs bypassing strip_tags()) was fixed by upstream vendor commit cc9921c14897ee2b592a431c2356af8a04ce4cfe, which added URL scheme validation before strip_tags() in src/web/User.php::setReturnUrl(). This fix was already present in upstream version 4.18.7 (released 2026-08-18) when TuxCare onboarded it (commit 4a22c9d3d..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 The target (craftcms/cms 4.18.7) is not affected by CVE-2026-32262. The vulnerability (path traversal via unsanitized targetFilename parameter in AssetsController->replaceFile() allowing arbitrary file deletion) was fixed by upstream vendor Pixel & Tonic in version 4.17.5 (commit c997efbe4c, Feb 16 2026). The target version 4.18.7 inherits this fix from upstream. The validation code rejecting f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The target (craftcms/cms 4.18.7) is not affected by CVE-2026-32262. The vulnerability (path traversal via unsanitized targetFilename parameter in AssetsController->replaceFile() allowing arbitrary file deletion) was fixed by upstream vendor Pixel & Tonic in version 4.17.5 (commit c997efbe4c, Feb 16 2026). The target version 4.18.7 inherits this fix from upstream. The validation code rejecting f..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. CVE-2026-32263 affects Craft CMS versions 5.6.0 to before 5.9.11, specifically in src/controllers/EntryTypesController.php. The target version 4.18.7 is not affected because: (1) EntryTypesController.php does not exist in version 4.x; (2) Entry type management in 4.x is handled by SectionsController.php which does not use parse_str; (3) All 4 instances of parse_str in version 4.18.7 controllers (FieldsController.php and ElementIndexesController.php) are protected with Component::cleanseConfig() before passing data to Craft::configure(). The vulnerable code pattern described in the CVE does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "CVE-2026-32263 affects Craft CMS versions 5.6.0 to before 5.9.11, specifically in src/controllers/EntryTypesController.php. The target version 4.18.7 is not affected because: (1) EntryTypesController.php does not exist in version 4.x; (2) Entry type management in 4.x is handled by SectionsController.php which does not use parse_str; (3) All 4 instances of parse_str in version 4.18.7 controllers (FieldsController.php and ElementIndexesController.php) are protected with Component::cleanseConfig() before passing data to Craft::configure(). The vulnerable code pattern described in the CVE does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32264 fix dfec46362fcb by brandon@pixelandtonic.com (2026-02-16) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32264 fix dfec46362fcb by brandon@pixelandtonic.com (2026-02-16) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32267 fix 6301e217c5f1 by brandon@pixelandtonic.com (2026-02-18) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32267 fix 6301e217c5f1 by brandon@pixelandtonic.com (2026-02-18) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 4.18.7 is not affected by CVE-2026-33051. The CVE describes an XSS vulnerability specific to versions 5.9.0-beta.1 through 5.9.10 where the creator's fullName is rendered as raw HTML due to Template::raw() combined with Craft::t() in the revision/draft context menu. While the target version 4.18.7 does display creator names in the revision menu (src/templates/_includes/revisionmenu.tw...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 4.18.7 is not affected by CVE-2026-33051. The CVE describes an XSS vulnerability specific to versions 5.9.0-beta.1 through 5.9.10 where the creator's fullName is rendered as raw HTML due to Template::raw() combined with Craft::t() in the revision/draft context menu. While the target version 4.18.7 does display creator names in the revision menu (src/templates/_includes/revisionmenu.tw..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. Version 4.18.7 is NOT affected by CVE-2026-33157. The vulnerability exists in Craft CMS 5.6.0-5.9.12 where a NEW code path (fieldLayouts parameter in ElementIndexesController::actionFilterHud) bypasses existing sanitization. This specific code path does NOT exist in version 4.x. Version 4.18.7 only processes conditionConfig in actionFilterHud(), which is properly sanitized via Component::cleanseConfig() at line 421. The setFieldLayouts() method and fieldLayouts parameter handling were introduced in version 5.x and are completely absent from version 4.18.7's codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "Version 4.18.7 is NOT affected by CVE-2026-33157. The vulnerability exists in Craft CMS 5.6.0-5.9.12 where a NEW code path (fieldLayouts parameter in ElementIndexesController::actionFilterHud) bypasses existing sanitization. This specific code path does NOT exist in version 4.x. Version 4.18.7 only processes conditionConfig in actionFilterHud(), which is properly sanitized via Component::cleanseConfig() at line 421. The setFieldLayouts() method and fieldLayouts parameter handling were introduced in version 5.x and are completely absent from version 4.18.7's codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-33158 is NOT present in Craft CMS 4.18.7. The vulnerability described an authorization bypass in the assets/edit-image endpoint allowing low-privileged users to read private asset content. The upstream vendor (Pixel & Tonic) fixed this in version 4.17.8 (commit e674bbbd30, Feb 25 2026) by adding requireVolumePermissionByAsset() and requirePeerVolumePermissionByAsset() checks. Version 4...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 CVE-2026-33158 is NOT present in Craft CMS 4.18.7. The vulnerability described an authorization bypass in the assets/edit-image endpoint allowing low-privileged users to read private asset content. The upstream vendor (Pixel & Tonic) fixed this in version 4.17.8 (commit e674bbbd30, Feb 25 2026) by adding requireVolumePermissionByAsset() and requirePeerVolumePermissionByAsset() checks. Version 4..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) contains the complete fix for CVE-2026-33159. The upstream vendor (Pixel & Tonic) fixed the vulnerability in commit 7f0ead833f (2026-02-25), included it in their 4.18.7 release (2026-08-18), and TuxCare onboarded that pre-fixed version (2026-09-07). The vulnerable pattern\u2014missing authentication/authorization on ConfigSyncController\u2014is not present at HEAD. Verdict: ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.7) contains the complete fix for CVE-2026-33159. The upstream vendor (Pixel & Tonic) fixed the vulnerability in commit 7f0ead833f (2026-02-25), included it in their 4.18.7 release (2026-08-18), and TuxCare onboarded that pre-fixed version (2026-09-07). The vulnerable pattern\u2014missing authentication/authorization on ConfigSyncController\u2014is not present at HEAD. Verdict: ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-33160 fix 83fd398c12a3 by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-33160 fix 83fd398c12a3 by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 4.18.7) contains the upstream vendor's fix for the asset information disclosure vulnerability. The CVE describes an authorization bypass where the assets/image-editor endpoint (actionImageEditor method) returns focalPoint and other editor metadata without validating user permissions. The fix (commit 1f91f9b7aa, GHSA-vgjg-248p-rfm2) added requireVolumePermissionB...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 4.18.7) contains the upstream vendor's fix for the asset information disclosure vulnerability. The CVE describes an authorization bypass where the assets/image-editor endpoint (actionImageEditor method) returns focalPoint and other editor metadata without validating user permissions. The fix (commit 1f91f9b7aa, GHSA-vgjg-248p-rfm2) added requireVolumePermissionB..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS v4.18.7 is not affected by CVE-2026-33162. The vulnerability affects the `/actions/entries/move-to-section` endpoint and Entry::canMove() authorization method, which were introduced in Craft CMS v5.x. Version 4.18.7 does not have the move-entries-between-sections feature at all. The GraphQL resolver explicitly prevents section changes with the error \"Impossible to change the section o...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 Craft CMS v4.18.7 is not affected by CVE-2026-33162. The vulnerability affects the `/actions/entries/move-to-section` endpoint and Entry::canMove() authorization method, which were introduced in Craft CMS v5.x. Version 4.18.7 does not have the move-entries-between-sections feature at all. The GraphQL resolver explicitly prevents section changes with the error \"Impossible to change the section o..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset upload) is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit d20aecfaa0 (March 4, 2026) by adding scheme validation that blocks non-HTTP/HTTPS protocols (gopher, file, ftp, etc.). This fix was later refactored into the craftcms/url-validator library (commit 26268c0210, Jun...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "not_affected \u2014 CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset upload) is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit d20aecfaa0 (March 4, 2026) by adding scheme validation that blocks non-HTTP/HTTPS protocols (gopher, file, ftp, etc.). This fix was later refactored into the craftcms/url-validator library (commit 26268c0210, Jun..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) is not affected by CVE-2026-41130. The SSRF vulnerability in the resource-js endpoint was fixed by upstream vendor (Pixel & Tonic) in commit ebe7e85f1c, which is present in the target. The vulnerable code that made HTTP requests via Guzzle client has been replaced with local filesystem serving using App::resourcePathByUri() with path traversal protection. Additiona...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.7) is not affected by CVE-2026-41130. The SSRF vulnerability in the resource-js endpoint was fixed by upstream vendor (Pixel & Tonic) in commit ebe7e85f1c, which is present in the target. The vulnerable code that made HTTP requests via Guzzle client has been replaced with local filesystem serving using App::resourcePathByUri() with path traversal protection. Additiona..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55790 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. CVE-2026-55790 (GHSA-24x4-j6x9-rfw5): The XSS vulnerability in the CraftSupport widget is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit 6bbb66038a (May 2026) by adding HTML escaping via Craft.escapeHtml() and using jQuery's text: option for error messages. This fix was included in upstream's 4.18.7 release (August 2026), which TuxCare subsequently adopted for ELS support (September 2026). TuxCare did not backport this specific fix; they inherited an already-fixed upstream release. Both defense mechanisms from the patch are present and correctly implemented at lines 382 and 555-557 of CraftSupportWidget.js.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55790" }, "impact_statement": "CVE-2026-55790 (GHSA-24x4-j6x9-rfw5): The XSS vulnerability in the CraftSupport widget is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit 6bbb66038a (May 2026) by adding HTML escaping via Craft.escapeHtml() and using jQuery's text: option for error messages. This fix was included in upstream's 4.18.7 release (August 2026), which TuxCare subsequently adopted for ELS support (September 2026). TuxCare did not backport this specific fix; they inherited an already-fixed upstream release. Both defense mechanisms from the patch are present and correctly implemented at lines 382 and 555-557 of CraftSupportWidget.js." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55793 is fixed in version 4.18.7-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55793" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is not affected. The CVE describes a vulnerability in version 5.0.0-RC1+, but analysis of 4.18.7 code shows user group names are protected by Twig's default HTML auto-escaping and Vue's text interpolation escaping. All rendering paths include runtime defenses that transform script content before display, preventing execution in administrators' browsers.", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is not affected. The CVE describes a vulnerability in version 5.0.0-RC1+, but analysis of 4.18.7 code shows user group names are protected by Twig's default HTML auto-escaping and Vue's text interpolation escaping. All rendering paths include runtime defenses that transform script content before display, preventing execution in administrators' browsers." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56382 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. Target version 4.18.7 is not affected by CVE-2026-56382. The vulnerable method `actionRenderCardPreview()` from the v5.x patch does not exist in v4.18.7's codebase. The CVE affects Craft CMS versions >= 5.5.0 and <= 5.9.13, while this target is v4.18.7. Although TuxCare backported this CVE to v3.9.15 (fixing a different vulnerable method `actionRenderLayoutElementSelector()`), v4.18.7 contains neither the v5.x vulnerable method nor the v3.x vulnerable method. The methods that do exist in v4.18.7 and handle layout configurations (`actionApplyLayoutTabSettings()`, `actionApplyLayoutElementSettings()`) properly sanitize all config parameters via `Component::cleanseConfig()` before passing them to layout creation functions.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56382" }, "impact_statement": "Target version 4.18.7 is not affected by CVE-2026-56382. The vulnerable method `actionRenderCardPreview()` from the v5.x patch does not exist in v4.18.7's codebase. The CVE affects Craft CMS versions >= 5.5.0 and <= 5.9.13, while this target is v4.18.7. Although TuxCare backported this CVE to v3.9.15 (fixing a different vulnerable method `actionRenderLayoutElementSelector()`), v4.18.7 contains neither the v5.x vulnerable method nor the v3.x vulnerable method. The methods that do exist in v4.18.7 and handle layout configurations (`actionApplyLayoutTabSettings()`, `actionApplyLayoutElementSettings()`) properly sanitize all config parameters via `Component::cleanseConfig()` before passing them to layout creation functions." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56383 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The upstream vendor fix (commit 7b372de262b8) is present in HEAD, applying HTML encoding to heading-type cell values before rendering. The fix was authored by brandon@pixelandtonic.com (Craft CMS upstream) and shipped in version 4.16.19. TuxCare onboarded version 4.18.7 (released 2026-08-18) which already contained this fix. No TuxCare attribution signals ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56383" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The upstream vendor fix (commit 7b372de262b8) is present in HEAD, applying HTML encoding to heading-type cell values before rendering. The fix was authored by brandon@pixelandtonic.com (Craft CMS upstream) and shipped in version 4.16.19. TuxCare onboarded version 4.18.7 (released 2026-08-18) which already contained this fix. No TuxCare attribution signals ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56384 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-56384 fix ed56049c9d3f by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56384" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-56384 fix ed56049c9d3f by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56385 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 contains the upstream vendor's authorization fix for CVE-2026-56385. The vulnerability (authorization bypass in assets/preview-file endpoint) was fixed by Pixel & Tonic in commit d30df31122 (Feb 2026) which added requireVolumePermissionByAsset and requirePeerVolumePermissionByAsset checks to actionPreviewFile(). This fix was included in upstream Craft CMS 4.17.8 and 4.18.7...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56385" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 contains the upstream vendor's authorization fix for CVE-2026-56385. The vulnerability (authorization bypass in assets/preview-file endpoint) was fixed by Pixel & Tonic in commit d30df31122 (Feb 2026) which added requireVolumePermissionByAsset and requirePeerVolumePermissionByAsset checks to actionPreviewFile(). This fix was included in upstream Craft CMS 4.17.8 and 4.18.7..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-11-08T14:16:00.068422+00:00", "status_notes": "Vulnerability CVE-2026-56393 affects version 4.18.7-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56393" }, "action_statement": "Vulnerability CVE-2026-56393 affects version 4.18.7-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. Target Craft CMS 4.18.7 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint has been fixed by upstream vendor commit 30f5f1a8d6 (authored by brandon@pixelandtonic.com), which added regex validation to reject extension parameters containing traversal sequences. The fix validates extensions with /^\\w+$/ before filesystem operations, preventing the attack chain described in the CVE. TuxCare adopted this fix when onboarding version 4.18.7 to ELS support.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "Target Craft CMS 4.18.7 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint has been fixed by upstream vendor commit 30f5f1a8d6 (authored by brandon@pixelandtonic.com), which added regex validation to reject extension parameters containing traversal sequences. The fix validates extensions with /^\\w+$/ before filesystem operations, preventing the attack chain described in the CVE. TuxCare adopted this fix when onboarding version 4.18.7 to ELS support." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was fixed in upstream Craft CMS 3.7.29 (commit 7ca2b2d2c by brandon@pixelandtonic.com, Jan 2022) and was already present in the 4.18.7 release that TuxCare onboarded. The fix adds a filter validating feed item permalinks match /^https?:\\/\\// before creating anchor elements, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was fixed in upstream Craft CMS 3.7.29 (commit 7ca2b2d2c by brandon@pixelandtonic.com, Jan 2022) and was already present in the 4.18.7 release that TuxCare onboarded. The fix adds a filter validating feed item permalinks match /^https?:\\/\\// before creating anchor elements, pre..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10090 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10859 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 3.9.15-p9+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 3.9.15-p9+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 3.9.15-p9+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 3.9.15-p9+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 3.9.15-p9+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2023-30179 is a false positive for craftcms/cms 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2023-30179" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33495 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 3.9.15-p9+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52291 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52291" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52292 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52292" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 3.9.15-p9+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. per review of Brhane", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "per review of Brhane" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-35939 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-35939" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54417 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-54417" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-57811" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ...", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68437 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68437" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68454" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68456 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68456" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-11-09T23:08:00.049119+00:00", "status_notes": "Vulnerability CVE-2026-115934 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 Target is Craft CMS 3.9.15 (TuxCare build). No vendor patch was supplied and the CVE text is vague. The only element-search SQL path is Search service, which builds SQL by string concatenation, but attacker input is neutralised before concatenation. The anonymous GraphQL endpoint's orderBy is allow-listed. No unauthenticated element-search endpoint injects raw input into SQL. Confidence is mode...", "vulnerability": { "name": "CVE-2026-115934" }, "impact_statement": "not_affected \u2014 Target is Craft CMS 3.9.15 (TuxCare build). No vendor patch was supplied and the CVE text is vague. The only element-search SQL path is Search service, which builds SQL by string concatenation, but attacker input is neutralised before concatenation. The anonymous GraphQL endpoint's orderBy is allow-listed. No unauthenticated element-search endpoint injects raw input into SQL. Confidence is mode..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-11-02T14:56:09.367348+00:00", "status_notes": "Vulnerability CVE-2026-115935 affects version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115935" }, "action_statement": "Vulnerability CVE-2026-115935 affects version 3.9.15-p9+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2026-115938 affects version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115938" }, "action_statement": "Vulnerability CVE-2026-115938 affects version 3.9.15-p9+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25493" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25494" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25495" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25496" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25498" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27127 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27127" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27128" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27129 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27129" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28783 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-28783" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29069 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29069" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29113" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31859 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-31859" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32262" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32264" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32267" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 affects version 3.9.15-p9+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare.", "vulnerability": { "name": "CVE-2026-33157" }, "action_statement": "Vulnerability CVE-2026-33157 affects version 3.9.15-p9+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33158" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33159" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33160" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33161" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55790 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55790" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55793 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55793" }, "impact_statement": "not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56382 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56382" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56383 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56383" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56384 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56384" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56385 is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56385" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-11-08T14:16:00.068422+00:00", "status_notes": "Vulnerability CVE-2026-56393 affects version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56393" }, "action_statement": "Vulnerability CVE-2026-56393 affects version 3.9.15-p9+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3m9m-24vh-39wx is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-3m9m-24vh-39wx" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-44px-qjjc-xrhq is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-44px-qjjc-xrhq" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6j87-m5qx-9fqp is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-6j87-m5qx-9fqp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-86vw-x4ww-x467 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-86vw-x4ww-x467" }, "impact_statement": "not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-95wr-3f2v-v2wh does not affect version 3.9.15-p9+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "GHSA-95wr-3f2v-v2wh" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c43v-4cr8-6mvp does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c43v-4cr8-6mvp" }, "impact_statement": "not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-19T17:32:00.114420+00:00", "status_notes": "Vulnerability GHSA-g3hp-vvqf-8vw6 does not affect version 3.9.15-p9+tuxcare of craftcms/cms. craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-g3hp-vvqf-8vw6" }, "impact_statement": "craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 3.9.15-p9+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x76w-8c62-48mg is fixed in version 3.9.15-p9+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-x76w-8c62-48mg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10090 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10859 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 3.9.15-p7+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 3.9.15-p7+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 3.9.15-p7+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 3.9.15-p7+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 3.9.15-p7+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2023-30179 is a false positive for craftcms/cms 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2023-30179" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33495 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 3.9.15-p7+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52291 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52291" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52292 affects version 3.9.15-p7+tuxcare of craftcms/cms, and is fixed in 3.9.15-p8+tuxcare.", "vulnerability": { "name": "CVE-2024-52292" }, "action_statement": "Vulnerability CVE-2024-52292 affects version 3.9.15-p7+tuxcare of craftcms/cms, and is fixed in 3.9.15-p8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 3.9.15-p7+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. per review of Brhane", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "per review of Brhane" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-35939 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-35939" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54417 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-54417" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-57811" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ...", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68437 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68437" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 affects version 3.9.15-p7+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2025-68454" }, "action_statement": "Vulnerability CVE-2025-68454 affects version 3.9.15-p7+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68456 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68456" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-11-09T23:08:00.049119+00:00", "status_notes": "Vulnerability CVE-2026-115934 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 Target is Craft CMS 3.9.15 (TuxCare build). No vendor patch was supplied and the CVE text is vague. The only element-search SQL path is Search service, which builds SQL by string concatenation, but attacker input is neutralised before concatenation. The anonymous GraphQL endpoint's orderBy is allow-listed. No unauthenticated element-search endpoint injects raw input into SQL. Confidence is mode...", "vulnerability": { "name": "CVE-2026-115934" }, "impact_statement": "not_affected \u2014 Target is Craft CMS 3.9.15 (TuxCare build). No vendor patch was supplied and the CVE text is vague. The only element-search SQL path is Search service, which builds SQL by string concatenation, but attacker input is neutralised before concatenation. The anonymous GraphQL endpoint's orderBy is allow-listed. No unauthenticated element-search endpoint injects raw input into SQL. Confidence is mode..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-11-02T14:56:09.367348+00:00", "status_notes": "Vulnerability CVE-2026-115935 affects version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115935" }, "action_statement": "Vulnerability CVE-2026-115935 affects version 3.9.15-p7+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2026-115938 affects version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115938" }, "action_statement": "Vulnerability CVE-2026-115938 affects version 3.9.15-p7+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25493" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25494" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25495" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25496" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25498" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27127 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27127" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27128" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27129 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27129" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28783 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-28783" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29069 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29069" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29113" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31859 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-31859" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 affects version 3.9.15-p7+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32262" }, "action_statement": "Vulnerability CVE-2026-32262 affects version 3.9.15-p7+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 affects version 3.9.15-p7+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32264" }, "action_statement": "Vulnerability CVE-2026-32264 affects version 3.9.15-p7+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32267" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 affects version 3.9.15-p7+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare.", "vulnerability": { "name": "CVE-2026-33157" }, "action_statement": "Vulnerability CVE-2026-33157 affects version 3.9.15-p7+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33158" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33159" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33160" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-33161" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55790 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55790" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55793 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55793" }, "impact_statement": "not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56382 affects version 3.9.15-p7+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-56382" }, "action_statement": "Vulnerability CVE-2026-56382 affects version 3.9.15-p7+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56383 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56383" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56384 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56384" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56385 is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56385" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-11-08T14:16:00.068422+00:00", "status_notes": "Vulnerability CVE-2026-56393 affects version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56393" }, "action_statement": "Vulnerability CVE-2026-56393 affects version 3.9.15-p7+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3m9m-24vh-39wx is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-3m9m-24vh-39wx" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-44px-qjjc-xrhq is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-44px-qjjc-xrhq" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6j87-m5qx-9fqp is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-6j87-m5qx-9fqp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-86vw-x4ww-x467 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-86vw-x4ww-x467" }, "impact_statement": "not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-95wr-3f2v-v2wh does not affect version 3.9.15-p7+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "GHSA-95wr-3f2v-v2wh" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c43v-4cr8-6mvp does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c43v-4cr8-6mvp" }, "impact_statement": "not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-19T17:32:00.114420+00:00", "status_notes": "Vulnerability GHSA-g3hp-vvqf-8vw6 does not affect version 3.9.15-p7+tuxcare of craftcms/cms. craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-g3hp-vvqf-8vw6" }, "impact_statement": "craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 3.9.15-p7+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x76w-8c62-48mg is fixed in version 3.9.15-p7+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-x76w-8c62-48mg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10090 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10090" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10859 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "AIKIDO-2025-10859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 affects Craft CMS before 3.6.0 due to HTML file uploads (htm/html extensions) in the default allowed file extensions, enabling XSS attacks via front-end forms. The target version 3.9.15 already includes the upstream fix from version 3.6.0, which removed htm and html from the default allowedFileExtensions configuration. The vulnerable code pattern is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 3.9.15-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 3.9.15-p13+tuxcare) is not affected by CVE-2021-32470. The XSS vulnerability in the promptForTabName function has been fixed by the upstream vendor. The fix (wrapping prompt() return value with Craft.escapeHtml()) is present at src/web/assets/cp/src/js/FieldLayoutDesigner.js:266-268. The vulnerable pattern (unescaped prompt input used in DOM) does not exist in the target. ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 3.9.15-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-29T08:22:18.108081+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is not present in Craft CMS 3.9.15. The vulnerability was an XSS issue in FeedWidget.js where malicious feed data could inject javascript: URLs into anchor tags. The upstream vendor (Pixel & Tonic) fixed this in version 3.7.29 by adding URL scheme validation (filtering permalinks to require http:// or https://). Since the target version 3.9.15 > 3.7.29, the fix was already presen..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 3.9.15-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "already_fixed \u2014 CVE-2022-37251 (XSS via Drafts) has already been fixed in the target repository. The target contains the vendor's patches from upstream Craft CMS 3.7.55.2 (September 2022) that address this CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 3.9.15-p4+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 3.9.15-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 Target CraftCMS 3.9.15-p13+tuxcare is not affected by CVE-2023-30177. The XSS vulnerability in Asset volume name output was fixed by Pixel & Tonic in version 3.7.68 (commit 00fb253d53, Feb 2023). The fix - Html::encode() wrapping of $volume->name - is present in the target at src/elements/Asset.php:2255. This fix shipped with upstream release 3.9.15, which TuxCare onboarded via snapshot commit ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2023-30179 is a false positive for craftcms/cms 3.9.15-p4+tuxcare.", "vulnerability": { "name": "CVE-2023-30179" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "already_fixed \u2014 CVE-2023-31144 (XSS via unescaped slashes in JSON) is already fixed in the target repository. The fix - removing JSON_UNESCAPED_SLASHES from the default encoding options - is present in src/helpers/Json.php at lines 36-39, matching the vendor patch exactly. All call sites have been updated to use the safe default." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in this target. The vulnerability was fixed upstream by commit 9d0cd0bda7 (April 3, 2023) and shipped in Craft CMS 3.9.15. TuxCare's snapshot of version 3.9.15 (commit dfb41889fa) already contained the fix. The target code uses jQuery's safe `text` property for rendering error messages, not vulnerable HTML concatenation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33195 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33195" }, "impact_statement": "already_fixed \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33195. The vulnerability was specific to version 4.x's externalLink macro which doesn't exist in version 3.x. Version 3.9.15 uses a safer architecture where RSS feed data is passed via the 'text' parameter which is automatically HTML-encoded by tagFunction (Extension.php:1567), preventing XSS attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33196 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33196" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) uses server-side Twig templates with built-in HTML auto-escaping, preventing XSS through file paths and volume URIs. The upstream vulnerability (CVE-2023-33196) affects version 4.4.7 which uses client-side TypeScript for HTML generation without escaping. This is a fundamental architectural difference between versions 3.x and 4.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33197 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33197" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2023-33197. The vulnerable feature (session overview table with client-side HTML rendering of volume names) does not exist in version 3.9.15. The target uses server-side Twig rendering with automatic HTML escaping, and volume names are never sent to JavaScript for client-side HTML construction." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-33495 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-33495" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS core (craftcms/cms), while the vulnerability CVE-2023-36260 exists in the Feed Me plugin (craftcms/feed-me), which is a separate third-party plugin codebase. The Feed Me plugin is not bundled with or integrated into Craft CMS core. The vulnerable code (FeedsController.php with actionSaveFeed method) does not exist anywhere in the target repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40035 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-40035" }, "impact_statement": "already_fixed \u2014 CVE-2023-40035 has been fixed in the target repository. The target (Craft CMS 3.9.15-p3+tuxcare) contains both security fixes: (1) Component::cleanseConfig() method that removes malicious 'on ' and 'as ' configuration keys to prevent RCE via event handler/behavior injection, and (2) FileHelper::normalizePath() that strips 'file://' protocol wrappers. The cleanseConfig fix was added in version 3..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41892 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41892" }, "impact_statement": "already_fixed \u2014 The target Craft CMS 3.9.15 repository already contains the fix for CVE-2023-41892. The vulnerability (RCE via Yii2 'on ' and 'as ' configuration keys) was originally patched in Craft 4.4.15 (June 2023) and backported to Craft 3.9.4 (September 2023). The target version 3.9.15 includes the Component::cleanseConfig() method that filters malicious config keys before object instantiation, matching ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "already_fixed \u2014 CVE-2024-21622 is NOT present in the target repository. The target is Craft CMS version 3.9.15-p5+tuxcare, which already contains the security fix introduced in version 3.9.6. The vulnerability allowed unauthorized username modification via POST body parameters, but the fix properly restricts this to authorized contexts only (new user creation, admin users, or self-modification)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 3.9.15-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 does not contain TOTP authentication functionality. The vulnerability CVE-2024-41800 affects Craft CMS 5.x, which introduced TOTP-based two-factor authentication. The target version predates this feature entirely." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52291 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-52291" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52292 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p8+tuxcare.", "vulnerability": { "name": "CVE-2024-52292" }, "action_statement": "Vulnerability CVE-2024-52292 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "already_fixed \u2014 The target repository (Craft CMS 3.9.15) already contains an equivalent and more comprehensive fix for the Twig SSTI arrow function injection vulnerability through prior TuxCare backports (PHPELSCVE-320). The defense mechanism '_checkFilterSupport()' blocks dangerous function names in Twig filter arrow parameters with a more extensive blocklist (26 functions) than the upstream patch (5 function..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 3.9.15-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "Version 3.9.15 is not vulnerable. Summary: The target repository (Craft CMS 3.9.15-p3+tuxcare) is NOT vulnerable to CVE-2025-23209. While the CVE affects Craft 4 and 5, this Craft 3.x version has been patched by completely disabling the vulnerable database restore functionality rather than adding validation. The vulnerable code pattern (unsanitized use of dbBackupPath) no longer exists in the codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. per review of Brhane", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "per review of Brhane" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-35939 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-35939" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54417 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-54417" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57811 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2025-57811" }, "action_statement": "Vulnerability CVE-2025-57811 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ...", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 The target version 3.9.15 is not affected by CVE-2025-68436. While the underlying data flaw exists (photoId is a public property without ownership validation), the architecture in version 3.9.15 prevents exploitation by regular authenticated users through permission constraints. The CVE explicitly lists versions 4.0.0-RC1+ and 5.0.0-RC1+ as affected, indicating the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68437 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68437" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68454 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2025-68454" }, "action_statement": "Vulnerability CVE-2025-68454 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Not affected. CVE-2025-68455 targets Craft 4/5 endpoints (apply-layout-element-settings, render-card-preview) introduced with the Craft 4 field layout designer overhaul; those routes do not exist in Craft 3.9.15. The exploit relies on injecting 'as ' and 'on ' keys via Component::__set(), which only interprets those prefixes when the target extends Yii's Component class. In 3.9.15, field-layout elements extend yii\\base\\BaseObject (not Component); BaseObject::__set() throws UnknownPropertyException on 'as'/'on' keys instead of attaching a Behavior or wildcard event handler. Even if an attacker reached the config path, no malicious behavior/handler attaches. The vulnerability was introduced by a base-class change made after 3.9.15. Reopened per developer analysis; VC verdict cited FieldsController::actionRenderLayoutElementSelector but the injection sink is inert on 3.9.15." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-68456 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68456" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-11-09T23:08:00.049119+00:00", "status_notes": "Vulnerability CVE-2026-115934 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 Target is Craft CMS 3.9.15 (TuxCare build). No vendor patch was supplied and the CVE text is vague. The only element-search SQL path is Search service, which builds SQL by string concatenation, but attacker input is neutralised before concatenation. The anonymous GraphQL endpoint's orderBy is allow-listed. No unauthenticated element-search endpoint injects raw input into SQL. Confidence is mode...", "vulnerability": { "name": "CVE-2026-115934" }, "impact_statement": "not_affected \u2014 Target is Craft CMS 3.9.15 (TuxCare build). No vendor patch was supplied and the CVE text is vague. The only element-search SQL path is Search service, which builds SQL by string concatenation, but attacker input is neutralised before concatenation. The anonymous GraphQL endpoint's orderBy is allow-listed. No unauthenticated element-search endpoint injects raw input into SQL. Confidence is mode..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-11-02T14:56:09.367348+00:00", "status_notes": "Vulnerability CVE-2026-115935 affects version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115935" }, "action_statement": "Vulnerability CVE-2026-115935 affects version 3.9.15-p4+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2026-115938 affects version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115938" }, "action_statement": "Vulnerability CVE-2026-115938 affects version 3.9.15-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-25491. The vulnerability affects Craft CMS versions 5.0.0-RC1 to 5.8.21 where Entry Type names are rendered via server-side PHP without HTML encoding. Version 3.9.15 uses a fundamentally different architecture (Twig/Vue.js frameworks) that provides automatic HTML escaping at multiple layers, preventing XSS attacks. The vulnerable code pattern (unescape..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25493 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25493" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25494 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-25494" }, "action_statement": "Vulnerability CVE-2026-25494 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25495 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-25495" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25496 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p5+tuxcare.", "vulnerability": { "name": "CVE-2026-25496" }, "action_statement": "Vulnerability CVE-2026-25496 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25498 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-25498" }, "action_statement": "Vulnerability CVE-2026-25498 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "Not affected. CVE-2026-27126 (GHSA-3jh3-prx3-w6wc) is a stored XSS in the 'html' column type of editableTable.twig. Per NVD it affects craftcms/cms >=4.5.0-RC1,<4.16.19 and >=5.0.0-RC1,<5.8.23 (patched 4.16.19/5.8.23). The 'html' column type was introduced in Craft 4.5; version 3.9.15 predates it and has no 'html' column type, so it is not in the affected range. Backport MR !27 closed." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27127 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27127" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27128 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-27128" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27129 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-27129" }, "action_statement": "Vulnerability CVE-2026-27129 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28783 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-28783" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29069 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-29069" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29113 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-29113" }, "action_statement": "Vulnerability CVE-2026-29113 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "not_affected \u2014 Version 3.9.15 is not affected by CVE-2026-31857. The vulnerability requires the conditions system (BaseElementSelectConditionRule) which was introduced in Craft 4.x and does not exist in this 3.x version. While renderObjectTemplate() lacks sandboxing in 3.9.15, no code path exists for low-privilege authenticated users to exploit it." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "not_affected \u2014 CVE-2026-31858 describes a SQL injection vulnerability in ElementSearchController::actionSearch() where user-supplied criteria parameters (where, orderBy, etc.) reach SQL queries without sanitization. This controller does not exist in Craft CMS 3.9.15 (it was introduced in version 5.x). The 3.9.15 architecture uses only ElementIndexesController for element queries, which already has the unset()..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31859 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-31859" }, "action_statement": "Vulnerability CVE-2026-31859 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32262 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32262" }, "action_statement": "Vulnerability CVE-2026-32262 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "not_affected \u2014 CVE-2026-32263 affects Craft CMS versions 5.6.0 to 5.9.11 in the EntryTypesController. The target repository is Craft CMS version 3.9.15, which uses a different architectural approach for entry type management. The specific vulnerability pattern (parse_str \u2192 Craft::configure without cleanseConfig in EntryTypesController) does not exist in version 3.x." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32264 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-32264" }, "action_statement": "Vulnerability CVE-2026-32264 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32267 is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-32267" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is not affected by CVE-2026-33051. The vulnerability affects versions 5.9.0-beta.1 through 5.9.10 and involves Template::raw() bypassing HTML escaping when rendering creator fullName in the revision/draft context menu. Version 3.9.15 uses a different architecture with Twig auto-escaping and jQuery .text() that prevent XSS attacks through automatic HTML entity encoding." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33157 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare.", "vulnerability": { "name": "CVE-2026-33157" }, "action_statement": "Vulnerability CVE-2026-33157 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33158 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33158" }, "action_statement": "Vulnerability CVE-2026-33158 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33159 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33159" }, "action_statement": "Vulnerability CVE-2026-33159 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33160 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33160" }, "action_statement": "Vulnerability CVE-2026-33160 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33161 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-33161" }, "action_statement": "Vulnerability CVE-2026-33161 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "Not affected. CVE-2026-33162 (cross-section entry-move authorization bypass) affects craftcms/cms 5.3.0..5.9.13 only. The move-entries-across-sections feature (EntriesController move action + Entry::canMove) was introduced in Craft 5.3 and does not exist in 3.9.15. Backport MR !36 closed as not applicable." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "CVE-2026-41129 fix already exists in commit ea60afd3edf8799d3461c8199fe9f09145756d1b" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 Craft CMS version 3.9.15 is not affected by CVE-2026-41130. The vulnerable actionResourceJs() method that proxies remote JavaScript resources via HTTP requests does not exist in this version. Version 3.9.15 uses a different architecture (_processResourceRequest() in Application.php) that only serves local files and never makes HTTP requests, preventing the SSRF vulnerability." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55790 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-55790" }, "action_statement": "Vulnerability CVE-2026-55790 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55793 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55793" }, "impact_statement": "not_affected \u2014 CVE-2026-55793 does not affect Craft CMS version 3.9.15. The vulnerability was introduced in version 5.x when the code was refactored to add accessibility features. Version 3.9.15 uses a fundamentally different architecture that never interpolates entry titles into HTML during toggle creation." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Craft CMS 3.9.15 is NOT affected by CVE-2026-56381. The CVE explicitly states the vulnerability exists \"from version 5.0.0-RC1\", excluding version 3.9.15. Analysis confirms that both Twig (default autoescape='html' in Twig 2.x) and Vue 2 ({{ }} interpolation auto-escaping) provide runtime HTML escaping protection. User group names are rendered in templates/_includes/permissions.html, templates/..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56382 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare.", "vulnerability": { "name": "CVE-2026-56382" }, "action_statement": "Vulnerability CVE-2026-56382 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56383 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-56383" }, "action_statement": "Vulnerability CVE-2026-56383 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56384 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-56384" }, "action_statement": "Vulnerability CVE-2026-56384 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56385 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-56385" }, "action_statement": "Vulnerability CVE-2026-56385 affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-11-08T14:16:00.068422+00:00", "status_notes": "Vulnerability CVE-2026-56393 affects version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56393" }, "action_statement": "Vulnerability CVE-2026-56393 affects version 3.9.15-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "The vulnerable assets/icon endpoint with the extension parameter does not exist in Craft CMS 3.9.15. This endpoint was introduced in version 4.0.0-RC1, which is later than the target version. Exhaustive searches found no controller action, route definition, or code accepting an extension parameter for icon operations. The only icon-related code (getIconPath in Assets service) is internal and not exposed via HTTP endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3m9m-24vh-39wx is fixed in version 3.9.15-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "GHSA-3m9m-24vh-39wx" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-44px-qjjc-xrhq affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "GHSA-44px-qjjc-xrhq" }, "action_statement": "Vulnerability GHSA-44px-qjjc-xrhq affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6j87-m5qx-9fqp affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare.", "vulnerability": { "name": "GHSA-6j87-m5qx-9fqp" }, "action_statement": "Vulnerability GHSA-6j87-m5qx-9fqp affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-86vw-x4ww-x467 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-86vw-x4ww-x467" }, "impact_statement": "not_affected \u2014 The specific vulnerability described in GHSA-86vw-x4ww-x467 does not affect Craft CMS version 3.9.15. The CVE references method `actionRenderCardPreview()` in FieldsController and function `Fields::createLayout()`, neither of which exist in this version. While a similar method `actionRenderLayoutElementSelector()` exists with a comparable code pattern (accepting POST config without cleanseConfi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-95wr-3f2v-v2wh does not affect version 3.9.15-p4+tuxcare of craftcms/cms. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "GHSA-95wr-3f2v-v2wh" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-c43v-4cr8-6mvp does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c43v-4cr8-6mvp" }, "impact_statement": "not_affected \u2014 The icon-serving feature described in GHSA-c43v-4cr8-6mvp does not exist in Craft CMS version 3.9.15. The vulnerable endpoint (assets/icon), controller action (AssetsController::actionIcon), and helper functions (Assets::iconPath, Assets::iconSvg) were introduced in a later version. The target version cannot be exploited via this vulnerability because the input-receiving code path does not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-19T17:32:00.114420+00:00", "status_notes": "Vulnerability GHSA-g3hp-vvqf-8vw6 does not affect version 3.9.15-p4+tuxcare of craftcms/cms. craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-g3hp-vvqf-8vw6" }, "impact_statement": "craftcms/cms 3.9.15 is not affected by GHSA-g3hp-vvqf-8vw6 (CVE-2026-56381). The advisory affects only >= 5.0.0-RC1, <= 5.8.21. The XSS sink is _includes/forms/checkbox.twig printing the checkbox label with {{ label|raw }}, which was introduced during the 5.x line (absent in 3.9.15, 4.0.0, 4.18.9 and 5.0.0; present in 5.8.21) and fixed upstream in 86b18872d6/02d865ba9c (5.9.0). In 3.9.15 the same caller (users/_edit.html:173, label: group.name|t('site')) renders through _includes/forms/checkbox.html:36 as {{ label }}, which is HTML-autoescaped (CP templates use Twig's html autoescape strategy, and the t filter is not marked safe). The other group-name path on the page (UserPermissions.php:139, 'Assign users to {group}' permission label) uses the same escaped checkbox template." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 3.9.15-p4+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 3.9.15) is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was patched by the upstream vendor (Pixel & Tonic) in version 3.7.29 (January 2022). Since the target version 3.9.15 was released after 3.7.29, it already contains the upstream fix. The fix filters feed items to reject permalinks that don't start with http:// or https://, pre..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@3.9.15-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x76w-8c62-48mg affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare.", "vulnerability": { "name": "GHSA-x76w-8c62-48mg" }, "action_statement": "Vulnerability GHSA-x76w-8c62-48mg affects version 3.9.15-p4+tuxcare of craftcms/cms, and is fixed in 3.9.15-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is not affected by CVE-2021-27902. The vulnerability allowed XSS via uploaded .htm/.html files in versions before 3.6.0. The fix (commit 8ee85a8f03) removed 'htm' and 'html' from the default allowedFileExtensions list. This fix was already present in the upstream Craft CMS 4.18.7 release that TuxCare onboarded, authored by Brandon Kelly (brandon@pixelandto...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is not affected by CVE-2021-27902. The vulnerability allowed XSS via uploaded .htm/.html files in versions before 3.6.0. The fix (commit 8ee85a8f03) removed 'htm' and 'html' from the default allowedFileExtensions list. This fix was already present in the upstream Craft CMS 4.18.7 release that TuxCare onboarded, authored by Brandon Kelly (brandon@pixelandto..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 4.18.7-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 4.18.7-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-32470 (XSS in tab name prompt) is NOT present in the target. The upstream vendor fixed this vulnerability in commit f9378aa154 (April 2021) by wrapping the prompt() result with Craft.escapeHtml() in FieldLayoutDesigner.js:150. This fix was already included in the upstream release before TuxCare onboarded version 4.18.7. The vulnerable code pattern (unescaped user input from prompt dire...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 CVE-2021-32470 (XSS in tab name prompt) is NOT present in the target. The upstream vendor fixed this vulnerability in commit f9378aa154 (April 2021) by wrapping the prompt() result with Craft.escapeHtml() in FieldLayoutDesigner.js:150. This fix was already included in the upstream release before TuxCare onboarded version 4.18.7. The vulnerable code pattern (unescaped user input from prompt dire..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 4.18.7-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 4.18.7-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 (XSS in Craft CMS before 3.7.29) is not present in target version 4.18.7. The vulnerability allowed JavaScript execution via malicious feed item permalinks (e.g., javascript: URIs) in the FeedWidget. The fix (commit 7ca2b2d2cc) adds permalink URL scheme validation to reject non-HTTP(S) URIs. This fix was shipped in upstream release 3.7.29 (Jan 2022) and is present in the target c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 (XSS in Craft CMS before 3.7.29) is not present in target version 4.18.7. The vulnerability allowed JavaScript execution via malicious feed item permalinks (e.g., javascript: URIs) in the FeedWidget. The fix (commit 7ca2b2d2cc) adds permalink URL scheme validation to reject non-HTTP(S) URIs. This fix was shipped in upstream release 3.7.29 (Jan 2022) and is present in the target c..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 4.18.7-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 4.18.7-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS 4.2.0.1 due to missing HTML encoding on user-controllable content (revision notes, tab names, group names, address titles). The vulnerability was fixed by upstream Craft CMS developers (Pixel & Tonic) in version 4.2.1 (released 2022-08-09) via commits that added Html::encode() to all affected output locations. Target version 4.18.7 inherits the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS 4.2.0.1 due to missing HTML encoding on user-controllable content (revision notes, tab names, group names, address titles). The vulnerability was fixed by upstream Craft CMS developers (Pixel & Tonic) in version 4.2.1 (released 2022-08-09) via commits that added Html::encode() to all affected output locations. Target version 4.18.7 inherits the..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 4.18.7-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 4.18.7-p4+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 4.18.7-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 4.18.7-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-30177 (XSS in Volume Name) is not present in target version 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream Craft CMS in version 4.4.0-beta.1 (commit 1381993c81, Dec 22, 2022) by adding Html::encode() to the volume name display in asset metadata. The fix was already present in the upstream release when TuxCare onboarded version 4.18.7. Both identified volume name d...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 CVE-2023-30177 (XSS in Volume Name) is not present in target version 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream Craft CMS in version 4.4.0-beta.1 (commit 1381993c81, Dec 22, 2022) by adding Html::encode() to the volume name display in asset metadata. The fix was already present in the upstream release when TuxCare onboarded version 4.18.7. Both identified volume name d..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-31144 is not present in target craftcms/cms 4.18.7. The vulnerability involved XSS through unescaped forward slashes in JSON encoding when feed titles containing malicious sequences like `` were embedded in HTML script tags. The upstream vendor (Pixel & Tonic) fixed this in commit e2f7e7b7d86a0afa54ce855375d13c7760670764 by removing JSON_UNESCAPED_SLASHES from the default enco...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "not_affected \u2014 CVE-2023-31144 is not present in target craftcms/cms 4.18.7. The vulnerability involved XSS through unescaped forward slashes in JSON encoding when feed titles containing malicious sequences like `` were embedded in HTML script tags. The upstream vendor (Pixel & Tonic) fixed this in commit e2f7e7b7d86a0afa54ce855375d13c7760670764 by removing JSON_UNESCAPED_SLASHES from the default enco..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in craftcms/cms 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream vendor (Pixel & Tonic) in commit 9d0cd0bd (April 2023) and shipped in version 3.8.10. The target version 4.18.7 includes this upstream fix. The vulnerable pattern ($('
  • ' + error + '
    • ')) does not exist; instead, the safe pattern (...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in craftcms/cms 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream vendor (Pixel & Tonic) in commit 9d0cd0bd (April 2023) and shipped in version 3.8.10. The target version 4.18.7 includes this upstream fix. The vulnerable pattern ($('
  • ' + error + '
    • ')) does not exist; instead, the safe pattern (..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-11-03T08:53:00.046847+00:00", "status_notes": "Vulnerability CVE-2023-33495 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. craftcms/cms 4.18.7 already contains upstream commit 57334cd435 (released in 4.17.0, 'Escape checkbox labels by default in JS'): Craft.ui.createSelect sets option labels via $option.text() with opt-in labelHtml, so the export-modal exporter-name HTML injection (GHSA-m3v5-gjj9-rg24, affected <= 4.4.9) is not exploitable. The TuxCare 3.9.15 fix (PHPELSCVE-271, b7d336d299) is not needed and would double-escape. Jira: PHPELSCVE-992.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33495" }, "impact_statement": "craftcms/cms 4.18.7 already contains upstream commit 57334cd435 (released in 4.17.0, 'Escape checkbox labels by default in JS'): Craft.ui.createSelect sets option labels via $option.text() with opt-in labelHtml, so the export-modal exporter-name HTML injection (GHSA-m3v5-gjj9-rg24, affected <= 4.4.9) is not exploitable. The TuxCare 3.9.15 fix (PHPELSCVE-271, b7d336d299) is not needed and would double-escape. Jira: PHPELSCVE-992." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:37:57.469921+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. CVE-2023-36260 describes a DoS vulnerability triggered via the Feed Me plugin when saving a feed with Asset element type but no volume selected. The vulnerable code pattern exists in craftcms/cms at src/elements/Asset.php:2938 (calling getFolderById($folderId)->getVolume() without null check), which would cause a fatal error if folderId is null. However, analysis of all Craft CMS's own entry points (GraphQL mutations, HTTP upload controllers, validation rules) shows they properly validate and set folderId before saving Assets. The vulnerable code path is not reachable through craftcms/cms's own production code - it requires a third-party plugin like Feed Me that creates Assets without properly setting folderId. Verdict: not_affected (Rule 5 Type A2 - code_not_reachable).", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "CVE-2023-36260 describes a DoS vulnerability triggered via the Feed Me plugin when saving a feed with Asset element type but no volume selected. The vulnerable code pattern exists in craftcms/cms at src/elements/Asset.php:2938 (calling getFolderById($folderId)->getVolume() without null check), which would cause a fatal error if folderId is null. However, analysis of all Craft CMS's own entry points (GraphQL mutations, HTTP upload controllers, validation rules) shows they properly validate and set folderId before saving Assets. The vulnerable code path is not reachable through craftcms/cms's own production code - it requires a third-party plugin like Feed Me that creates Assets without properly setting folderId. Verdict: not_affected (Rule 5 Type A2 - code_not_reachable)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2023-40035 affects version 4.18.7-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-40035" }, "action_statement": "Vulnerability CVE-2023-40035 affects version 4.18.7-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2024-21622 describes privilege escalation vulnerabilities in Craft CMS fixed by two upstream commits: ca0576b3ed (UsersController username parameter restriction) and 42f929e777 (ElementsController TOCTOU authorization fix). Both fixes were authored by Pixel & Tonic developers (brad@pixelandtonic.com) in November 2023 and were already present in the upstream Craft CMS 4.18.7 release that Tux...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "not_affected \u2014 CVE-2024-21622 describes privilege escalation vulnerabilities in Craft CMS fixed by two upstream commits: ca0576b3ed (UsersController username parameter restriction) and 42f929e777 (ElementsController TOCTOU authorization fix). Both fixes were authored by Pixel & Tonic developers (brad@pixelandtonic.com) in November 2023 and were already present in the upstream Craft CMS 4.18.7 release that Tux..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 4.18.7-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 4.18.7-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS version 4.18.7, while CVE-2024-41800 specifically affects Craft CMS 5's TOTP (Time-based One-Time Password) two-factor authentication feature. The TOTP 2FA functionality does not exist in Craft CMS 4.x at all. Exhaustive searches across the entire codebase found no TOTP-related code, no Google2FA library dependency, no auth/methods directory structure, no Auth...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS version 4.18.7, while CVE-2024-41800 specifically affects Craft CMS 5's TOTP (Time-based One-Time Password) two-factor authentication feature. The TOTP 2FA functionality does not exist in Craft CMS 4.x at all. Exhaustive searches across the entire codebase found no TOTP-related code, no Google2FA library dependency, no auth/methods directory structure, no Auth..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2024-52291 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. craftcms/cms 4.18.7 is not affected by CVE-2024-52291 (GHSA-jrh5-vhr9-qh7q). The advisory affects 4.x only up to <= 4.12.4.1 (patched 4.12.5). The upstream fix 1bc4eaa40a (Fixed GHSA-jrh5-vhr9-qh7q, first tagged 4.12.5) replaced the single-prefix StringHelper::removeLeft($path, 'file://') in FileHelper::normalizePath() with a regex that strips all consecutive file:// prefixes, closing the file://file://// local filesystem validation bypass. The fixed code is present on tuxcare-current/4.18.7.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52291" }, "impact_statement": "craftcms/cms 4.18.7 is not affected by CVE-2024-52291 (GHSA-jrh5-vhr9-qh7q). The advisory affects 4.x only up to <= 4.12.4.1 (patched 4.12.5). The upstream fix 1bc4eaa40a (Fixed GHSA-jrh5-vhr9-qh7q, first tagged 4.12.5) replaced the single-prefix StringHelper::removeLeft($path, 'file://') in FileHelper::normalizePath() with a regex that strips all consecutive file:// prefixes, closing the file://file://// local filesystem validation bypass. The fixed code is present on tuxcare-current/4.18.7." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2024-52292 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. The target repository (Craft CMS 4.18.7-p1+tuxcare) is NOT AFFECTED by CVE-2024-52292. The upstream vendor (Craft CMS / Pixel & Tonic) already fixed the arbitrary file read vulnerability in commit 3ee85a48c1 (Oct 21, 2024) by adding path containment validation to the Html::dataUrl() function. This fix was already present in the upstream codebase when TuxCare onboarded version 4.18.7 (PHPELS-197). The defense restricts file access to within the project root directory, preventing the attack vector described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52292" }, "impact_statement": "The target repository (Craft CMS 4.18.7-p1+tuxcare) is NOT AFFECTED by CVE-2024-52292. The upstream vendor (Craft CMS / Pixel & Tonic) already fixed the arbitrary file read vulnerability in commit 3ee85a48c1 (Oct 21, 2024) by adding path containment validation to the Html::dataUrl() function. This fix was already present in the upstream codebase when TuxCare onboarded version 4.18.7 (PHPELS-197). The defense restricts file access to within the project root directory, preventing the attack vector described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. CVE-2024-52293 is NOT present in the target. The vulnerability required missing normalizePath() in FileHelper::absolutePath() line 136, allowing path traversal sequences like `../templates/poc` to bypass system directory security checks. The target code contains the upstream vendor's fix: `return static::normalizePath($from . $ds . $to, $ds);` which resolves traversal sequences before the path is used in security validations. This fix was introduced in upstream Craft CMS version 4.12.2 (commit 123e48a696 by brandon@pixelandtonic.com on 2024-09-11). The target version 4.18.7 naturally includes all fixes from 4.12.2. TuxCare onboarded the pre-fixed version 4.18.7; there is no separate TuxCare backport for this CVE on this version line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 is NOT present in the target. The vulnerability required missing normalizePath() in FileHelper::absolutePath() line 136, allowing path traversal sequences like `../templates/poc` to bypass system directory security checks. The target code contains the upstream vendor's fix: `return static::normalizePath($from . $ds . $to, $ds);` which resolves traversal sequences before the path is used in security validations. This fix was introduced in upstream Craft CMS version 4.12.2 (commit 123e48a696 by brandon@pixelandtonic.com on 2024-09-11). The target version 4.18.7 naturally includes all fixes from 4.12.2. TuxCare onboarded the pre-fixed version 4.18.7; there is no separate TuxCare backport for this CVE on this version line." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 4.18.7-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 4.18.7-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-23209 fix a19d46be78a9 by brandon@pixelandtonic.com (2025-07-07) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-23209 fix a19d46be78a9 by brandon@pixelandtonic.com (2025-07-07) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. CVE-2025-32432 RCE vulnerability is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this type confusion vulnerability in commit e1c85441 (2025-04-10) by adding string type validation for the 'handle' parameter in AssetsController::actionGenerateTransform(). This fix was included in upstream release 4.18.7 (2026-08-18), which TuxCare subsequently onboarded to ELS on 2026-09-07. The target code at HEAD (b16f3f8a9b) contains the complete fix: lines 1208-1210 validate that $handle is a string before use, exactly matching the vendor patch. The CVE affects versions 4.0.0-RC1 to before 4.14.15; target version 4.18.7 is after the fixed version. Attribution: upstream vendor fix (no TuxCare authorship signal).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "CVE-2025-32432 RCE vulnerability is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this type confusion vulnerability in commit e1c85441 (2025-04-10) by adding string type validation for the 'handle' parameter in AssetsController::actionGenerateTransform(). This fix was included in upstream release 4.18.7 (2026-08-18), which TuxCare subsequently onboarded to ELS on 2026-09-07. The target code at HEAD (b16f3f8a9b) contains the complete fix: lines 1208-1210 validate that $handle is a string before use, exactly matching the vendor patch. The CVE affects versions 4.0.0-RC1 to before 4.14.15; target version 4.18.7 is after the fixed version. Attribution: upstream vendor fix (no TuxCare authorship signal)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2025-35939 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2025-35939 is not present in the target. The vulnerability involves storing unsanitized return URLs containing arbitrary HTML/PHP code in session files. The upstream vendor (Craft CMS) shipped the fix in version 4.18.7, which strips HTML/PHP tags via strip_tags() and validates URL schemes before storing return URLs in the session. TuxCare onboarded this version with the fix already present....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-35939" }, "impact_statement": "not_affected \u2014 CVE-2025-35939 is not present in the target. The vulnerability involves storing unsanitized return URLs containing arbitrary HTML/PHP code in session files. The upstream vendor (Craft CMS) shipped the fix in version 4.18.7, which strips HTML/PHP tags via strip_tags() and validates URL schemes before storing return URLs in the session. TuxCare onboarded this version with the fix already present...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. Not affected: CVE-2025-46731 affects Craft CMS 4.x prior to 4.14.13 and is fixed upstream in 4.14.13; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (c3f75107a4b4d00f802a56f23aa57cde134df838).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "Not affected: CVE-2025-46731 affects Craft CMS 4.x prior to 4.14.13 and is fixed upstream in 4.14.13; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (c3f75107a4b4d00f802a56f23aa57cde134df838)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2025-57811 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. Not affected: CVE-2025-57811 affects Craft CMS 4.0.0-RC1 through 4.16.5 and is fixed upstream in 4.16.6; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (e77f8a287dcdda41f1724f525d03542f18566cbc).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-57811" }, "impact_statement": "Not affected: CVE-2025-57811 affects Craft CMS 4.0.0-RC1 through 4.16.5 and is fixed upstream in 4.16.6; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (e77f8a287dcdda41f1724f525d03542f18566cbc)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68436 fix 4bcb0db554e2 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68436 fix 4bcb0db554e2 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2025-68437 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68437 fix 013db636fdb3 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68437" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68437 fix 013db636fdb3 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2025-68454 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. Not affected: CVE-2025-68454 affects Craft CMS 4.0.0-RC1 through 4.16.16 and is fixed upstream in 4.16.17; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (d82680f4a05f9576883bb83c3f6243d33ca73ebe).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68454" }, "impact_statement": "Not affected: CVE-2025-68454 affects Craft CMS 4.0.0-RC1 through 4.16.16 and is fixed upstream in 4.16.17; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (d82680f4a05f9576883bb83c3f6243d33ca73ebe)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. Version 4.18.7 is not affected by CVE-2025-68455. The vulnerability was fixed by upstream vendor (Craft CMS/Pixel & Tonic) in version 4.16.17 via commit ec43c497ed (released 2025-12-04). Target version 4.18.7 (released 2026-08-18) is newer and includes this fix plus additional hardening. The fix adds Component::cleanseConfig() to remove dangerous config keys (\"on \" event handlers and \"as \" behaviors) before object instantiation, preventing malicious behavior attachment and RCE. TuxCare later adopted version 4.18.7 into their ELS program, inheriting the upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Version 4.18.7 is not affected by CVE-2025-68455. The vulnerability was fixed by upstream vendor (Craft CMS/Pixel & Tonic) in version 4.16.17 via commit ec43c497ed (released 2025-12-04). Target version 4.18.7 (released 2026-08-18) is newer and includes this fix plus additional hardening. The fix adds Component::cleanseConfig() to remove dangerous config keys (\"on \" event handlers and \"as \" behaviors) before object instantiation, preventing malicious behavior attachment and RCE. TuxCare later adopted version 4.18.7 into their ELS program, inheriting the upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2025-68456 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68456 fix 1718011a5faa by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68456" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68456 fix 1718011a5faa by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-11-09T23:08:00.049119+00:00", "status_notes": "Vulnerability CVE-2026-115934 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 4.18.7 builds search SQL by string interpolation (src/services/Search.php), but every user-controlled fragment is sanitized first. Search terms go through SearchHelper::normalizeKeywords, which strips quotes, backslashes, semicolons and other punctuation. Attribute names are limited to \\w+. Field IDs are integers. I found no unauthenticated element search endpoint in the target. No ve...", "vulnerability": { "name": "CVE-2026-115934" }, "impact_statement": "not_affected \u2014 Craft CMS 4.18.7 builds search SQL by string interpolation (src/services/Search.php), but every user-controlled fragment is sanitized first. Search terms go through SearchHelper::normalizeKeywords, which strips quotes, backslashes, semicolons and other punctuation. Attribute names are limited to \\w+. Field IDs are integers. I found no unauthenticated element search endpoint in the target. No ve..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-115935 is fixed in version 4.18.7-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115935" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-115938 is fixed in version 4.18.7-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115938" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.7 is NOT AFFECTED by CVE-2026-25491. The vulnerability (stored XSS via unescaped entry type names) affects Craft CMS 5.0.0-RC1 through 5.8.21, where the architecture changed from Vue.js client-side rendering to PHP server-side rendering. In version 4.18.7, entry type names are rendered through Vue.js's default {{ }} interpolation (App.vue:115,120), which automatically applies HTML ...", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 4.18.7 is NOT AFFECTED by CVE-2026-25491. The vulnerability (stored XSS via unescaped entry type names) affects Craft CMS 5.0.0-RC1 through 5.8.21, where the architecture changed from Vue.js client-side rendering to PHP server-side rendering. In version 4.18.7, entry type names are rendered through Vue.js's default {{ }} interpolation (App.vue:115,120), which automatically applies HTML ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-25493. The upstream vendor fixed this SSRF redirect bypass vulnerability in commit 26268c0210 (June 2026), which was included in the 4.18.7 release (August 2026). The target code disables HTTP redirects at line 318 (`RequestOptions::ALLOW_REDIRECTS => false`) in the downloadUrl method, preventing attackers from bypassing validation ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-25493. The upstream vendor fixed this SSRF redirect bypass vulnerability in commit 26268c0210 (June 2026), which was included in the 4.18.7 release (August 2026). The target code disables HTTP redirects at line 318 (`RequestOptions::ALLOW_REDIRECTS => false`) in the downloadUrl method, preventing attackers from bypassing validation ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-25494 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-25494 describes a hex IP notation bypass of filter_var() validation in the saveAsset GraphQL mutation. The target (4.18.7) is NOT AFFECTED because the vulnerable code pattern has been completely replaced by an upstream vendor refactoring. On June 15, 2026, upstream author brandon@pixelandtonic.com (commit 26268c0210) replaced the inline filter_var() validation with the craftcms/url-val...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "not_affected \u2014 CVE-2026-25494 describes a hex IP notation bypass of filter_var() validation in the saveAsset GraphQL mutation. The target (4.18.7) is NOT AFFECTED because the vulnerable code pattern has been completely replaced by an upstream vendor refactoring. On June 15, 2026, upstream author brandon@pixelandtonic.com (commit 26268c0210) replaced the inline filter_var() validation with the craftcms/url-val..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. Craft CMS 4.18.7 is not affected by CVE-2026-25495. The upstream vendor (Pixel & Tonic) fixed this SQL injection vulnerability in version 4.16.18 (released 2026-01-09) by removing dangerous SQL query construction parameters from user-provided criteria before database query configuration. The fix was refactored into ElementHelper::cleanseQueryCriteria() in version 4.17.4 (released 2026-02-11). The target version 4.18.7 (released 2026-08-18) inherits this upstream fix. The vulnerable pattern is not present in the target because an upstream-authored fix is already applied in the shipped version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "Craft CMS 4.18.7 is not affected by CVE-2026-25495. The upstream vendor (Pixel & Tonic) fixed this SQL injection vulnerability in version 4.16.18 (released 2026-01-09) by removing dangerous SQL query construction parameters from user-provided criteria before database query configuration. The fix was refactored into ElementHelper::cleanseQueryCriteria() in version 4.17.4 (released 2026-02-11). The target version 4.18.7 (released 2026-08-18) inherits this upstream fix. The vulnerable pattern is not present in the target because an upstream-authored fix is already applied in the shipped version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is not affected by CVE-2026-25496. The upstream vendor (Craft CMS / Pixel & Tonic) fixed the stored XSS vulnerability in commit 93837b626f on 2026-01-05 by adding HTML encoding to the Number field's Prefix and Suffix rendering. This fix was included in the upstream 4.18.7 release (finalized 2026-08-18), which TuxCare inherited when onboarding this version. The vulnerable p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is not affected by CVE-2026-25496. The upstream vendor (Craft CMS / Pixel & Tonic) fixed the stored XSS vulnerability in commit 93837b626f on 2026-01-05 by adding HTML encoding to the Number field's Prefix and Suffix rendering. This fix was included in the upstream 4.18.7 release (finalized 2026-08-18), which TuxCare inherited when onboarding this version. The vulnerable p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. Target version 4.18.7 is not vulnerable to CVE-2026-25498. The upstream vendor (Pixel & Tonic) fixed the RCE vulnerability in commit 395c64f0b8 on 2026-01-09 by adding ComponentHelper::cleanseConfig() sanitization before passing user-supplied field layout configuration to object creation. This fix was included in the upstream 4.18.7 release (2026-08-18) which TuxCare subsequently onboarded for Extended Lifecycle Support. The vulnerable pattern (unsanitized config data passed directly to createLayout) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "Target version 4.18.7 is not vulnerable to CVE-2026-25498. The upstream vendor (Pixel & Tonic) fixed the RCE vulnerability in commit 395c64f0b8 on 2026-01-09 by adding ComponentHelper::cleanseConfig() sanitization before passing user-supplied field layout configuration to object creation. This fix was included in the upstream 4.18.7 release (2026-08-18) which TuxCare subsequently onboarded for Extended Lifecycle Support. The vulnerable pattern (unsanitized config data passed directly to createLayout) is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (CVE-2026-27126) affecting versions 4.5.0-RC1 through 4.16.18 was patched in upstream version 4.16.19. The target version 4.18.7 inherited the complete fix from upstream commit f5d488d9bb (authored by brandon@pixelandtonic.com on 2026-01-14). The fix validates table column types against a whitelist and converts unsupported types (includin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (CVE-2026-27126) affecting versions 4.5.0-RC1 through 4.16.18 was patched in upstream version 4.16.19. The target version 4.18.7 inherited the complete fix from upstream commit f5d488d9bb (authored by brandon@pixelandtonic.com on 2026-01-14). The fix validates table column types against a whitelist and converts unsupported types (includin..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-27127 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-27127 (DNS rebinding TOCTOU SSRF). The upstream vendor (Pixel & Tonic) deployed a comprehensive fix in commit 26268c0210 (June 15, 2026) that implements DNS pinning via CURLOPT_RESOLVE and pre-validates IPs through the craftcms/url-validator package. This fix was naturally included in version 4.18.7 (released August 18, 2026). The vulnerable pattern (separate DNS lookups without pinning) has been completely removed from the codebase. This is a vendor-authored fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27127" }, "impact_statement": "The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-27127 (DNS rebinding TOCTOU SSRF). The upstream vendor (Pixel & Tonic) deployed a comprehensive fix in commit 26268c0210 (June 15, 2026) that implements DNS pinning via CURLOPT_RESOLVE and pre-validates IPs through the craftcms/url-validator package. This fix was naturally included in version 4.18.7 (released August 18, 2026). The vulnerable pattern (separate DNS lookups without pinning) has been completely removed from the codebase. This is a vendor-authored fix, not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 The target repository at version 4.18.7 is NOT vulnerable to CVE-2026-27128. The TOCTOU race condition fix was applied by the upstream vendor (Pixel & Tonic) in commit 3e4afe1827 as part of version 4.16.19 (released 2026-01-15). Version 4.18.7, being newer than 4.16.19, naturally includes this fix. The getTokenRoute() method in src/services/Tokens.php correctly uses mutex locking to ensure atom...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target repository at version 4.18.7 is NOT vulnerable to CVE-2026-27128. The TOCTOU race condition fix was applied by the upstream vendor (Pixel & Tonic) in commit 3e4afe1827 as part of version 4.16.19 (released 2026-01-15). Version 4.18.7, being newer than 4.16.19, naturally includes this fix. The getTokenRoute() method in src/services/Tokens.php correctly uses mutex locking to ensure atom..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-27129 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) is NOT AFFECTED by CVE-2026-27129. The vulnerable pattern (using gethostbyname() which only resolves IPv4) is absent because the upstream vendor refactored the code to use the craftcms/url-validator library (commit 26268c0210, Jun 2026). This library uses dns_get_record() with both DNS_A and DNS_AAAA records, and includes comprehensive IPv6 validation via FILTER_FL...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27129" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.7) is NOT AFFECTED by CVE-2026-27129. The vulnerable pattern (using gethostbyname() which only resolves IPv4) is absent because the upstream vendor refactored the code to use the craftcms/url-validator library (commit 26268c0210, Jun 2026). This library uses dns_get_record() with both DNS_A and DNS_AAAA records, and includes comprehensive IPv6 validation via FILTER_FL..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. The target craftcms/cms 4.18.7 contains the upstream vendor fix for CVE-2026-31857. The vulnerable unsandboxed Twig rendering call has been replaced with the sandboxed version in BaseElementSelectConditionRule.php line 88. Fix commit 8d4903647d was authored by brandon@pixelandtonic.com (Craft CMS upstream vendor) as part of the 4.17.4 release, and is included in the 4.18.7 version onboarded by TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "The target craftcms/cms 4.18.7 contains the upstream vendor fix for CVE-2026-31857. The vulnerable unsandboxed Twig rendering call has been replaced with the sandboxed version in BaseElementSelectConditionRule.php line 88. Fix commit 8d4903647d was authored by brandon@pixelandtonic.com (Craft CMS upstream vendor) as part of the 4.17.4 release, and is included in the 4.18.7 version onboarded by TuxCare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. CVE-2026-31858 does not affect Craft CMS version 4.18.7. The vulnerable component ElementSearchController was introduced in Craft CMS 5.x and does not exist in version 4.x. The target repository is running version 4.18.7, which predates the introduction of this controller. The only controller in version 4.18.7 that processes user query criteria (ElementIndexesController) already contains the proper defense mechanism (ElementHelper::cleanseQueryCriteria()) that was added for CVE-2026-25495. No alternative code path exists in version 4.18.7 that exhibits the same SQL injection vulnerability pattern.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "CVE-2026-31858 does not affect Craft CMS version 4.18.7. The vulnerable component ElementSearchController was introduced in Craft CMS 5.x and does not exist in version 4.x. The target repository is running version 4.18.7, which predates the introduction of this controller. The only controller in version 4.18.7 that processes user query criteria (ElementIndexesController) already contains the proper defense mechanism (ElementHelper::cleanseQueryCriteria()) that was added for CVE-2026-25495. No alternative code path exists in version 4.18.7 that exhibits the same SQL injection vulnerability pattern." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-31859 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (XSS via javascript: URLs bypassing strip_tags()) was fixed by upstream vendor commit cc9921c14897ee2b592a431c2356af8a04ce4cfe, which added URL scheme validation before strip_tags() in src/web/User.php::setReturnUrl(). This fix was already present in upstream version 4.18.7 (released 2026-08-18) when TuxCare onboarded it (commit 4a22c9d3d...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31859" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (XSS via javascript: URLs bypassing strip_tags()) was fixed by upstream vendor commit cc9921c14897ee2b592a431c2356af8a04ce4cfe, which added URL scheme validation before strip_tags() in src/web/User.php::setReturnUrl(). This fix was already present in upstream version 4.18.7 (released 2026-08-18) when TuxCare onboarded it (commit 4a22c9d3d..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 The target (craftcms/cms 4.18.7) is not affected by CVE-2026-32262. The vulnerability (path traversal via unsanitized targetFilename parameter in AssetsController->replaceFile() allowing arbitrary file deletion) was fixed by upstream vendor Pixel & Tonic in version 4.17.5 (commit c997efbe4c, Feb 16 2026). The target version 4.18.7 inherits this fix from upstream. The validation code rejecting f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The target (craftcms/cms 4.18.7) is not affected by CVE-2026-32262. The vulnerability (path traversal via unsanitized targetFilename parameter in AssetsController->replaceFile() allowing arbitrary file deletion) was fixed by upstream vendor Pixel & Tonic in version 4.17.5 (commit c997efbe4c, Feb 16 2026). The target version 4.18.7 inherits this fix from upstream. The validation code rejecting f..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. CVE-2026-32263 affects Craft CMS versions 5.6.0 to before 5.9.11, specifically in src/controllers/EntryTypesController.php. The target version 4.18.7 is not affected because: (1) EntryTypesController.php does not exist in version 4.x; (2) Entry type management in 4.x is handled by SectionsController.php which does not use parse_str; (3) All 4 instances of parse_str in version 4.18.7 controllers (FieldsController.php and ElementIndexesController.php) are protected with Component::cleanseConfig() before passing data to Craft::configure(). The vulnerable code pattern described in the CVE does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "CVE-2026-32263 affects Craft CMS versions 5.6.0 to before 5.9.11, specifically in src/controllers/EntryTypesController.php. The target version 4.18.7 is not affected because: (1) EntryTypesController.php does not exist in version 4.x; (2) Entry type management in 4.x is handled by SectionsController.php which does not use parse_str; (3) All 4 instances of parse_str in version 4.18.7 controllers (FieldsController.php and ElementIndexesController.php) are protected with Component::cleanseConfig() before passing data to Craft::configure(). The vulnerable code pattern described in the CVE does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32264 fix dfec46362fcb by brandon@pixelandtonic.com (2026-02-16) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32264 fix dfec46362fcb by brandon@pixelandtonic.com (2026-02-16) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32267 fix 6301e217c5f1 by brandon@pixelandtonic.com (2026-02-18) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32267 fix 6301e217c5f1 by brandon@pixelandtonic.com (2026-02-18) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 4.18.7 is not affected by CVE-2026-33051. The CVE describes an XSS vulnerability specific to versions 5.9.0-beta.1 through 5.9.10 where the creator's fullName is rendered as raw HTML due to Template::raw() combined with Craft::t() in the revision/draft context menu. While the target version 4.18.7 does display creator names in the revision menu (src/templates/_includes/revisionmenu.tw...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 4.18.7 is not affected by CVE-2026-33051. The CVE describes an XSS vulnerability specific to versions 5.9.0-beta.1 through 5.9.10 where the creator's fullName is rendered as raw HTML due to Template::raw() combined with Craft::t() in the revision/draft context menu. While the target version 4.18.7 does display creator names in the revision menu (src/templates/_includes/revisionmenu.tw..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. Version 4.18.7 is NOT affected by CVE-2026-33157. The vulnerability exists in Craft CMS 5.6.0-5.9.12 where a NEW code path (fieldLayouts parameter in ElementIndexesController::actionFilterHud) bypasses existing sanitization. This specific code path does NOT exist in version 4.x. Version 4.18.7 only processes conditionConfig in actionFilterHud(), which is properly sanitized via Component::cleanseConfig() at line 421. The setFieldLayouts() method and fieldLayouts parameter handling were introduced in version 5.x and are completely absent from version 4.18.7's codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "Version 4.18.7 is NOT affected by CVE-2026-33157. The vulnerability exists in Craft CMS 5.6.0-5.9.12 where a NEW code path (fieldLayouts parameter in ElementIndexesController::actionFilterHud) bypasses existing sanitization. This specific code path does NOT exist in version 4.x. Version 4.18.7 only processes conditionConfig in actionFilterHud(), which is properly sanitized via Component::cleanseConfig() at line 421. The setFieldLayouts() method and fieldLayouts parameter handling were introduced in version 5.x and are completely absent from version 4.18.7's codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-33158 is NOT present in Craft CMS 4.18.7. The vulnerability described an authorization bypass in the assets/edit-image endpoint allowing low-privileged users to read private asset content. The upstream vendor (Pixel & Tonic) fixed this in version 4.17.8 (commit e674bbbd30, Feb 25 2026) by adding requireVolumePermissionByAsset() and requirePeerVolumePermissionByAsset() checks. Version 4...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 CVE-2026-33158 is NOT present in Craft CMS 4.18.7. The vulnerability described an authorization bypass in the assets/edit-image endpoint allowing low-privileged users to read private asset content. The upstream vendor (Pixel & Tonic) fixed this in version 4.17.8 (commit e674bbbd30, Feb 25 2026) by adding requireVolumePermissionByAsset() and requirePeerVolumePermissionByAsset() checks. Version 4..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) contains the complete fix for CVE-2026-33159. The upstream vendor (Pixel & Tonic) fixed the vulnerability in commit 7f0ead833f (2026-02-25), included it in their 4.18.7 release (2026-08-18), and TuxCare onboarded that pre-fixed version (2026-09-07). The vulnerable pattern\u2014missing authentication/authorization on ConfigSyncController\u2014is not present at HEAD. Verdict: ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.7) contains the complete fix for CVE-2026-33159. The upstream vendor (Pixel & Tonic) fixed the vulnerability in commit 7f0ead833f (2026-02-25), included it in their 4.18.7 release (2026-08-18), and TuxCare onboarded that pre-fixed version (2026-09-07). The vulnerable pattern\u2014missing authentication/authorization on ConfigSyncController\u2014is not present at HEAD. Verdict: ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-33160 fix 83fd398c12a3 by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-33160 fix 83fd398c12a3 by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-33161 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 4.18.7) contains the upstream vendor's fix for the asset information disclosure vulnerability. The CVE describes an authorization bypass where the assets/image-editor endpoint (actionImageEditor method) returns focalPoint and other editor metadata without validating user permissions. The fix (commit 1f91f9b7aa, GHSA-vgjg-248p-rfm2) added requireVolumePermissionB...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 4.18.7) contains the upstream vendor's fix for the asset information disclosure vulnerability. The CVE describes an authorization bypass where the assets/image-editor endpoint (actionImageEditor method) returns focalPoint and other editor metadata without validating user permissions. The fix (commit 1f91f9b7aa, GHSA-vgjg-248p-rfm2) added requireVolumePermissionB..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS v4.18.7 is not affected by CVE-2026-33162. The vulnerability affects the `/actions/entries/move-to-section` endpoint and Entry::canMove() authorization method, which were introduced in Craft CMS v5.x. Version 4.18.7 does not have the move-entries-between-sections feature at all. The GraphQL resolver explicitly prevents section changes with the error \"Impossible to change the section o...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 Craft CMS v4.18.7 is not affected by CVE-2026-33162. The vulnerability affects the `/actions/entries/move-to-section` endpoint and Entry::canMove() authorization method, which were introduced in Craft CMS v5.x. Version 4.18.7 does not have the move-entries-between-sections feature at all. The GraphQL resolver explicitly prevents section changes with the error \"Impossible to change the section o..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset upload) is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit d20aecfaa0 (March 4, 2026) by adding scheme validation that blocks non-HTTP/HTTPS protocols (gopher, file, ftp, etc.). This fix was later refactored into the craftcms/url-validator library (commit 26268c0210, Jun...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "not_affected \u2014 CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset upload) is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit d20aecfaa0 (March 4, 2026) by adding scheme validation that blocks non-HTTP/HTTPS protocols (gopher, file, ftp, etc.). This fix was later refactored into the craftcms/url-validator library (commit 26268c0210, Jun..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) is not affected by CVE-2026-41130. The SSRF vulnerability in the resource-js endpoint was fixed by upstream vendor (Pixel & Tonic) in commit ebe7e85f1c, which is present in the target. The vulnerable code that made HTTP requests via Guzzle client has been replaced with local filesystem serving using App::resourcePathByUri() with path traversal protection. Additiona...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.7) is not affected by CVE-2026-41130. The SSRF vulnerability in the resource-js endpoint was fixed by upstream vendor (Pixel & Tonic) in commit ebe7e85f1c, which is present in the target. The vulnerable code that made HTTP requests via Guzzle client has been replaced with local filesystem serving using App::resourcePathByUri() with path traversal protection. Additiona..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-55790 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. CVE-2026-55790 (GHSA-24x4-j6x9-rfw5): The XSS vulnerability in the CraftSupport widget is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit 6bbb66038a (May 2026) by adding HTML escaping via Craft.escapeHtml() and using jQuery's text: option for error messages. This fix was included in upstream's 4.18.7 release (August 2026), which TuxCare subsequently adopted for ELS support (September 2026). TuxCare did not backport this specific fix; they inherited an already-fixed upstream release. Both defense mechanisms from the patch are present and correctly implemented at lines 382 and 555-557 of CraftSupportWidget.js.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55790" }, "impact_statement": "CVE-2026-55790 (GHSA-24x4-j6x9-rfw5): The XSS vulnerability in the CraftSupport widget is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit 6bbb66038a (May 2026) by adding HTML escaping via Craft.escapeHtml() and using jQuery's text: option for error messages. This fix was included in upstream's 4.18.7 release (August 2026), which TuxCare subsequently adopted for ELS support (September 2026). TuxCare did not backport this specific fix; they inherited an already-fixed upstream release. Both defense mechanisms from the patch are present and correctly implemented at lines 382 and 555-557 of CraftSupportWidget.js." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-55793 is fixed in version 4.18.7-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55793" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is not affected. The CVE describes a vulnerability in version 5.0.0-RC1+, but analysis of 4.18.7 code shows user group names are protected by Twig's default HTML auto-escaping and Vue's text interpolation escaping. All rendering paths include runtime defenses that transform script content before display, preventing execution in administrators' browsers.", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is not affected. The CVE describes a vulnerability in version 5.0.0-RC1+, but analysis of 4.18.7 code shows user group names are protected by Twig's default HTML auto-escaping and Vue's text interpolation escaping. All rendering paths include runtime defenses that transform script content before display, preventing execution in administrators' browsers." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-56382 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. Target version 4.18.7 is not affected by CVE-2026-56382. The vulnerable method `actionRenderCardPreview()` from the v5.x patch does not exist in v4.18.7's codebase. The CVE affects Craft CMS versions >= 5.5.0 and <= 5.9.13, while this target is v4.18.7. Although TuxCare backported this CVE to v3.9.15 (fixing a different vulnerable method `actionRenderLayoutElementSelector()`), v4.18.7 contains neither the v5.x vulnerable method nor the v3.x vulnerable method. The methods that do exist in v4.18.7 and handle layout configurations (`actionApplyLayoutTabSettings()`, `actionApplyLayoutElementSettings()`) properly sanitize all config parameters via `Component::cleanseConfig()` before passing them to layout creation functions.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56382" }, "impact_statement": "Target version 4.18.7 is not affected by CVE-2026-56382. The vulnerable method `actionRenderCardPreview()` from the v5.x patch does not exist in v4.18.7's codebase. The CVE affects Craft CMS versions >= 5.5.0 and <= 5.9.13, while this target is v4.18.7. Although TuxCare backported this CVE to v3.9.15 (fixing a different vulnerable method `actionRenderLayoutElementSelector()`), v4.18.7 contains neither the v5.x vulnerable method nor the v3.x vulnerable method. The methods that do exist in v4.18.7 and handle layout configurations (`actionApplyLayoutTabSettings()`, `actionApplyLayoutElementSettings()`) properly sanitize all config parameters via `Component::cleanseConfig()` before passing them to layout creation functions." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-56383 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The upstream vendor fix (commit 7b372de262b8) is present in HEAD, applying HTML encoding to heading-type cell values before rendering. The fix was authored by brandon@pixelandtonic.com (Craft CMS upstream) and shipped in version 4.16.19. TuxCare onboarded version 4.18.7 (released 2026-08-18) which already contained this fix. No TuxCare attribution signals ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56383" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The upstream vendor fix (commit 7b372de262b8) is present in HEAD, applying HTML encoding to heading-type cell values before rendering. The fix was authored by brandon@pixelandtonic.com (Craft CMS upstream) and shipped in version 4.16.19. TuxCare onboarded version 4.18.7 (released 2026-08-18) which already contained this fix. No TuxCare attribution signals ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-56384 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-56384 fix ed56049c9d3f by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56384" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-56384 fix ed56049c9d3f by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-56385 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 contains the upstream vendor's authorization fix for CVE-2026-56385. The vulnerability (authorization bypass in assets/preview-file endpoint) was fixed by Pixel & Tonic in commit d30df31122 (Feb 2026) which added requireVolumePermissionByAsset and requirePeerVolumePermissionByAsset checks to actionPreviewFile(). This fix was included in upstream Craft CMS 4.17.8 and 4.18.7...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56385" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 contains the upstream vendor's authorization fix for CVE-2026-56385. The vulnerability (authorization bypass in assets/preview-file endpoint) was fixed by Pixel & Tonic in commit d30df31122 (Feb 2026) which added requireVolumePermissionByAsset and requirePeerVolumePermissionByAsset checks to actionPreviewFile(). This fix was included in upstream Craft CMS 4.17.8 and 4.18.7..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-11-08T14:16:00.068422+00:00", "status_notes": "Vulnerability CVE-2026-56393 affects version 4.18.7-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56393" }, "action_statement": "Vulnerability CVE-2026-56393 affects version 4.18.7-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:55:57.619283+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 4.18.7-p4+tuxcare of craftcms/cms. Target Craft CMS 4.18.7 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint has been fixed by upstream vendor commit 30f5f1a8d6 (authored by brandon@pixelandtonic.com), which added regex validation to reject extension parameters containing traversal sequences. The fix validates extensions with /^\\w+$/ before filesystem operations, preventing the attack chain described in the CVE. TuxCare adopted this fix when onboarding version 4.18.7 to ELS support.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "Target Craft CMS 4.18.7 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint has been fixed by upstream vendor commit 30f5f1a8d6 (authored by brandon@pixelandtonic.com), which added regex validation to reject extension parameters containing traversal sequences. The fix validates extensions with /^\\w+$/ before filesystem operations, preventing the attack chain described in the CVE. TuxCare adopted this fix when onboarding version 4.18.7 to ELS support." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p4+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 4.18.7-p4+tuxcare of craftcms/cms. not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was fixed in upstream Craft CMS 3.7.29 (commit 7ca2b2d2c by brandon@pixelandtonic.com, Jan 2022) and was already present in the 4.18.7 release that TuxCare onboarded. The fix adds a filter validating feed item permalinks match /^https?:\\/\\// before creating anchor elements, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was fixed in upstream Craft CMS 3.7.29 (commit 7ca2b2d2c by brandon@pixelandtonic.com, Jan 2022) and was already present in the 4.18.7 release that TuxCare onboarded. The fix adds a filter validating feed item permalinks match /^https?:\\/\\// before creating anchor elements, pre..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is not affected by CVE-2021-27902. The vulnerability allowed XSS via uploaded .htm/.html files in versions before 3.6.0. The fix (commit 8ee85a8f03) removed 'htm' and 'html' from the default allowedFileExtensions list. This fix was already present in the upstream Craft CMS 4.18.7 release that TuxCare onboarded, authored by Brandon Kelly (brandon@pixelandto...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is not affected by CVE-2021-27902. The vulnerability allowed XSS via uploaded .htm/.html files in versions before 3.6.0. The fix (commit 8ee85a8f03) removed 'htm' and 'html' from the default allowedFileExtensions list. This fix was already present in the upstream Craft CMS 4.18.7 release that TuxCare onboarded, authored by Brandon Kelly (brandon@pixelandto..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 4.18.7-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 4.18.7-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-32470 (XSS in tab name prompt) is NOT present in the target. The upstream vendor fixed this vulnerability in commit f9378aa154 (April 2021) by wrapping the prompt() result with Craft.escapeHtml() in FieldLayoutDesigner.js:150. This fix was already included in the upstream release before TuxCare onboarded version 4.18.7. The vulnerable code pattern (unescaped user input from prompt dire...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 CVE-2021-32470 (XSS in tab name prompt) is NOT present in the target. The upstream vendor fixed this vulnerability in commit f9378aa154 (April 2021) by wrapping the prompt() result with Craft.escapeHtml() in FieldLayoutDesigner.js:150. This fix was already included in the upstream release before TuxCare onboarded version 4.18.7. The vulnerable code pattern (unescaped user input from prompt dire..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 4.18.7-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 4.18.7-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 (XSS in Craft CMS before 3.7.29) is not present in target version 4.18.7. The vulnerability allowed JavaScript execution via malicious feed item permalinks (e.g., javascript: URIs) in the FeedWidget. The fix (commit 7ca2b2d2cc) adds permalink URL scheme validation to reject non-HTTP(S) URIs. This fix was shipped in upstream release 3.7.29 (Jan 2022) and is present in the target c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 (XSS in Craft CMS before 3.7.29) is not present in target version 4.18.7. The vulnerability allowed JavaScript execution via malicious feed item permalinks (e.g., javascript: URIs) in the FeedWidget. The fix (commit 7ca2b2d2cc) adds permalink URL scheme validation to reject non-HTTP(S) URIs. This fix was shipped in upstream release 3.7.29 (Jan 2022) and is present in the target c..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 4.18.7-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 4.18.7-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS 4.2.0.1 due to missing HTML encoding on user-controllable content (revision notes, tab names, group names, address titles). The vulnerability was fixed by upstream Craft CMS developers (Pixel & Tonic) in version 4.2.1 (released 2022-08-09) via commits that added Html::encode() to all affected output locations. Target version 4.18.7 inherits the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS 4.2.0.1 due to missing HTML encoding on user-controllable content (revision notes, tab names, group names, address titles). The vulnerability was fixed by upstream Craft CMS developers (Pixel & Tonic) in version 4.2.1 (released 2022-08-09) via commits that added Html::encode() to all affected output locations. Target version 4.18.7 inherits the..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 4.18.7-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 4.18.7-p3+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 4.18.7-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 4.18.7-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-30177 (XSS in Volume Name) is not present in target version 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream Craft CMS in version 4.4.0-beta.1 (commit 1381993c81, Dec 22, 2022) by adding Html::encode() to the volume name display in asset metadata. The fix was already present in the upstream release when TuxCare onboarded version 4.18.7. Both identified volume name d...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 CVE-2023-30177 (XSS in Volume Name) is not present in target version 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream Craft CMS in version 4.4.0-beta.1 (commit 1381993c81, Dec 22, 2022) by adding Html::encode() to the volume name display in asset metadata. The fix was already present in the upstream release when TuxCare onboarded version 4.18.7. Both identified volume name d..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-31144 is not present in target craftcms/cms 4.18.7. The vulnerability involved XSS through unescaped forward slashes in JSON encoding when feed titles containing malicious sequences like `` were embedded in HTML script tags. The upstream vendor (Pixel & Tonic) fixed this in commit e2f7e7b7d86a0afa54ce855375d13c7760670764 by removing JSON_UNESCAPED_SLASHES from the default enco...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "not_affected \u2014 CVE-2023-31144 is not present in target craftcms/cms 4.18.7. The vulnerability involved XSS through unescaped forward slashes in JSON encoding when feed titles containing malicious sequences like `` were embedded in HTML script tags. The upstream vendor (Pixel & Tonic) fixed this in commit e2f7e7b7d86a0afa54ce855375d13c7760670764 by removing JSON_UNESCAPED_SLASHES from the default enco..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in craftcms/cms 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream vendor (Pixel & Tonic) in commit 9d0cd0bd (April 2023) and shipped in version 3.8.10. The target version 4.18.7 includes this upstream fix. The vulnerable pattern ($('
  • ' + error + '
    • ')) does not exist; instead, the safe pattern (...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in craftcms/cms 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream vendor (Pixel & Tonic) in commit 9d0cd0bd (April 2023) and shipped in version 3.8.10. The target version 4.18.7 includes this upstream fix. The vulnerable pattern ($('
  • ' + error + '
    • ')) does not exist; instead, the safe pattern (..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-11-03T08:53:00.046847+00:00", "status_notes": "Vulnerability CVE-2023-33495 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. craftcms/cms 4.18.7 already contains upstream commit 57334cd435 (released in 4.17.0, 'Escape checkbox labels by default in JS'): Craft.ui.createSelect sets option labels via $option.text() with opt-in labelHtml, so the export-modal exporter-name HTML injection (GHSA-m3v5-gjj9-rg24, affected <= 4.4.9) is not exploitable. The TuxCare 3.9.15 fix (PHPELSCVE-271, b7d336d299) is not needed and would double-escape. Jira: PHPELSCVE-992.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33495" }, "impact_statement": "craftcms/cms 4.18.7 already contains upstream commit 57334cd435 (released in 4.17.0, 'Escape checkbox labels by default in JS'): Craft.ui.createSelect sets option labels via $option.text() with opt-in labelHtml, so the export-modal exporter-name HTML injection (GHSA-m3v5-gjj9-rg24, affected <= 4.4.9) is not exploitable. The TuxCare 3.9.15 fix (PHPELSCVE-271, b7d336d299) is not needed and would double-escape. Jira: PHPELSCVE-992." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:37:57.469921+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. CVE-2023-36260 describes a DoS vulnerability triggered via the Feed Me plugin when saving a feed with Asset element type but no volume selected. The vulnerable code pattern exists in craftcms/cms at src/elements/Asset.php:2938 (calling getFolderById($folderId)->getVolume() without null check), which would cause a fatal error if folderId is null. However, analysis of all Craft CMS's own entry points (GraphQL mutations, HTTP upload controllers, validation rules) shows they properly validate and set folderId before saving Assets. The vulnerable code path is not reachable through craftcms/cms's own production code - it requires a third-party plugin like Feed Me that creates Assets without properly setting folderId. Verdict: not_affected (Rule 5 Type A2 - code_not_reachable).", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "CVE-2023-36260 describes a DoS vulnerability triggered via the Feed Me plugin when saving a feed with Asset element type but no volume selected. The vulnerable code pattern exists in craftcms/cms at src/elements/Asset.php:2938 (calling getFolderById($folderId)->getVolume() without null check), which would cause a fatal error if folderId is null. However, analysis of all Craft CMS's own entry points (GraphQL mutations, HTTP upload controllers, validation rules) shows they properly validate and set folderId before saving Assets. The vulnerable code path is not reachable through craftcms/cms's own production code - it requires a third-party plugin like Feed Me that creates Assets without properly setting folderId. Verdict: not_affected (Rule 5 Type A2 - code_not_reachable)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2023-40035 affects version 4.18.7-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-40035" }, "action_statement": "Vulnerability CVE-2023-40035 affects version 4.18.7-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2024-21622 describes privilege escalation vulnerabilities in Craft CMS fixed by two upstream commits: ca0576b3ed (UsersController username parameter restriction) and 42f929e777 (ElementsController TOCTOU authorization fix). Both fixes were authored by Pixel & Tonic developers (brad@pixelandtonic.com) in November 2023 and were already present in the upstream Craft CMS 4.18.7 release that Tux...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "not_affected \u2014 CVE-2024-21622 describes privilege escalation vulnerabilities in Craft CMS fixed by two upstream commits: ca0576b3ed (UsersController username parameter restriction) and 42f929e777 (ElementsController TOCTOU authorization fix). Both fixes were authored by Pixel & Tonic developers (brad@pixelandtonic.com) in November 2023 and were already present in the upstream Craft CMS 4.18.7 release that Tux..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 4.18.7-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 4.18.7-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS version 4.18.7, while CVE-2024-41800 specifically affects Craft CMS 5's TOTP (Time-based One-Time Password) two-factor authentication feature. The TOTP 2FA functionality does not exist in Craft CMS 4.x at all. Exhaustive searches across the entire codebase found no TOTP-related code, no Google2FA library dependency, no auth/methods directory structure, no Auth...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS version 4.18.7, while CVE-2024-41800 specifically affects Craft CMS 5's TOTP (Time-based One-Time Password) two-factor authentication feature. The TOTP 2FA functionality does not exist in Craft CMS 4.x at all. Exhaustive searches across the entire codebase found no TOTP-related code, no Google2FA library dependency, no auth/methods directory structure, no Auth..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2024-52291 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. craftcms/cms 4.18.7 is not affected by CVE-2024-52291 (GHSA-jrh5-vhr9-qh7q). The advisory affects 4.x only up to <= 4.12.4.1 (patched 4.12.5). The upstream fix 1bc4eaa40a (Fixed GHSA-jrh5-vhr9-qh7q, first tagged 4.12.5) replaced the single-prefix StringHelper::removeLeft($path, 'file://') in FileHelper::normalizePath() with a regex that strips all consecutive file:// prefixes, closing the file://file://// local filesystem validation bypass. The fixed code is present on tuxcare-current/4.18.7.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52291" }, "impact_statement": "craftcms/cms 4.18.7 is not affected by CVE-2024-52291 (GHSA-jrh5-vhr9-qh7q). The advisory affects 4.x only up to <= 4.12.4.1 (patched 4.12.5). The upstream fix 1bc4eaa40a (Fixed GHSA-jrh5-vhr9-qh7q, first tagged 4.12.5) replaced the single-prefix StringHelper::removeLeft($path, 'file://') in FileHelper::normalizePath() with a regex that strips all consecutive file:// prefixes, closing the file://file://// local filesystem validation bypass. The fixed code is present on tuxcare-current/4.18.7." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2024-52292 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. The target repository (Craft CMS 4.18.7-p1+tuxcare) is NOT AFFECTED by CVE-2024-52292. The upstream vendor (Craft CMS / Pixel & Tonic) already fixed the arbitrary file read vulnerability in commit 3ee85a48c1 (Oct 21, 2024) by adding path containment validation to the Html::dataUrl() function. This fix was already present in the upstream codebase when TuxCare onboarded version 4.18.7 (PHPELS-197). The defense restricts file access to within the project root directory, preventing the attack vector described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52292" }, "impact_statement": "The target repository (Craft CMS 4.18.7-p1+tuxcare) is NOT AFFECTED by CVE-2024-52292. The upstream vendor (Craft CMS / Pixel & Tonic) already fixed the arbitrary file read vulnerability in commit 3ee85a48c1 (Oct 21, 2024) by adding path containment validation to the Html::dataUrl() function. This fix was already present in the upstream codebase when TuxCare onboarded version 4.18.7 (PHPELS-197). The defense restricts file access to within the project root directory, preventing the attack vector described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. CVE-2024-52293 is NOT present in the target. The vulnerability required missing normalizePath() in FileHelper::absolutePath() line 136, allowing path traversal sequences like `../templates/poc` to bypass system directory security checks. The target code contains the upstream vendor's fix: `return static::normalizePath($from . $ds . $to, $ds);` which resolves traversal sequences before the path is used in security validations. This fix was introduced in upstream Craft CMS version 4.12.2 (commit 123e48a696 by brandon@pixelandtonic.com on 2024-09-11). The target version 4.18.7 naturally includes all fixes from 4.12.2. TuxCare onboarded the pre-fixed version 4.18.7; there is no separate TuxCare backport for this CVE on this version line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 is NOT present in the target. The vulnerability required missing normalizePath() in FileHelper::absolutePath() line 136, allowing path traversal sequences like `../templates/poc` to bypass system directory security checks. The target code contains the upstream vendor's fix: `return static::normalizePath($from . $ds . $to, $ds);` which resolves traversal sequences before the path is used in security validations. This fix was introduced in upstream Craft CMS version 4.12.2 (commit 123e48a696 by brandon@pixelandtonic.com on 2024-09-11). The target version 4.18.7 naturally includes all fixes from 4.12.2. TuxCare onboarded the pre-fixed version 4.18.7; there is no separate TuxCare backport for this CVE on this version line." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:36:42.887038+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 4.18.7-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 4.18.7-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-23209 fix a19d46be78a9 by brandon@pixelandtonic.com (2025-07-07) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-23209 fix a19d46be78a9 by brandon@pixelandtonic.com (2025-07-07) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. CVE-2025-32432 RCE vulnerability is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this type confusion vulnerability in commit e1c85441 (2025-04-10) by adding string type validation for the 'handle' parameter in AssetsController::actionGenerateTransform(). This fix was included in upstream release 4.18.7 (2026-08-18), which TuxCare subsequently onboarded to ELS on 2026-09-07. The target code at HEAD (b16f3f8a9b) contains the complete fix: lines 1208-1210 validate that $handle is a string before use, exactly matching the vendor patch. The CVE affects versions 4.0.0-RC1 to before 4.14.15; target version 4.18.7 is after the fixed version. Attribution: upstream vendor fix (no TuxCare authorship signal).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "CVE-2025-32432 RCE vulnerability is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this type confusion vulnerability in commit e1c85441 (2025-04-10) by adding string type validation for the 'handle' parameter in AssetsController::actionGenerateTransform(). This fix was included in upstream release 4.18.7 (2026-08-18), which TuxCare subsequently onboarded to ELS on 2026-09-07. The target code at HEAD (b16f3f8a9b) contains the complete fix: lines 1208-1210 validate that $handle is a string before use, exactly matching the vendor patch. The CVE affects versions 4.0.0-RC1 to before 4.14.15; target version 4.18.7 is after the fixed version. Attribution: upstream vendor fix (no TuxCare authorship signal)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2025-35939 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2025-35939 is not present in the target. The vulnerability involves storing unsanitized return URLs containing arbitrary HTML/PHP code in session files. The upstream vendor (Craft CMS) shipped the fix in version 4.18.7, which strips HTML/PHP tags via strip_tags() and validates URL schemes before storing return URLs in the session. TuxCare onboarded this version with the fix already present....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-35939" }, "impact_statement": "not_affected \u2014 CVE-2025-35939 is not present in the target. The vulnerability involves storing unsanitized return URLs containing arbitrary HTML/PHP code in session files. The upstream vendor (Craft CMS) shipped the fix in version 4.18.7, which strips HTML/PHP tags via strip_tags() and validates URL schemes before storing return URLs in the session. TuxCare onboarded this version with the fix already present...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. Not affected: CVE-2025-46731 affects Craft CMS 4.x prior to 4.14.13 and is fixed upstream in 4.14.13; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (c3f75107a4b4d00f802a56f23aa57cde134df838).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "Not affected: CVE-2025-46731 affects Craft CMS 4.x prior to 4.14.13 and is fixed upstream in 4.14.13; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (c3f75107a4b4d00f802a56f23aa57cde134df838)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2025-57811 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. Not affected: CVE-2025-57811 affects Craft CMS 4.0.0-RC1 through 4.16.5 and is fixed upstream in 4.16.6; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (e77f8a287dcdda41f1724f525d03542f18566cbc).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-57811" }, "impact_statement": "Not affected: CVE-2025-57811 affects Craft CMS 4.0.0-RC1 through 4.16.5 and is fixed upstream in 4.16.6; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (e77f8a287dcdda41f1724f525d03542f18566cbc)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68436 fix 4bcb0db554e2 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68436 fix 4bcb0db554e2 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2025-68437 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68437 fix 013db636fdb3 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68437" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68437 fix 013db636fdb3 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2025-68454 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. Not affected: CVE-2025-68454 affects Craft CMS 4.0.0-RC1 through 4.16.16 and is fixed upstream in 4.16.17; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (d82680f4a05f9576883bb83c3f6243d33ca73ebe).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68454" }, "impact_statement": "Not affected: CVE-2025-68454 affects Craft CMS 4.0.0-RC1 through 4.16.16 and is fixed upstream in 4.16.17; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (d82680f4a05f9576883bb83c3f6243d33ca73ebe)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. Version 4.18.7 is not affected by CVE-2025-68455. The vulnerability was fixed by upstream vendor (Craft CMS/Pixel & Tonic) in version 4.16.17 via commit ec43c497ed (released 2025-12-04). Target version 4.18.7 (released 2026-08-18) is newer and includes this fix plus additional hardening. The fix adds Component::cleanseConfig() to remove dangerous config keys (\"on \" event handlers and \"as \" behaviors) before object instantiation, preventing malicious behavior attachment and RCE. TuxCare later adopted version 4.18.7 into their ELS program, inheriting the upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Version 4.18.7 is not affected by CVE-2025-68455. The vulnerability was fixed by upstream vendor (Craft CMS/Pixel & Tonic) in version 4.16.17 via commit ec43c497ed (released 2025-12-04). Target version 4.18.7 (released 2026-08-18) is newer and includes this fix plus additional hardening. The fix adds Component::cleanseConfig() to remove dangerous config keys (\"on \" event handlers and \"as \" behaviors) before object instantiation, preventing malicious behavior attachment and RCE. TuxCare later adopted version 4.18.7 into their ELS program, inheriting the upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2025-68456 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68456 fix 1718011a5faa by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68456" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68456 fix 1718011a5faa by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-11-09T23:08:00.049119+00:00", "status_notes": "Vulnerability CVE-2026-115934 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 4.18.7 builds search SQL by string interpolation (src/services/Search.php), but every user-controlled fragment is sanitized first. Search terms go through SearchHelper::normalizeKeywords, which strips quotes, backslashes, semicolons and other punctuation. Attribute names are limited to \\w+. Field IDs are integers. I found no unauthenticated element search endpoint in the target. No ve...", "vulnerability": { "name": "CVE-2026-115934" }, "impact_statement": "not_affected \u2014 Craft CMS 4.18.7 builds search SQL by string interpolation (src/services/Search.php), but every user-controlled fragment is sanitized first. Search terms go through SearchHelper::normalizeKeywords, which strips quotes, backslashes, semicolons and other punctuation. Attribute names are limited to \\w+. Field IDs are integers. I found no unauthenticated element search endpoint in the target. No ve..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:41.506821+00:00", "status_notes": "Vulnerability CVE-2026-115935 is fixed in version 4.18.7-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115935" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:41.506821+00:00", "status_notes": "Vulnerability CVE-2026-115938 is fixed in version 4.18.7-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115938" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.7 is NOT AFFECTED by CVE-2026-25491. The vulnerability (stored XSS via unescaped entry type names) affects Craft CMS 5.0.0-RC1 through 5.8.21, where the architecture changed from Vue.js client-side rendering to PHP server-side rendering. In version 4.18.7, entry type names are rendered through Vue.js's default {{ }} interpolation (App.vue:115,120), which automatically applies HTML ...", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 4.18.7 is NOT AFFECTED by CVE-2026-25491. The vulnerability (stored XSS via unescaped entry type names) affects Craft CMS 5.0.0-RC1 through 5.8.21, where the architecture changed from Vue.js client-side rendering to PHP server-side rendering. In version 4.18.7, entry type names are rendered through Vue.js's default {{ }} interpolation (App.vue:115,120), which automatically applies HTML ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-25493. The upstream vendor fixed this SSRF redirect bypass vulnerability in commit 26268c0210 (June 2026), which was included in the 4.18.7 release (August 2026). The target code disables HTTP redirects at line 318 (`RequestOptions::ALLOW_REDIRECTS => false`) in the downloadUrl method, preventing attackers from bypassing validation ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-25493. The upstream vendor fixed this SSRF redirect bypass vulnerability in commit 26268c0210 (June 2026), which was included in the 4.18.7 release (August 2026). The target code disables HTTP redirects at line 318 (`RequestOptions::ALLOW_REDIRECTS => false`) in the downloadUrl method, preventing attackers from bypassing validation ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-25494 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-25494 describes a hex IP notation bypass of filter_var() validation in the saveAsset GraphQL mutation. The target (4.18.7) is NOT AFFECTED because the vulnerable code pattern has been completely replaced by an upstream vendor refactoring. On June 15, 2026, upstream author brandon@pixelandtonic.com (commit 26268c0210) replaced the inline filter_var() validation with the craftcms/url-val...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "not_affected \u2014 CVE-2026-25494 describes a hex IP notation bypass of filter_var() validation in the saveAsset GraphQL mutation. The target (4.18.7) is NOT AFFECTED because the vulnerable code pattern has been completely replaced by an upstream vendor refactoring. On June 15, 2026, upstream author brandon@pixelandtonic.com (commit 26268c0210) replaced the inline filter_var() validation with the craftcms/url-val..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. Craft CMS 4.18.7 is not affected by CVE-2026-25495. The upstream vendor (Pixel & Tonic) fixed this SQL injection vulnerability in version 4.16.18 (released 2026-01-09) by removing dangerous SQL query construction parameters from user-provided criteria before database query configuration. The fix was refactored into ElementHelper::cleanseQueryCriteria() in version 4.17.4 (released 2026-02-11). The target version 4.18.7 (released 2026-08-18) inherits this upstream fix. The vulnerable pattern is not present in the target because an upstream-authored fix is already applied in the shipped version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "Craft CMS 4.18.7 is not affected by CVE-2026-25495. The upstream vendor (Pixel & Tonic) fixed this SQL injection vulnerability in version 4.16.18 (released 2026-01-09) by removing dangerous SQL query construction parameters from user-provided criteria before database query configuration. The fix was refactored into ElementHelper::cleanseQueryCriteria() in version 4.17.4 (released 2026-02-11). The target version 4.18.7 (released 2026-08-18) inherits this upstream fix. The vulnerable pattern is not present in the target because an upstream-authored fix is already applied in the shipped version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is not affected by CVE-2026-25496. The upstream vendor (Craft CMS / Pixel & Tonic) fixed the stored XSS vulnerability in commit 93837b626f on 2026-01-05 by adding HTML encoding to the Number field's Prefix and Suffix rendering. This fix was included in the upstream 4.18.7 release (finalized 2026-08-18), which TuxCare inherited when onboarding this version. The vulnerable p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is not affected by CVE-2026-25496. The upstream vendor (Craft CMS / Pixel & Tonic) fixed the stored XSS vulnerability in commit 93837b626f on 2026-01-05 by adding HTML encoding to the Number field's Prefix and Suffix rendering. This fix was included in the upstream 4.18.7 release (finalized 2026-08-18), which TuxCare inherited when onboarding this version. The vulnerable p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. Target version 4.18.7 is not vulnerable to CVE-2026-25498. The upstream vendor (Pixel & Tonic) fixed the RCE vulnerability in commit 395c64f0b8 on 2026-01-09 by adding ComponentHelper::cleanseConfig() sanitization before passing user-supplied field layout configuration to object creation. This fix was included in the upstream 4.18.7 release (2026-08-18) which TuxCare subsequently onboarded for Extended Lifecycle Support. The vulnerable pattern (unsanitized config data passed directly to createLayout) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "Target version 4.18.7 is not vulnerable to CVE-2026-25498. The upstream vendor (Pixel & Tonic) fixed the RCE vulnerability in commit 395c64f0b8 on 2026-01-09 by adding ComponentHelper::cleanseConfig() sanitization before passing user-supplied field layout configuration to object creation. This fix was included in the upstream 4.18.7 release (2026-08-18) which TuxCare subsequently onboarded for Extended Lifecycle Support. The vulnerable pattern (unsanitized config data passed directly to createLayout) is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (CVE-2026-27126) affecting versions 4.5.0-RC1 through 4.16.18 was patched in upstream version 4.16.19. The target version 4.18.7 inherited the complete fix from upstream commit f5d488d9bb (authored by brandon@pixelandtonic.com on 2026-01-14). The fix validates table column types against a whitelist and converts unsupported types (includin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (CVE-2026-27126) affecting versions 4.5.0-RC1 through 4.16.18 was patched in upstream version 4.16.19. The target version 4.18.7 inherited the complete fix from upstream commit f5d488d9bb (authored by brandon@pixelandtonic.com on 2026-01-14). The fix validates table column types against a whitelist and converts unsupported types (includin..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-27127 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-27127 (DNS rebinding TOCTOU SSRF). The upstream vendor (Pixel & Tonic) deployed a comprehensive fix in commit 26268c0210 (June 15, 2026) that implements DNS pinning via CURLOPT_RESOLVE and pre-validates IPs through the craftcms/url-validator package. This fix was naturally included in version 4.18.7 (released August 18, 2026). The vulnerable pattern (separate DNS lookups without pinning) has been completely removed from the codebase. This is a vendor-authored fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27127" }, "impact_statement": "The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-27127 (DNS rebinding TOCTOU SSRF). The upstream vendor (Pixel & Tonic) deployed a comprehensive fix in commit 26268c0210 (June 15, 2026) that implements DNS pinning via CURLOPT_RESOLVE and pre-validates IPs through the craftcms/url-validator package. This fix was naturally included in version 4.18.7 (released August 18, 2026). The vulnerable pattern (separate DNS lookups without pinning) has been completely removed from the codebase. This is a vendor-authored fix, not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 The target repository at version 4.18.7 is NOT vulnerable to CVE-2026-27128. The TOCTOU race condition fix was applied by the upstream vendor (Pixel & Tonic) in commit 3e4afe1827 as part of version 4.16.19 (released 2026-01-15). Version 4.18.7, being newer than 4.16.19, naturally includes this fix. The getTokenRoute() method in src/services/Tokens.php correctly uses mutex locking to ensure atom...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target repository at version 4.18.7 is NOT vulnerable to CVE-2026-27128. The TOCTOU race condition fix was applied by the upstream vendor (Pixel & Tonic) in commit 3e4afe1827 as part of version 4.16.19 (released 2026-01-15). Version 4.18.7, being newer than 4.16.19, naturally includes this fix. The getTokenRoute() method in src/services/Tokens.php correctly uses mutex locking to ensure atom..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-27129 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) is NOT AFFECTED by CVE-2026-27129. The vulnerable pattern (using gethostbyname() which only resolves IPv4) is absent because the upstream vendor refactored the code to use the craftcms/url-validator library (commit 26268c0210, Jun 2026). This library uses dns_get_record() with both DNS_A and DNS_AAAA records, and includes comprehensive IPv6 validation via FILTER_FL...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27129" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.7) is NOT AFFECTED by CVE-2026-27129. The vulnerable pattern (using gethostbyname() which only resolves IPv4) is absent because the upstream vendor refactored the code to use the craftcms/url-validator library (commit 26268c0210, Jun 2026). This library uses dns_get_record() with both DNS_A and DNS_AAAA records, and includes comprehensive IPv6 validation via FILTER_FL..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. The target craftcms/cms 4.18.7 contains the upstream vendor fix for CVE-2026-31857. The vulnerable unsandboxed Twig rendering call has been replaced with the sandboxed version in BaseElementSelectConditionRule.php line 88. Fix commit 8d4903647d was authored by brandon@pixelandtonic.com (Craft CMS upstream vendor) as part of the 4.17.4 release, and is included in the 4.18.7 version onboarded by TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "The target craftcms/cms 4.18.7 contains the upstream vendor fix for CVE-2026-31857. The vulnerable unsandboxed Twig rendering call has been replaced with the sandboxed version in BaseElementSelectConditionRule.php line 88. Fix commit 8d4903647d was authored by brandon@pixelandtonic.com (Craft CMS upstream vendor) as part of the 4.17.4 release, and is included in the 4.18.7 version onboarded by TuxCare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. CVE-2026-31858 does not affect Craft CMS version 4.18.7. The vulnerable component ElementSearchController was introduced in Craft CMS 5.x and does not exist in version 4.x. The target repository is running version 4.18.7, which predates the introduction of this controller. The only controller in version 4.18.7 that processes user query criteria (ElementIndexesController) already contains the proper defense mechanism (ElementHelper::cleanseQueryCriteria()) that was added for CVE-2026-25495. No alternative code path exists in version 4.18.7 that exhibits the same SQL injection vulnerability pattern.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "CVE-2026-31858 does not affect Craft CMS version 4.18.7. The vulnerable component ElementSearchController was introduced in Craft CMS 5.x and does not exist in version 4.x. The target repository is running version 4.18.7, which predates the introduction of this controller. The only controller in version 4.18.7 that processes user query criteria (ElementIndexesController) already contains the proper defense mechanism (ElementHelper::cleanseQueryCriteria()) that was added for CVE-2026-25495. No alternative code path exists in version 4.18.7 that exhibits the same SQL injection vulnerability pattern." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-31859 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (XSS via javascript: URLs bypassing strip_tags()) was fixed by upstream vendor commit cc9921c14897ee2b592a431c2356af8a04ce4cfe, which added URL scheme validation before strip_tags() in src/web/User.php::setReturnUrl(). This fix was already present in upstream version 4.18.7 (released 2026-08-18) when TuxCare onboarded it (commit 4a22c9d3d...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31859" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (XSS via javascript: URLs bypassing strip_tags()) was fixed by upstream vendor commit cc9921c14897ee2b592a431c2356af8a04ce4cfe, which added URL scheme validation before strip_tags() in src/web/User.php::setReturnUrl(). This fix was already present in upstream version 4.18.7 (released 2026-08-18) when TuxCare onboarded it (commit 4a22c9d3d..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 The target (craftcms/cms 4.18.7) is not affected by CVE-2026-32262. The vulnerability (path traversal via unsanitized targetFilename parameter in AssetsController->replaceFile() allowing arbitrary file deletion) was fixed by upstream vendor Pixel & Tonic in version 4.17.5 (commit c997efbe4c, Feb 16 2026). The target version 4.18.7 inherits this fix from upstream. The validation code rejecting f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The target (craftcms/cms 4.18.7) is not affected by CVE-2026-32262. The vulnerability (path traversal via unsanitized targetFilename parameter in AssetsController->replaceFile() allowing arbitrary file deletion) was fixed by upstream vendor Pixel & Tonic in version 4.17.5 (commit c997efbe4c, Feb 16 2026). The target version 4.18.7 inherits this fix from upstream. The validation code rejecting f..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. CVE-2026-32263 affects Craft CMS versions 5.6.0 to before 5.9.11, specifically in src/controllers/EntryTypesController.php. The target version 4.18.7 is not affected because: (1) EntryTypesController.php does not exist in version 4.x; (2) Entry type management in 4.x is handled by SectionsController.php which does not use parse_str; (3) All 4 instances of parse_str in version 4.18.7 controllers (FieldsController.php and ElementIndexesController.php) are protected with Component::cleanseConfig() before passing data to Craft::configure(). The vulnerable code pattern described in the CVE does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "CVE-2026-32263 affects Craft CMS versions 5.6.0 to before 5.9.11, specifically in src/controllers/EntryTypesController.php. The target version 4.18.7 is not affected because: (1) EntryTypesController.php does not exist in version 4.x; (2) Entry type management in 4.x is handled by SectionsController.php which does not use parse_str; (3) All 4 instances of parse_str in version 4.18.7 controllers (FieldsController.php and ElementIndexesController.php) are protected with Component::cleanseConfig() before passing data to Craft::configure(). The vulnerable code pattern described in the CVE does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32264 fix dfec46362fcb by brandon@pixelandtonic.com (2026-02-16) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32264 fix dfec46362fcb by brandon@pixelandtonic.com (2026-02-16) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32267 fix 6301e217c5f1 by brandon@pixelandtonic.com (2026-02-18) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32267 fix 6301e217c5f1 by brandon@pixelandtonic.com (2026-02-18) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 4.18.7 is not affected by CVE-2026-33051. The CVE describes an XSS vulnerability specific to versions 5.9.0-beta.1 through 5.9.10 where the creator's fullName is rendered as raw HTML due to Template::raw() combined with Craft::t() in the revision/draft context menu. While the target version 4.18.7 does display creator names in the revision menu (src/templates/_includes/revisionmenu.tw...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 4.18.7 is not affected by CVE-2026-33051. The CVE describes an XSS vulnerability specific to versions 5.9.0-beta.1 through 5.9.10 where the creator's fullName is rendered as raw HTML due to Template::raw() combined with Craft::t() in the revision/draft context menu. While the target version 4.18.7 does display creator names in the revision menu (src/templates/_includes/revisionmenu.tw..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. Version 4.18.7 is NOT affected by CVE-2026-33157. The vulnerability exists in Craft CMS 5.6.0-5.9.12 where a NEW code path (fieldLayouts parameter in ElementIndexesController::actionFilterHud) bypasses existing sanitization. This specific code path does NOT exist in version 4.x. Version 4.18.7 only processes conditionConfig in actionFilterHud(), which is properly sanitized via Component::cleanseConfig() at line 421. The setFieldLayouts() method and fieldLayouts parameter handling were introduced in version 5.x and are completely absent from version 4.18.7's codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "Version 4.18.7 is NOT affected by CVE-2026-33157. The vulnerability exists in Craft CMS 5.6.0-5.9.12 where a NEW code path (fieldLayouts parameter in ElementIndexesController::actionFilterHud) bypasses existing sanitization. This specific code path does NOT exist in version 4.x. Version 4.18.7 only processes conditionConfig in actionFilterHud(), which is properly sanitized via Component::cleanseConfig() at line 421. The setFieldLayouts() method and fieldLayouts parameter handling were introduced in version 5.x and are completely absent from version 4.18.7's codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-33158 is NOT present in Craft CMS 4.18.7. The vulnerability described an authorization bypass in the assets/edit-image endpoint allowing low-privileged users to read private asset content. The upstream vendor (Pixel & Tonic) fixed this in version 4.17.8 (commit e674bbbd30, Feb 25 2026) by adding requireVolumePermissionByAsset() and requirePeerVolumePermissionByAsset() checks. Version 4...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 CVE-2026-33158 is NOT present in Craft CMS 4.18.7. The vulnerability described an authorization bypass in the assets/edit-image endpoint allowing low-privileged users to read private asset content. The upstream vendor (Pixel & Tonic) fixed this in version 4.17.8 (commit e674bbbd30, Feb 25 2026) by adding requireVolumePermissionByAsset() and requirePeerVolumePermissionByAsset() checks. Version 4..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) contains the complete fix for CVE-2026-33159. The upstream vendor (Pixel & Tonic) fixed the vulnerability in commit 7f0ead833f (2026-02-25), included it in their 4.18.7 release (2026-08-18), and TuxCare onboarded that pre-fixed version (2026-09-07). The vulnerable pattern\u2014missing authentication/authorization on ConfigSyncController\u2014is not present at HEAD. Verdict: ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.7) contains the complete fix for CVE-2026-33159. The upstream vendor (Pixel & Tonic) fixed the vulnerability in commit 7f0ead833f (2026-02-25), included it in their 4.18.7 release (2026-08-18), and TuxCare onboarded that pre-fixed version (2026-09-07). The vulnerable pattern\u2014missing authentication/authorization on ConfigSyncController\u2014is not present at HEAD. Verdict: ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-33160 fix 83fd398c12a3 by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-33160 fix 83fd398c12a3 by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-33161 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 4.18.7) contains the upstream vendor's fix for the asset information disclosure vulnerability. The CVE describes an authorization bypass where the assets/image-editor endpoint (actionImageEditor method) returns focalPoint and other editor metadata without validating user permissions. The fix (commit 1f91f9b7aa, GHSA-vgjg-248p-rfm2) added requireVolumePermissionB...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 4.18.7) contains the upstream vendor's fix for the asset information disclosure vulnerability. The CVE describes an authorization bypass where the assets/image-editor endpoint (actionImageEditor method) returns focalPoint and other editor metadata without validating user permissions. The fix (commit 1f91f9b7aa, GHSA-vgjg-248p-rfm2) added requireVolumePermissionB..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS v4.18.7 is not affected by CVE-2026-33162. The vulnerability affects the `/actions/entries/move-to-section` endpoint and Entry::canMove() authorization method, which were introduced in Craft CMS v5.x. Version 4.18.7 does not have the move-entries-between-sections feature at all. The GraphQL resolver explicitly prevents section changes with the error \"Impossible to change the section o...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 Craft CMS v4.18.7 is not affected by CVE-2026-33162. The vulnerability affects the `/actions/entries/move-to-section` endpoint and Entry::canMove() authorization method, which were introduced in Craft CMS v5.x. Version 4.18.7 does not have the move-entries-between-sections feature at all. The GraphQL resolver explicitly prevents section changes with the error \"Impossible to change the section o..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset upload) is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit d20aecfaa0 (March 4, 2026) by adding scheme validation that blocks non-HTTP/HTTPS protocols (gopher, file, ftp, etc.). This fix was later refactored into the craftcms/url-validator library (commit 26268c0210, Jun...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "not_affected \u2014 CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset upload) is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit d20aecfaa0 (March 4, 2026) by adding scheme validation that blocks non-HTTP/HTTPS protocols (gopher, file, ftp, etc.). This fix was later refactored into the craftcms/url-validator library (commit 26268c0210, Jun..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) is not affected by CVE-2026-41130. The SSRF vulnerability in the resource-js endpoint was fixed by upstream vendor (Pixel & Tonic) in commit ebe7e85f1c, which is present in the target. The vulnerable code that made HTTP requests via Guzzle client has been replaced with local filesystem serving using App::resourcePathByUri() with path traversal protection. Additiona...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.7) is not affected by CVE-2026-41130. The SSRF vulnerability in the resource-js endpoint was fixed by upstream vendor (Pixel & Tonic) in commit ebe7e85f1c, which is present in the target. The vulnerable code that made HTTP requests via Guzzle client has been replaced with local filesystem serving using App::resourcePathByUri() with path traversal protection. Additiona..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-55790 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. CVE-2026-55790 (GHSA-24x4-j6x9-rfw5): The XSS vulnerability in the CraftSupport widget is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit 6bbb66038a (May 2026) by adding HTML escaping via Craft.escapeHtml() and using jQuery's text: option for error messages. This fix was included in upstream's 4.18.7 release (August 2026), which TuxCare subsequently adopted for ELS support (September 2026). TuxCare did not backport this specific fix; they inherited an already-fixed upstream release. Both defense mechanisms from the patch are present and correctly implemented at lines 382 and 555-557 of CraftSupportWidget.js.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55790" }, "impact_statement": "CVE-2026-55790 (GHSA-24x4-j6x9-rfw5): The XSS vulnerability in the CraftSupport widget is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit 6bbb66038a (May 2026) by adding HTML escaping via Craft.escapeHtml() and using jQuery's text: option for error messages. This fix was included in upstream's 4.18.7 release (August 2026), which TuxCare subsequently adopted for ELS support (September 2026). TuxCare did not backport this specific fix; they inherited an already-fixed upstream release. Both defense mechanisms from the patch are present and correctly implemented at lines 382 and 555-557 of CraftSupportWidget.js." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-55793 is fixed in version 4.18.7-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55793" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is not affected. The CVE describes a vulnerability in version 5.0.0-RC1+, but analysis of 4.18.7 code shows user group names are protected by Twig's default HTML auto-escaping and Vue's text interpolation escaping. All rendering paths include runtime defenses that transform script content before display, preventing execution in administrators' browsers.", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is not affected. The CVE describes a vulnerability in version 5.0.0-RC1+, but analysis of 4.18.7 code shows user group names are protected by Twig's default HTML auto-escaping and Vue's text interpolation escaping. All rendering paths include runtime defenses that transform script content before display, preventing execution in administrators' browsers." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-56382 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. Target version 4.18.7 is not affected by CVE-2026-56382. The vulnerable method `actionRenderCardPreview()` from the v5.x patch does not exist in v4.18.7's codebase. The CVE affects Craft CMS versions >= 5.5.0 and <= 5.9.13, while this target is v4.18.7. Although TuxCare backported this CVE to v3.9.15 (fixing a different vulnerable method `actionRenderLayoutElementSelector()`), v4.18.7 contains neither the v5.x vulnerable method nor the v3.x vulnerable method. The methods that do exist in v4.18.7 and handle layout configurations (`actionApplyLayoutTabSettings()`, `actionApplyLayoutElementSettings()`) properly sanitize all config parameters via `Component::cleanseConfig()` before passing them to layout creation functions.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56382" }, "impact_statement": "Target version 4.18.7 is not affected by CVE-2026-56382. The vulnerable method `actionRenderCardPreview()` from the v5.x patch does not exist in v4.18.7's codebase. The CVE affects Craft CMS versions >= 5.5.0 and <= 5.9.13, while this target is v4.18.7. Although TuxCare backported this CVE to v3.9.15 (fixing a different vulnerable method `actionRenderLayoutElementSelector()`), v4.18.7 contains neither the v5.x vulnerable method nor the v3.x vulnerable method. The methods that do exist in v4.18.7 and handle layout configurations (`actionApplyLayoutTabSettings()`, `actionApplyLayoutElementSettings()`) properly sanitize all config parameters via `Component::cleanseConfig()` before passing them to layout creation functions." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-56383 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The upstream vendor fix (commit 7b372de262b8) is present in HEAD, applying HTML encoding to heading-type cell values before rendering. The fix was authored by brandon@pixelandtonic.com (Craft CMS upstream) and shipped in version 4.16.19. TuxCare onboarded version 4.18.7 (released 2026-08-18) which already contained this fix. No TuxCare attribution signals ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56383" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The upstream vendor fix (commit 7b372de262b8) is present in HEAD, applying HTML encoding to heading-type cell values before rendering. The fix was authored by brandon@pixelandtonic.com (Craft CMS upstream) and shipped in version 4.16.19. TuxCare onboarded version 4.18.7 (released 2026-08-18) which already contained this fix. No TuxCare attribution signals ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-56384 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-56384 fix ed56049c9d3f by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56384" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-56384 fix ed56049c9d3f by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-56385 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 contains the upstream vendor's authorization fix for CVE-2026-56385. The vulnerability (authorization bypass in assets/preview-file endpoint) was fixed by Pixel & Tonic in commit d30df31122 (Feb 2026) which added requireVolumePermissionByAsset and requirePeerVolumePermissionByAsset checks to actionPreviewFile(). This fix was included in upstream Craft CMS 4.17.8 and 4.18.7...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56385" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 contains the upstream vendor's authorization fix for CVE-2026-56385. The vulnerability (authorization bypass in assets/preview-file endpoint) was fixed by Pixel & Tonic in commit d30df31122 (Feb 2026) which added requireVolumePermissionByAsset and requirePeerVolumePermissionByAsset checks to actionPreviewFile(). This fix was included in upstream Craft CMS 4.17.8 and 4.18.7..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-11-08T14:16:00.068422+00:00", "status_notes": "Vulnerability CVE-2026-56393 affects version 4.18.7-p3+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56393" }, "action_statement": "Vulnerability CVE-2026-56393 affects version 4.18.7-p3+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-28T13:01:32.038750+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 4.18.7-p3+tuxcare of craftcms/cms. Target Craft CMS 4.18.7 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint has been fixed by upstream vendor commit 30f5f1a8d6 (authored by brandon@pixelandtonic.com), which added regex validation to reject extension parameters containing traversal sequences. The fix validates extensions with /^\\w+$/ before filesystem operations, preventing the attack chain described in the CVE. TuxCare adopted this fix when onboarding version 4.18.7 to ELS support.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "Target Craft CMS 4.18.7 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint has been fixed by upstream vendor commit 30f5f1a8d6 (authored by brandon@pixelandtonic.com), which added regex validation to reject extension parameters containing traversal sequences. The fix validates extensions with /^\\w+$/ before filesystem operations, preventing the attack chain described in the CVE. TuxCare adopted this fix when onboarding version 4.18.7 to ELS support." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p3+tuxcare" } } ], "timestamp": "2026-10-29T08:36:42.244967+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 4.18.7-p3+tuxcare of craftcms/cms. not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was fixed in upstream Craft CMS 3.7.29 (commit 7ca2b2d2c by brandon@pixelandtonic.com, Jan 2022) and was already present in the 4.18.7 release that TuxCare onboarded. The fix adds a filter validating feed item permalinks match /^https?:\\/\\// before creating anchor elements, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was fixed in upstream Craft CMS 3.7.29 (commit 7ca2b2d2c by brandon@pixelandtonic.com, Jan 2022) and was already present in the 4.18.7 release that TuxCare onboarded. The fix adds a filter validating feed item permalinks match /^https?:\\/\\// before creating anchor elements, pre..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2018-14773 does not affect version v7.4.8-p1+tuxcare of symfony/http-foundation. not_affected \u2014 CVE-2018-14773 is not present in symfony/http-foundation v7.4.8-p1+tuxcare. The vulnerable code pattern that trusted X-Original-URL and X-Rewrite-URL headers was removed by upstream Symfony in 2018. The fix (authored by Nicolas Grekas) was already included in the upstream Symfony v7.4.8 release that TuxCare onboarded. The target's prepareRequestUri() method does not check for these headers, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14773" }, "impact_statement": "not_affected \u2014 CVE-2018-14773 is not present in symfony/http-foundation v7.4.8-p1+tuxcare. The vulnerable code pattern that trusted X-Original-URL and X-Rewrite-URL headers was removed by upstream Symfony in 2018. The fix (authored by Nicolas Grekas) was already included in the upstream Symfony v7.4.8 release that TuxCare onboarded. The target's prepareRequestUri() method does not check for these headers, pre..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:19:23.616509+00:00", "status_notes": "Vulnerability CVE-2019-10913 does not affect version v7.4.8-p1+tuxcare of symfony/http-foundation. The target is NOT vulnerable to CVE-2019-10913. The vulnerable code pattern (unvalidated HTTP method override strings) is not present in symfony/http-foundation v7.4.8-p1+tuxcare. The upstream vendor (Symfony) fixed this CVE before releasing v7.4.8, which TuxCare onboarded via snapshot commit b882216d. The current code at Request.php:1280-1282 contains robust validation that rejects any method override string containing non-uppercase-letter characters, effectively blocking SQL injection and XSS payloads that could exploit unvalidated method strings.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10913" }, "impact_statement": "The target is NOT vulnerable to CVE-2019-10913. The vulnerable code pattern (unvalidated HTTP method override strings) is not present in symfony/http-foundation v7.4.8-p1+tuxcare. The upstream vendor (Symfony) fixed this CVE before releasing v7.4.8, which TuxCare onboarded via snapshot commit b882216d. The current code at Request.php:1280-1282 contains robust validation that rejects any method override string containing non-uppercase-letter characters, effectively blocking SQL injection and XSS payloads that could exploit unvalidated method strings." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:19:23.616509+00:00", "status_notes": "Vulnerability CVE-2019-18888 does not affect version v7.4.8-p1+tuxcare of symfony/http-foundation. CVE-2019-18888 affects the FileBinaryMimeTypeGuesser class which executes the `file` command with unsanitized file paths. In Symfony versions 2.8-4.2, this class was part of http-foundation. However, starting with Symfony 4.3, all MIME type detection was migrated to the separate symfony/mime component, and in Symfony 5.0 the entire MimeType namespace was removed from http-foundation. The target (v7.4.8) does not contain any of the vulnerable code - File::getMimeType() delegates entirely to Symfony\\Component\\Mime\\MimeTypes, which is only listed as a dev-dependency (not vendored). The vulnerable code path (file path \u2192 FileBinaryMimeTypeGuesser \u2192 passthru/file command) does not exist in this repository. Any vulnerability in symfony/mime is tracked separately against that component.", "vulnerability": { "name": "CVE-2019-18888" }, "impact_statement": "CVE-2019-18888 affects the FileBinaryMimeTypeGuesser class which executes the `file` command with unsanitized file paths. In Symfony versions 2.8-4.2, this class was part of http-foundation. However, starting with Symfony 4.3, all MIME type detection was migrated to the separate symfony/mime component, and in Symfony 5.0 the entire MimeType namespace was removed from http-foundation. The target (v7.4.8) does not contain any of the vulnerable code - File::getMimeType() delegates entirely to Symfony\\Component\\Mime\\MimeTypes, which is only listed as a dev-dependency (not vendored). The vulnerable code path (file path \u2192 FileBinaryMimeTypeGuesser \u2192 passthru/file command) does not exist in this repository. Any vulnerability in symfony/mime is tracked separately against that component." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare" } } ], "timestamp": "2026-10-21T07:30:06.486681+00:00", "status_notes": "Vulnerability CVE-2024-50345 does not affect version v7.4.8-p1+tuxcare of symfony/http-foundation. already_fixed \u2014 The target repository (symfony/http-foundation v7.4.8) already contains the fix for CVE-2024-50345. All four validation checks from the vendor patch are present in Request::create() at lines 354-374, rejecting URIs with invalid characters that could cause parsing discrepancies between PHP and browsers.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-50345" }, "impact_statement": "already_fixed \u2014 The target repository (symfony/http-foundation v7.4.8) already contains the fix for CVE-2024-50345. All four validation checks from the vendor patch are present in Request::create() at lines 354-374, rejecting URIs with invalid characters that could cause parsing discrepancies between PHP and browsers." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare" } } ], "timestamp": "2026-10-21T07:30:06.486681+00:00", "status_notes": "Vulnerability CVE-2025-64500 does not affect version v7.4.8-p1+tuxcare of symfony/http-foundation. already_fixed \u2014 CVE-2025-64500: The target repository (symfony/http-foundation v7.4.8) already contains the fix for the PATH_INFO leading slash vulnerability. The preparePathInfo() method at Request.php:2038-2039 includes the critical check that ensures all path values start with '/' by detecting when pathInfo[0] is not '/' and prepending a slash. This is the same defense mechanism as the upstream patch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-64500" }, "impact_statement": "already_fixed \u2014 CVE-2025-64500: The target repository (symfony/http-foundation v7.4.8) already contains the fix for the PATH_INFO leading slash vulnerability. The preparePathInfo() method at Request.php:2038-2039 includes the critical check that ensures all path values start with '/' by detecting when pathInfo[0] is not '/' and prepending a slash. This is the same defense mechanism as the upstream patch." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare" } } ], "timestamp": "2026-10-21T07:30:06.486681+00:00", "status_notes": "Vulnerability CVE-2026-108082 is fixed in version v7.4.8-p1+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2026-108082" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:34:00.103182+00:00", "status_notes": "Vulnerability CVE-2026-118514 affects version v7.4.8-p1+tuxcare of symfony/http-foundation, and is fixed in v7.4.8-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-118514" }, "action_statement": "Vulnerability CVE-2026-118514 affects version v7.4.8-p1+tuxcare of symfony/http-foundation, and is fixed in v7.4.8-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare" } } ], "timestamp": "2026-10-21T07:30:06.486681+00:00", "status_notes": "Vulnerability CVE-2026-48736 does not affect version v7.4.8-p1+tuxcare of symfony/http-foundation. not_affected \u2014 The target repository (symfony/http-foundation v7.4.8) is a library that exports IpUtils::isPrivateIp() and PRIVATE_SUBNETS, which do contain the vulnerability pattern described in CVE-2026-48736 (incomplete IPv6 transition prefix coverage). However, the library itself does not execute any code path that processes user-supplied URLs or makes HTTP requests to private networks. The vulnerable cod...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-48736" }, "impact_statement": "not_affected \u2014 The target repository (symfony/http-foundation v7.4.8) is a library that exports IpUtils::isPrivateIp() and PRIVATE_SUBNETS, which do contain the vulnerability pattern described in CVE-2026-48736 (incomplete IPv6 transition prefix coverage). However, the library itself does not execute any code path that processes user-supplied URLs or makes HTTP requests to private networks. The vulnerable cod..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v5.4.48-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v5.4.48-p2+tuxcare" } } ], "timestamp": "2026-11-10T15:40:53.187521+00:00", "status_notes": "Vulnerability CVE-2026-118516 is fixed in version v5.4.48-p2+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-118516" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v5.4.48-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v5.4.48-p2+tuxcare" } } ], "timestamp": "2026-11-10T15:40:33.525152+00:00", "status_notes": "Vulnerability CVE-2026-45065 is fixed in version v5.4.48-p2+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-45065" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v5.4.48-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v5.4.48-p2+tuxcare" } } ], "timestamp": "2026-11-10T15:40:33.525152+00:00", "status_notes": "Vulnerability CVE-2026-48784 is fixed in version v5.4.48-p2+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-48784" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 11.44.0-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is not affected by CVE-2017-14775. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database-level token comparison with constant-time hash_equals() comparison. The target version 11.44.0 already contains this fix as it was present in the upstream release when TuxCare onboarded it. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() fo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is not affected by CVE-2017-14775. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database-level token comparison with constant-time hash_equals() comparison. The target version 11.44.0 already contains this fix as it was present in the upstream release when TuxCare onboarded it. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() fo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 11.44.0-p4+tuxcare of laravel/framework. CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, allowing RCE via PHP object injection when untrusted X-XSRF-TOKEN values are unserialized. The target (Laravel 11.44.0-p4+tuxcare) is NOT AFFECTED because upstream Laravel fixed this vulnerability in August 2018 (commit c0eb9073eb by Taylor Otwell), long before version 11.44.0 was released. The fix prevents automatic PHP unserialization of decrypted cookies/headers by passing `false` to the decrypt method's serialize parameter, blocking the RCE attack chain. The vulnerable code pattern (automatic unserialization) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, allowing RCE via PHP object injection when untrusted X-XSRF-TOKEN values are unserialized. The target (Laravel 11.44.0-p4+tuxcare) is NOT AFFECTED because upstream Laravel fixed this vulnerability in August 2018 (commit c0eb9073eb by Taylor Otwell), long before version 11.44.0 was released. The fix prevents automatic PHP unserialization of decrypted cookies/headers by passing `false` to the decrypt method's serialize parameter, blocking the RCE attack chain. The vulnerable code pattern (automatic unserialization) is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-11-04T11:54:00.052758+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 11.44.0-p4+tuxcare of laravel/framework, and is fixed in 11.44.0-p5+tuxcare.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 11.44.0-p4+tuxcare of laravel/framework, and is fixed in 11.44.0-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 11.44.0-p4+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework versions before 5.8.17 due to OS command injection in the link() function of Filesystem.php. The vulnerability allowed attackers to inject arbitrary shell commands through unescaped $target and $link parameters passed to exec(). The target version 11.44.0 is NOT affected because the upstream fix (commit 44c3feb604) was already included in the upstream release when TuxCare onboarded it. The fix wraps both parameters with escapeshellarg() to prevent shell metacharacter injection. This was an upstream fix by Taylor Otwell applied in v5.8.17 (May 2019), well before version 11.44.0.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework versions before 5.8.17 due to OS command injection in the link() function of Filesystem.php. The vulnerability allowed attackers to inject arbitrary shell commands through unescaped $target and $link parameters passed to exec(). The target version 11.44.0 is NOT affected because the upstream fix (commit 44c3feb604) was already included in the upstream release when TuxCare onboarded it. The fix wraps both parameters with escapeshellarg() to prevent shell metacharacter injection. This was an upstream fix by Taylor Otwell applied in v5.8.17 (May 2019), well before version 11.44.0." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:41:49.287227+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 11.44.0-p4+tuxcare of laravel/framework. The target Laravel Framework 11.44.0-p4+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability involved a mass assignment bypass where attackers could set protected (guarded) model attributes by using fabricated keys with JSON path notation. The fix (commit 897d107 by Taylor Otwell, 2020-08-07) adds the isGuardableColumn() method that validates attribute keys against actual database columns, rejecting keys that don't correspond to real columns. This fix was already present in the upstream Laravel 11.44.0 release that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix commit predates the first TuxCare snapshot commit (c9a73e2b77b).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel Framework 11.44.0-p4+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability involved a mass assignment bypass where attackers could set protected (guarded) model attributes by using fabricated keys with JSON path notation. The fix (commit 897d107 by Taylor Otwell, 2020-08-07) adds the isGuardableColumn() method that validates attribute keys against actual database columns, rejecting keys that don't correspond to real columns. This fix was already present in the upstream Laravel 11.44.0 release that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix commit predates the first TuxCare snapshot commit (c9a73e2b77b)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 11.44.0-p4+tuxcare of laravel/framework. Laravel 11.44.0 is not affected by CVE-2021-21263. The vulnerability (query binding exploitation via unchecked array inputs) was fixed in the upstream Laravel release through commit d0954f4574 by Taylor Otwell on Jan 13, 2021. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() helper or array_slice() to limit bindings. The fix was already present in upstream Laravel 11.44.0 when TuxCare onboarded it via snapshot commit c9a73e2b77.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "Laravel 11.44.0 is not affected by CVE-2021-21263. The vulnerability (query binding exploitation via unchecked array inputs) was fixed in the upstream Laravel release through commit d0954f4574 by Taylor Otwell on Jan 13, 2021. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() helper or array_slice() to limit bindings. The fix was already present in upstream Laravel 11.44.0 when TuxCare onboarded it via snapshot commit c9a73e2b77." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:25:11.687376+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 11.44.0-p4+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 (XSS via predictable Blade parent placeholders) is not present in Laravel 11.44.0. The vulnerability pattern (deterministic sha1($section) hashes allowing placeholder prediction) was fixed by upstream Laravel in December 2021. The fix was already included in the v11.44.0 release before TuxCare onboarded it. Both critical files contain the defense: ManagesLayouts.php uses per-requ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 (XSS via predictable Blade parent placeholders) is not present in Laravel 11.44.0. The vulnerability pattern (deterministic sha1($section) hashes allowing placeholder prediction) was fixed by upstream Laravel in December 2021. The fix was already included in the v11.44.0 release before TuxCare onboarded it. Both critical files contain the defense: ManagesLayouts.php uses per-requ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 11.44.0-p4+tuxcare of laravel/framework. The target repository (laravel/framework v11.44.0-p4+tuxcare) is NOT AFFECTED by CVE-2024-52301. The vulnerability pattern has been removed by an upstream fix that was already present in Laravel v11.44.0 when TuxCare onboarded this version. The fix (commit 18b326d22d831e1fe05e737209e367e30796d5f3 by Taylor Otwell) adds a runningInConsole() check before using $_SERVER['argv'] for environment detection, preventing attackers from manipulating the application environment via crafted query strings when register_argc_argv is enabled.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target repository (laravel/framework v11.44.0-p4+tuxcare) is NOT AFFECTED by CVE-2024-52301. The vulnerability pattern has been removed by an upstream fix that was already present in Laravel v11.44.0 when TuxCare onboarded this version. The fix (commit 18b326d22d831e1fe05e737209e367e30796d5f3 by Taylor Otwell) adds a runningInConsole() check before using $_SERVER['argv'] for environment detection, preventing attackers from manipulating the application environment via crafted query strings when register_argc_argv is enabled." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-27T09:58:59.407356+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 11.44.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-27T09:58:59.407356+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 11.44.0-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is NOT affected by CVE-2026-102279. The vulnerability (DOM-based XSS via Tippy.js tooltips with allowHTML: true) was introduced in Laravel 12.x and never existed in version 11.x. The target uses Tippy.js v6.3.7 without setting allowHTML, relying on the library's safe default (allowHTML: false), which prevents HTML interpretation in tooltips. Although attacker-controlled input (H...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is NOT affected by CVE-2026-102279. The vulnerability (DOM-based XSS via Tippy.js tooltips with allowHTML: true) was introduced in Laravel 12.x and never existed in version 11.x. The target uses Tippy.js v6.3.7 without setting allowHTML, relying on the library's safe default (allowHTML: false), which prevents HTML interpretation in tooltips. Although attacker-controlled input (H..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 11.44.0-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource feature, which was introduced in Laravel 12.x (commit 2f30936319, first appearing in v12.45.0). The target version (11.44.0) predates the JsonApi feature entirely. The vulnerable code path - specifically the ResolvesJsonApiElements trait that processes relationship include parameters and c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource feature, which was introduced in Laravel 12.x (commit 2f30936319, first appearing in v12.45.0). The target version (11.44.0) predates the JsonApi feature entirely. The vulnerable code path - specifically the ResolvesJsonApiElements trait that processes relationship include parameters and c..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-27T09:58:59.407356+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 11.44.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:46:42.693041+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 11.44.0-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 11.44.0 is NOT affected by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input passed to limit/offset/skip/take functions when using SQL Server. The fix was authored by Taylor Otwell (upstream) in commit 09bf1457e9 (April 28, 2021) and was already present in the upstream Laravel 11.44.0 release before TuxCare onboarding. The fix adds integ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The target Laravel 11.44.0 is NOT affected by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input passed to limit/offset/skip/take functions when using SQL Server. The fix was authored by Taylor Otwell (upstream) in commit 09bf1457e9 (April 28, 2021) and was already present in the upstream Laravel 11.44.0 release before TuxCare onboarding. The fix adds integ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-27T09:58:59.407356+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 11.44.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:58:31.605031+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 11.44.0-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization RCE vulnerability). The security fix that disables cookie serialization was introduced by upstream Laravel in v5.6.30 (August 2018) and is fully present in the target version. The vulnerable pattern (automatic PHP object serialization/unserialization of encrypted cookies) has been removed. Cookie serialization is dis...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization RCE vulnerability). The security fix that disables cookie serialization was introduced by upstream Laravel in v5.6.30 (August 2018) and is fully present in the target version. The vulnerable pattern (automatic PHP object serialization/unserialization of encrypted cookies) has been removed. Cookie serialization is dis..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 11.44.0-p4+tuxcare of laravel/framework. not_affected \u2014 GHSA-7852-w36x-6mf6 is NOT present in laravel/framework 11.44.0-p4+tuxcare. The vulnerability was fixed upstream by Taylor Otwell on March 30, 2018 (commit 886d261df0), seven years before TuxCare onboarded this version in October 2025. The fix adds IV length validation in the Encrypter::validPayload() method at line 273, preventing manipulated encrypted payloads from causing silent decryption f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 GHSA-7852-w36x-6mf6 is NOT present in laravel/framework 11.44.0-p4+tuxcare. The vulnerability was fixed upstream by Taylor Otwell on March 30, 2018 (commit 886d261df0), seven years before TuxCare onboarded this version in October 2025. The fix adds IV length validation in the Encrypter::validPayload() method at line 273, preventing manipulated encrypted payloads from causing silent decryption f..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-27T09:58:59.407356+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp is fixed in version 11.44.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:15:38.790655+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 11.44.0-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v11.44.0 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability requires array values to bypass flattening before being added to query bindings. The target already contains the fix: all vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use flattenValue() or equivalent Arr::flatt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework v11.44.0 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability requires array values to bypass flattening before being added to query bindings. The target already contains the fix: all vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use flattenValue() or equivalent Arr::flatt..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:18:00.235397+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 11.44.0-p4+tuxcare of laravel/framework. The target Laravel framework v11.44.0 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (RCE via cookie session driver encryption oracle). The vulnerability was fixed by upstream Laravel in July 2020 (commits 5786aa4a38 and c9ce261a9f by Taylor Otwell), which changed cookie value prefixes from predictable SHA1 hashes to HMAC-based prefixes requiring the secret encryption key. The fix was already present in Laravel v11.44.0 when TuxCare onboarded it, as confirmed by the CookieValuePrefix class using hash_hmac('sha1', $cookieName.'v2', $key) at line 16. No vulnerable pattern (simple sha1 prefix) exists in the target code.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework v11.44.0 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (RCE via cookie session driver encryption oracle). The vulnerability was fixed by upstream Laravel in July 2020 (commits 5786aa4a38 and c9ce261a9f by Taylor Otwell), which changed cookie value prefixes from predictable SHA1 hashes to HMAC-based prefixes requiring the secret encryption key. The fix was already present in Laravel v11.44.0 when TuxCare onboarded it, as confirmed by the CookieValuePrefix class using hash_hmac('sha1', $cookieName.'v2', $key) at line 16. No vulnerable pattern (simple sha1 prefix) exists in the target code." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 11.44.0-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework 11.44.0 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in Laravel 6.20.26, 7.30.5, and 8.40.0 in April 2021. Version 11.44.0 already contains the complete upstream fix with comprehensive integer casting protections in both the Query Builder and SQL Server Grammar classes. The fix was present in the upstream v11.44....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Laravel Framework 11.44.0 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in Laravel 6.20.26, 7.30.5, and 8.40.0 in April 2021. Version 11.44.0 already contains the complete upstream fix with comprehensive integer casting protections in both the Query Builder and SQL Server Grammar classes. The fix was present in the upstream v11.44...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:41:49.287227+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 11.44.0-p4+tuxcare of laravel/framework. The target laravel/framework 11.44.0-p4+tuxcare is NOT AFFECTED by GHSA-x7p5-p2c9-phvg. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalar values. The upstream Laravel framework fixed this in January 2021 (commit 9d3752ca5f by Kane Cohen) by introducing the scalarValue/flattenValue helper method that normalizes array inputs to scalar values by extracting the first element using head(Arr::flatten()). This fix was already present in the upstream Laravel 11.44.0 release that TuxCare onboarded via snapshot commit c9a73e2b77 on 2025-10-10. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the flattenValue defense in the target code at HEAD (9e3c1203). The fix is attributed to upstream, not TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "The target laravel/framework 11.44.0-p4+tuxcare is NOT AFFECTED by GHSA-x7p5-p2c9-phvg. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalar values. The upstream Laravel framework fixed this in January 2021 (commit 9d3752ca5f by Kane Cohen) by introducing the scalarValue/flattenValue helper method that normalizes array inputs to scalar values by extracting the first element using head(Arr::flatten()). This fix was already present in the upstream Laravel 11.44.0 release that TuxCare onboarded via snapshot commit c9a73e2b77 on 2025-10-10. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the flattenValue defense in the target code at HEAD (9e3c1203). The fix is attributed to upstream, not TuxCare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/enshrined/svg-sanitize@0.16.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/enshrined/svg-sanitize@0.16.0-p1+tuxcare" } } ], "timestamp": "2026-11-10T14:33:00.057870+00:00", "status_notes": "Vulnerability CVE-2019-10772 affects version 0.16.0-p1+tuxcare of enshrined/svg-sanitize.", "vulnerability": { "name": "CVE-2019-10772" }, "action_statement": "Vulnerability CVE-2019-10772 affects version 0.16.0-p1+tuxcare of enshrined/svg-sanitize." }, { "status": "affected", "products": [ { "@id": "pkg:composer/enshrined/svg-sanitize@0.16.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/enshrined/svg-sanitize@0.16.0-p1+tuxcare" } } ], "timestamp": "2026-11-10T14:33:00.057870+00:00", "status_notes": "Vulnerability CVE-2019-18857 affects version 0.16.0-p1+tuxcare of enshrined/svg-sanitize.", "vulnerability": { "name": "CVE-2019-18857" }, "action_statement": "Vulnerability CVE-2019-18857 affects version 0.16.0-p1+tuxcare of enshrined/svg-sanitize." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/enshrined/svg-sanitize@0.16.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/enshrined/svg-sanitize@0.16.0-p1+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2022-23638 does not affect version 0.16.0-p1+tuxcare of enshrined/svg-sanitize. not_affected \u2014 Target version 0.16.0-p2+tuxcare is NOT AFFECTED by CVE-2022-23638. The vulnerability (HTML elements in CDATA sections/comments/processing instructions causing XSS when SVG is embedded in HTML) was fixed in upstream version 0.15.0. The target's code contains comprehensive defenses: (1) CDATA sections are purified with HTMLPurifier and converted to safe text nodes, (2) HTML comments and processi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-23638" }, "impact_statement": "not_affected \u2014 Target version 0.16.0-p2+tuxcare is NOT AFFECTED by CVE-2022-23638. The vulnerability (HTML elements in CDATA sections/comments/processing instructions causing XSS when SVG is embedded in HTML) was fixed in upstream version 0.15.0. The target's code contains comprehensive defenses: (1) CDATA sections are purified with HTMLPurifier and converted to safe text nodes, (2) HTML comments and processi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/enshrined/svg-sanitize@0.16.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/enshrined/svg-sanitize@0.16.0-p1+tuxcare" } } ], "timestamp": "2026-11-10T14:33:00.057870+00:00", "status_notes": "Vulnerability CVE-2023-28426 is a false positive for enshrined/svg-sanitize 0.16.0-p1+tuxcare.", "vulnerability": { "name": "CVE-2023-28426" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/enshrined/svg-sanitize@0.16.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/enshrined/svg-sanitize@0.16.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55166 is fixed in version 0.16.0-p1+tuxcare of enshrined/svg-sanitize.", "vulnerability": { "name": "CVE-2025-55166" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/enshrined/svg-sanitize@0.16.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/enshrined/svg-sanitize@0.16.0-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:39:00.058839+00:00", "status_notes": "Vulnerability CVE-2026-107379 affects version 0.16.0-p1+tuxcare of enshrined/svg-sanitize, and is fixed in 0.16.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-107379" }, "action_statement": "Vulnerability CVE-2026-107379 affects version 0.16.0-p1+tuxcare of enshrined/svg-sanitize, and is fixed in 0.16.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/enshrined/svg-sanitize@0.16.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/enshrined/svg-sanitize@0.16.0-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:39:00.058839+00:00", "status_notes": "Vulnerability CVE-2026-107380 affects version 0.16.0-p1+tuxcare of enshrined/svg-sanitize, and is fixed in 0.16.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-107380" }, "action_statement": "Vulnerability CVE-2026-107380 affects version 0.16.0-p1+tuxcare of enshrined/svg-sanitize, and is fixed in 0.16.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/enshrined/svg-sanitize@0.16.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/enshrined/svg-sanitize@0.16.0-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:39:00.058839+00:00", "status_notes": "Vulnerability CVE-2026-107381 affects version 0.16.0-p1+tuxcare of enshrined/svg-sanitize, and is fixed in 0.16.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-107381" }, "action_statement": "Vulnerability CVE-2026-107381 affects version 0.16.0-p1+tuxcare of enshrined/svg-sanitize, and is fixed in 0.16.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/enshrined/svg-sanitize@0.16.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/enshrined/svg-sanitize@0.16.0-p2+tuxcare" } } ], "timestamp": "2026-11-10T14:33:00.057870+00:00", "status_notes": "Vulnerability CVE-2019-10772 affects version 0.16.0-p2+tuxcare of enshrined/svg-sanitize.", "vulnerability": { "name": "CVE-2019-10772" }, "action_statement": "Vulnerability CVE-2019-10772 affects version 0.16.0-p2+tuxcare of enshrined/svg-sanitize." }, { "status": "affected", "products": [ { "@id": "pkg:composer/enshrined/svg-sanitize@0.16.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/enshrined/svg-sanitize@0.16.0-p2+tuxcare" } } ], "timestamp": "2026-11-10T14:33:00.057870+00:00", "status_notes": "Vulnerability CVE-2019-18857 affects version 0.16.0-p2+tuxcare of enshrined/svg-sanitize.", "vulnerability": { "name": "CVE-2019-18857" }, "action_statement": "Vulnerability CVE-2019-18857 affects version 0.16.0-p2+tuxcare of enshrined/svg-sanitize." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/enshrined/svg-sanitize@0.16.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/enshrined/svg-sanitize@0.16.0-p2+tuxcare" } } ], "timestamp": "2026-10-29T08:10:38.151653+00:00", "status_notes": "Vulnerability CVE-2022-23638 does not affect version 0.16.0-p2+tuxcare of enshrined/svg-sanitize. not_affected \u2014 Target version 0.16.0-p2+tuxcare is NOT AFFECTED by CVE-2022-23638. The vulnerability (HTML elements in CDATA sections/comments/processing instructions causing XSS when SVG is embedded in HTML) was fixed in upstream version 0.15.0. The target's code contains comprehensive defenses: (1) CDATA sections are purified with HTMLPurifier and converted to safe text nodes, (2) HTML comments and processi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-23638" }, "impact_statement": "not_affected \u2014 Target version 0.16.0-p2+tuxcare is NOT AFFECTED by CVE-2022-23638. The vulnerability (HTML elements in CDATA sections/comments/processing instructions causing XSS when SVG is embedded in HTML) was fixed in upstream version 0.15.0. The target's code contains comprehensive defenses: (1) CDATA sections are purified with HTMLPurifier and converted to safe text nodes, (2) HTML comments and processi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/enshrined/svg-sanitize@0.16.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/enshrined/svg-sanitize@0.16.0-p2+tuxcare" } } ], "timestamp": "2026-11-10T14:33:00.057870+00:00", "status_notes": "Vulnerability CVE-2023-28426 is a false positive for enshrined/svg-sanitize 0.16.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2023-28426" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/enshrined/svg-sanitize@0.16.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/enshrined/svg-sanitize@0.16.0-p2+tuxcare" } } ], "timestamp": "2026-10-14T14:39:00.058839+00:00", "status_notes": "Vulnerability CVE-2025-55166 is fixed in version 0.16.0-p2+tuxcare of enshrined/svg-sanitize.", "vulnerability": { "name": "CVE-2025-55166" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/enshrined/svg-sanitize@0.16.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/enshrined/svg-sanitize@0.16.0-p2+tuxcare" } } ], "timestamp": "2026-10-14T14:39:00.058839+00:00", "status_notes": "Vulnerability CVE-2026-107379 is fixed in version 0.16.0-p2+tuxcare of enshrined/svg-sanitize.", "vulnerability": { "name": "CVE-2026-107379" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/enshrined/svg-sanitize@0.16.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/enshrined/svg-sanitize@0.16.0-p2+tuxcare" } } ], "timestamp": "2026-10-14T14:39:00.058839+00:00", "status_notes": "Vulnerability CVE-2026-107380 is fixed in version 0.16.0-p2+tuxcare of enshrined/svg-sanitize.", "vulnerability": { "name": "CVE-2026-107380" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/enshrined/svg-sanitize@0.16.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/enshrined/svg-sanitize@0.16.0-p2+tuxcare" } } ], "timestamp": "2026-10-14T14:39:00.058839+00:00", "status_notes": "Vulnerability CVE-2026-107381 is fixed in version 0.16.0-p2+tuxcare of enshrined/svg-sanitize.", "vulnerability": { "name": "CVE-2026-107381" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/firebase/php-jwt@6.11.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/firebase/php-jwt@6.11.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10963 does not affect version 6.11.1-p1+tuxcare of firebase/php-jwt. already_fixed \u2014 The target repository firebase/php-jwt version 6.11.1 has already been fixed for AIKIDO-2025-10963 (Inadequate Encryption Strength). TuxCare applied an identical backport in commit 9d756cb (PHPELSCVE-211) that implements the same key length validation as the upstream patch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "AIKIDO-2025-10963" }, "impact_statement": "already_fixed \u2014 The target repository firebase/php-jwt version 6.11.1 has already been fixed for AIKIDO-2025-10963 (Inadequate Encryption Strength). TuxCare applied an identical backport in commit 9d756cb (PHPELSCVE-211) that implements the same key length validation as the upstream patch." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/firebase/php-jwt@6.11.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/firebase/php-jwt@6.11.1-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2021-46743 does not affect version 6.11.1-p1+tuxcare of firebase/php-jwt. Target version 6.11.1 is not affected by CVE-2021-46743. The vulnerability (algorithm-confusion allowing JWT forgery via kid header) was fixed in upstream version 6.0.0 (released 2022-01-24) through the introduction of the Key object that binds key material to its intended algorithm. The target already contains this fix as it was present in the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-46743" }, "impact_statement": "Target version 6.11.1 is not affected by CVE-2021-46743. The vulnerability (algorithm-confusion allowing JWT forgery via kid header) was fixed in upstream version 6.0.0 (released 2022-01-24) through the introduction of the Key object that binds key material to its intended algorithm. The target already contains this fix as it was present in the upstream release that TuxCare onboarded." }, { "status": "affected", "products": [ { "@id": "pkg:composer/firebase/php-jwt@6.11.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/firebase/php-jwt@6.11.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-45769 affects version 6.11.1-p1+tuxcare of firebase/php-jwt, and is fixed in 6.11.1-p2+tuxcare.", "vulnerability": { "name": "CVE-2025-45769" }, "action_statement": "Vulnerability CVE-2025-45769 affects version 6.11.1-p1+tuxcare of firebase/php-jwt, and is fixed in 6.11.1-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/firebase/php-jwt@6.11.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/firebase/php-jwt@6.11.1-p1+tuxcare" } } ], "timestamp": "2026-11-10T14:33:00.057870+00:00", "status_notes": "Vulnerability GHSA-h533-5v22-8vcp affects version 6.11.1-p1+tuxcare of firebase/php-jwt.", "vulnerability": { "name": "GHSA-h533-5v22-8vcp" }, "action_statement": "Vulnerability GHSA-h533-5v22-8vcp affects version 6.11.1-p1+tuxcare of firebase/php-jwt." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2018-14773 does not affect version 4.4.49-p2+tuxcare of symfony/http-foundation. not_affected \u2014 CVE-2018-14773 is NOT present in symfony/http-foundation v4.4.49-p3+tuxcare. The vulnerability involved legacy IIS headers (X-Original-URL and X-Rewrite-URL) that could override the request URI, enabling web cache poisoning. The fix was applied by upstream Symfony in version 4.1.3, which removed processing of these headers from the prepareRequestUri() method. Since the target version 4.4.49 is ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14773" }, "impact_statement": "not_affected \u2014 CVE-2018-14773 is NOT present in symfony/http-foundation v4.4.49-p3+tuxcare. The vulnerability involved legacy IIS headers (X-Original-URL and X-Rewrite-URL) that could override the request URI, enabling web cache poisoning. The fix was applied by upstream Symfony in version 4.1.3, which removed processing of these headers from the prepareRequestUri() method. Since the target version 4.4.49 is ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:19:23.616509+00:00", "status_notes": "Vulnerability CVE-2019-10913 does not affect version 4.4.49-p2+tuxcare of symfony/http-foundation. CVE-2019-10913 is NOT present in the target. The vulnerability involves unvalidated HTTP method override values that could enable SQL injection or XSS through arbitrary string injection. The fix (validation of method override strings via whitelist + regex check) was already present in the upstream Symfony v4.4.49 release that TuxCare onboarded. The target code at Request.php lines 1267-1273 contains the complete fix: whitelist validation for standard HTTP methods and regex validation rejecting any custom method with non-A-Z characters. This is an upstream fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10913" }, "impact_statement": "CVE-2019-10913 is NOT present in the target. The vulnerability involves unvalidated HTTP method override values that could enable SQL injection or XSS through arbitrary string injection. The fix (validation of method override strings via whitelist + regex check) was already present in the upstream Symfony v4.4.49 release that TuxCare onboarded. The target code at Request.php lines 1267-1273 contains the complete fix: whitelist validation for standard HTTP methods and regex validation rejecting any custom method with non-A-Z characters. This is an upstream fix, not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:19:00.032324+00:00", "status_notes": "Vulnerability CVE-2019-18888 does not affect version 4.4.49-p2+tuxcare of symfony/http-foundation. The target repository (symfony/http-foundation v4.4.49-p3+tuxcare) is NOT AFFECTED by CVE-2019-18888. The vulnerability pattern (unescaped dash-prefixed filenames passed to the file command) is not present in the target because the upstream vendor fix was already included in Symfony v4.4.49 when TuxCare onboarded it. The fix (adding `--` separator and prepending `./` to dash-prefixed paths) is present in File/MimeType/FileBinaryMimeTypeGuesser.php at lines 39 and 88. This fix was authored by Nicolas Grekas (upstream Symfony maintainer) in April 2019 and was part of the upstream release, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-18888" }, "impact_statement": "The target repository (symfony/http-foundation v4.4.49-p3+tuxcare) is NOT AFFECTED by CVE-2019-18888. The vulnerability pattern (unescaped dash-prefixed filenames passed to the file command) is not present in the target because the upstream vendor fix was already included in Symfony v4.4.49 when TuxCare onboarded it. The fix (adding `--` separator and prepending `./` to dash-prefixed paths) is present in File/MimeType/FileBinaryMimeTypeGuesser.php at lines 39 and 88. This fix was authored by Nicolas Grekas (upstream Symfony maintainer) in April 2019 and was part of the upstream release, not a TuxCare backport." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-50345 is fixed in version 4.4.49-p2+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2024-50345" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64500 is fixed in version 4.4.49-p2+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2025-64500" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare" } } ], "timestamp": "2026-10-20T20:45:05.425663+00:00", "status_notes": "Vulnerability CVE-2026-108082 affects version 4.4.49-p2+tuxcare of symfony/http-foundation, and is fixed in 4.4.49-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-108082" }, "action_statement": "Vulnerability CVE-2026-108082 affects version 4.4.49-p2+tuxcare of symfony/http-foundation, and is fixed in 4.4.49-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare" } } ], "timestamp": "2026-11-10T15:36:00.072033+00:00", "status_notes": "Vulnerability CVE-2026-118514 affects version 4.4.49-p2+tuxcare of symfony/http-foundation, and is fixed in 4.4.49-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-118514" }, "action_statement": "Vulnerability CVE-2026-118514 affects version 4.4.49-p2+tuxcare of symfony/http-foundation, and is fixed in 4.4.49-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p2+tuxcare" } } ], "timestamp": "2026-10-29T01:02:19.900071+00:00", "status_notes": "Vulnerability CVE-2026-48736 does not affect version 4.4.49-p2+tuxcare of symfony/http-foundation. not_affected \u2014 Target version v4.4.49 is NOT AFFECTED. The vulnerable code pattern (IpUtils::PRIVATE_SUBNETS constant and IpUtils::isPrivateIp method with incomplete IPv6 transition form coverage) does not exist in this version. These features were introduced in later versions: isPrivateIp in v6.3.0 (March 2023) and PRIVATE_SUBNETS in v7.2.0 (September 2024). The CVE affects versions 5.4+ where NoPrivateNetwo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48736" }, "impact_statement": "not_affected \u2014 Target version v4.4.49 is NOT AFFECTED. The vulnerable code pattern (IpUtils::PRIVATE_SUBNETS constant and IpUtils::isPrivateIp method with incomplete IPv6 transition form coverage) does not exist in this version. These features were introduced in later versions: isPrivateIp in v6.3.0 (March 2023) and PRIVATE_SUBNETS in v7.2.0 (September 2024). The CVE affects versions 5.4+ where NoPrivateNetwo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v7.4.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v7.4.8-p2+tuxcare" } } ], "timestamp": "2026-11-10T15:33:43.632921+00:00", "status_notes": "Vulnerability CVE-2018-14773 does not affect version v7.4.8-p2+tuxcare of symfony/http-foundation. not_affected \u2014 CVE-2018-14773 is not present in symfony/http-foundation v7.4.8-p1+tuxcare. The vulnerable code pattern that trusted X-Original-URL and X-Rewrite-URL headers was removed by upstream Symfony in 2018. The fix (authored by Nicolas Grekas) was already included in the upstream Symfony v7.4.8 release that TuxCare onboarded. The target's prepareRequestUri() method does not check for these headers, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14773" }, "impact_statement": "not_affected \u2014 CVE-2018-14773 is not present in symfony/http-foundation v7.4.8-p1+tuxcare. The vulnerable code pattern that trusted X-Original-URL and X-Rewrite-URL headers was removed by upstream Symfony in 2018. The fix (authored by Nicolas Grekas) was already included in the upstream Symfony v7.4.8 release that TuxCare onboarded. The target's prepareRequestUri() method does not check for these headers, pre..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v7.4.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v7.4.8-p2+tuxcare" } } ], "timestamp": "2026-11-10T15:33:43.632921+00:00", "status_notes": "Vulnerability CVE-2019-10913 does not affect version v7.4.8-p2+tuxcare of symfony/http-foundation. The target is NOT vulnerable to CVE-2019-10913. The vulnerable code pattern (unvalidated HTTP method override strings) is not present in symfony/http-foundation v7.4.8-p1+tuxcare. The upstream vendor (Symfony) fixed this CVE before releasing v7.4.8, which TuxCare onboarded via snapshot commit b882216d. The current code at Request.php:1280-1282 contains robust validation that rejects any method override string containing non-uppercase-letter characters, effectively blocking SQL injection and XSS payloads that could exploit unvalidated method strings.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10913" }, "impact_statement": "The target is NOT vulnerable to CVE-2019-10913. The vulnerable code pattern (unvalidated HTTP method override strings) is not present in symfony/http-foundation v7.4.8-p1+tuxcare. The upstream vendor (Symfony) fixed this CVE before releasing v7.4.8, which TuxCare onboarded via snapshot commit b882216d. The current code at Request.php:1280-1282 contains robust validation that rejects any method override string containing non-uppercase-letter characters, effectively blocking SQL injection and XSS payloads that could exploit unvalidated method strings." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v7.4.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v7.4.8-p2+tuxcare" } } ], "timestamp": "2026-11-10T15:33:43.632921+00:00", "status_notes": "Vulnerability CVE-2019-18888 does not affect version v7.4.8-p2+tuxcare of symfony/http-foundation. CVE-2019-18888 affects the FileBinaryMimeTypeGuesser class which executes the `file` command with unsanitized file paths. In Symfony versions 2.8-4.2, this class was part of http-foundation. However, starting with Symfony 4.3, all MIME type detection was migrated to the separate symfony/mime component, and in Symfony 5.0 the entire MimeType namespace was removed from http-foundation. The target (v7.4.8) does not contain any of the vulnerable code - File::getMimeType() delegates entirely to Symfony\\Component\\Mime\\MimeTypes, which is only listed as a dev-dependency (not vendored). The vulnerable code path (file path \u2192 FileBinaryMimeTypeGuesser \u2192 passthru/file command) does not exist in this repository. Any vulnerability in symfony/mime is tracked separately against that component.", "vulnerability": { "name": "CVE-2019-18888" }, "impact_statement": "CVE-2019-18888 affects the FileBinaryMimeTypeGuesser class which executes the `file` command with unsanitized file paths. In Symfony versions 2.8-4.2, this class was part of http-foundation. However, starting with Symfony 4.3, all MIME type detection was migrated to the separate symfony/mime component, and in Symfony 5.0 the entire MimeType namespace was removed from http-foundation. The target (v7.4.8) does not contain any of the vulnerable code - File::getMimeType() delegates entirely to Symfony\\Component\\Mime\\MimeTypes, which is only listed as a dev-dependency (not vendored). The vulnerable code path (file path \u2192 FileBinaryMimeTypeGuesser \u2192 passthru/file command) does not exist in this repository. Any vulnerability in symfony/mime is tracked separately against that component." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v7.4.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v7.4.8-p2+tuxcare" } } ], "timestamp": "2026-11-10T15:33:43.632921+00:00", "status_notes": "Vulnerability CVE-2024-50345 does not affect version v7.4.8-p2+tuxcare of symfony/http-foundation. already_fixed \u2014 The target repository (symfony/http-foundation v7.4.8) already contains the fix for CVE-2024-50345. All four validation checks from the vendor patch are present in Request::create() at lines 354-374, rejecting URIs with invalid characters that could cause parsing discrepancies between PHP and browsers.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-50345" }, "impact_statement": "already_fixed \u2014 The target repository (symfony/http-foundation v7.4.8) already contains the fix for CVE-2024-50345. All four validation checks from the vendor patch are present in Request::create() at lines 354-374, rejecting URIs with invalid characters that could cause parsing discrepancies between PHP and browsers." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v7.4.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v7.4.8-p2+tuxcare" } } ], "timestamp": "2026-11-10T15:33:43.632921+00:00", "status_notes": "Vulnerability CVE-2025-64500 does not affect version v7.4.8-p2+tuxcare of symfony/http-foundation. already_fixed \u2014 CVE-2025-64500: The target repository (symfony/http-foundation v7.4.8) already contains the fix for the PATH_INFO leading slash vulnerability. The preparePathInfo() method at Request.php:2038-2039 includes the critical check that ensures all path values start with '/' by detecting when pathInfo[0] is not '/' and prepending a slash. This is the same defense mechanism as the upstream patch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-64500" }, "impact_statement": "already_fixed \u2014 CVE-2025-64500: The target repository (symfony/http-foundation v7.4.8) already contains the fix for the PATH_INFO leading slash vulnerability. The preparePathInfo() method at Request.php:2038-2039 includes the critical check that ensures all path values start with '/' by detecting when pathInfo[0] is not '/' and prepending a slash. This is the same defense mechanism as the upstream patch." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v7.4.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v7.4.8-p2+tuxcare" } } ], "timestamp": "2026-11-10T15:33:43.632921+00:00", "status_notes": "Vulnerability CVE-2026-108082 is fixed in version v7.4.8-p2+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2026-108082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v7.4.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v7.4.8-p2+tuxcare" } } ], "timestamp": "2026-11-10T15:34:00.103182+00:00", "status_notes": "Vulnerability CVE-2026-118514 is fixed in version v7.4.8-p2+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2026-118514" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v7.4.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v7.4.8-p2+tuxcare" } } ], "timestamp": "2026-11-10T15:33:43.632921+00:00", "status_notes": "Vulnerability CVE-2026-48736 does not affect version v7.4.8-p2+tuxcare of symfony/http-foundation. not_affected \u2014 The target repository (symfony/http-foundation v7.4.8) is a library that exports IpUtils::isPrivateIp() and PRIVATE_SUBNETS, which do contain the vulnerability pattern described in CVE-2026-48736 (incomplete IPv6 transition prefix coverage). However, the library itself does not execute any code path that processes user-supplied URLs or makes HTTP requests to private networks. The vulnerable cod...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-48736" }, "impact_statement": "not_affected \u2014 The target repository (symfony/http-foundation v7.4.8) is a library that exports IpUtils::isPrivateIp() and PRIVATE_SUBNETS, which do contain the vulnerability pattern described in CVE-2026-48736 (incomplete IPv6 transition prefix coverage). However, the library itself does not execute any code path that processes user-supplied URLs or makes HTTP requests to private networks. The vulnerable cod..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/firebase/php-jwt@6.11.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/firebase/php-jwt@6.11.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10963 does not affect version 6.11.1-p2+tuxcare of firebase/php-jwt. already_fixed \u2014 The target repository firebase/php-jwt version 6.11.1 has already been fixed for AIKIDO-2025-10963 (Inadequate Encryption Strength). TuxCare applied an identical backport in commit 9d756cb (PHPELSCVE-211) that implements the same key length validation as the upstream patch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "AIKIDO-2025-10963" }, "impact_statement": "already_fixed \u2014 The target repository firebase/php-jwt version 6.11.1 has already been fixed for AIKIDO-2025-10963 (Inadequate Encryption Strength). TuxCare applied an identical backport in commit 9d756cb (PHPELSCVE-211) that implements the same key length validation as the upstream patch." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/firebase/php-jwt@6.11.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/firebase/php-jwt@6.11.1-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2021-46743 does not affect version 6.11.1-p2+tuxcare of firebase/php-jwt. Target version 6.11.1 is not affected by CVE-2021-46743. The vulnerability (algorithm-confusion allowing JWT forgery via kid header) was fixed in upstream version 6.0.0 (released 2022-01-24) through the introduction of the Key object that binds key material to its intended algorithm. The target already contains this fix as it was present in the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-46743" }, "impact_statement": "Target version 6.11.1 is not affected by CVE-2021-46743. The vulnerability (algorithm-confusion allowing JWT forgery via kid header) was fixed in upstream version 6.0.0 (released 2022-01-24) through the introduction of the Key object that binds key material to its intended algorithm. The target already contains this fix as it was present in the upstream release that TuxCare onboarded." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/firebase/php-jwt@6.11.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/firebase/php-jwt@6.11.1-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-45769 is fixed in version 6.11.1-p2+tuxcare of firebase/php-jwt.", "vulnerability": { "name": "CVE-2025-45769" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/firebase/php-jwt@6.11.1-p2+tuxcare", "identifiers": { "purl": "pkg:composer/firebase/php-jwt@6.11.1-p2+tuxcare" } } ], "timestamp": "2026-11-10T14:33:00.057870+00:00", "status_notes": "Vulnerability GHSA-h533-5v22-8vcp affects version 6.11.1-p2+tuxcare of firebase/php-jwt.", "vulnerability": { "name": "GHSA-h533-5v22-8vcp" }, "action_statement": "Vulnerability GHSA-h533-5v22-8vcp affects version 6.11.1-p2+tuxcare of firebase/php-jwt." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/routing@v7.4.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v7.4.9-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:42:54.752183+00:00", "status_notes": "Vulnerability CVE-2026-118516 affects version v7.4.9-p1+tuxcare of symfony/routing, and is fixed in v7.4.9-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-118516" }, "action_statement": "Vulnerability CVE-2026-118516 affects version v7.4.9-p1+tuxcare of symfony/routing, and is fixed in v7.4.9-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v7.4.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v7.4.9-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45065 is fixed in version v7.4.9-p1+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-45065" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v7.4.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v7.4.9-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48784 is fixed in version v7.4.9-p1+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-48784" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-client@v6.0.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-client@v6.0.20-p2+tuxcare" } } ], "timestamp": "2026-11-10T15:30:43.011411+00:00", "status_notes": "Vulnerability CVE-2024-50342 is fixed in version v6.0.20-p2+tuxcare of symfony/http-client.", "vulnerability": { "name": "CVE-2024-50342" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-client@v6.0.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-client@v6.0.20-p2+tuxcare" } } ], "timestamp": "2026-11-10T15:30:43.011411+00:00", "status_notes": "Vulnerability CVE-2026-118517 affects version v6.0.20-p2+tuxcare of symfony/http-client.", "vulnerability": { "name": "CVE-2026-118517" }, "action_statement": "Vulnerability CVE-2026-118517 affects version v6.0.20-p2+tuxcare of symfony/http-client." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-client@v6.0.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-client@v6.0.20-p2+tuxcare" } } ], "timestamp": "2026-11-10T15:31:00.060957+00:00", "status_notes": "Vulnerability CVE-2026-121971 is fixed in version v6.0.20-p2+tuxcare of symfony/http-client.", "vulnerability": { "name": "CVE-2026-121971" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-client@v6.0.20-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-client@v6.0.20-p2+tuxcare" } } ], "timestamp": "2026-11-10T15:31:00.060957+00:00", "status_notes": "Vulnerability CVE-2026-123119 is fixed in version v6.0.20-p2+tuxcare of symfony/http-client.", "vulnerability": { "name": "CVE-2026-123119" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 11.44.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is not affected by CVE-2017-14775. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database-level token comparison with constant-time hash_equals() comparison. The target version 11.44.0 already contains this fix as it was present in the upstream release when TuxCare onboarded it. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() fo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is not affected by CVE-2017-14775. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database-level token comparison with constant-time hash_equals() comparison. The target version 11.44.0 already contains this fix as it was present in the upstream release when TuxCare onboarded it. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() fo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 11.44.0-p3+tuxcare of laravel/framework. CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, allowing RCE via PHP object injection when untrusted X-XSRF-TOKEN values are unserialized. The target (Laravel 11.44.0-p4+tuxcare) is NOT AFFECTED because upstream Laravel fixed this vulnerability in August 2018 (commit c0eb9073eb by Taylor Otwell), long before version 11.44.0 was released. The fix prevents automatic PHP unserialization of decrypted cookies/headers by passing `false` to the decrypt method's serialize parameter, blocking the RCE attack chain. The vulnerable code pattern (automatic unserialization) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, allowing RCE via PHP object injection when untrusted X-XSRF-TOKEN values are unserialized. The target (Laravel 11.44.0-p4+tuxcare) is NOT AFFECTED because upstream Laravel fixed this vulnerability in August 2018 (commit c0eb9073eb by Taylor Otwell), long before version 11.44.0 was released. The fix prevents automatic PHP unserialization of decrypted cookies/headers by passing `false` to the decrypt method's serialize parameter, blocking the RCE attack chain. The vulnerable code pattern (automatic unserialization) is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:54:00.052758+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 11.44.0-p3+tuxcare of laravel/framework, and is fixed in 11.44.0-p5+tuxcare.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 11.44.0-p3+tuxcare of laravel/framework, and is fixed in 11.44.0-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 11.44.0-p3+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework versions before 5.8.17 due to OS command injection in the link() function of Filesystem.php. The vulnerability allowed attackers to inject arbitrary shell commands through unescaped $target and $link parameters passed to exec(). The target version 11.44.0 is NOT affected because the upstream fix (commit 44c3feb604) was already included in the upstream release when TuxCare onboarded it. The fix wraps both parameters with escapeshellarg() to prevent shell metacharacter injection. This was an upstream fix by Taylor Otwell applied in v5.8.17 (May 2019), well before version 11.44.0.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework versions before 5.8.17 due to OS command injection in the link() function of Filesystem.php. The vulnerability allowed attackers to inject arbitrary shell commands through unescaped $target and $link parameters passed to exec(). The target version 11.44.0 is NOT affected because the upstream fix (commit 44c3feb604) was already included in the upstream release when TuxCare onboarded it. The fix wraps both parameters with escapeshellarg() to prevent shell metacharacter injection. This was an upstream fix by Taylor Otwell applied in v5.8.17 (May 2019), well before version 11.44.0." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:41:49.287227+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 11.44.0-p3+tuxcare of laravel/framework. The target Laravel Framework 11.44.0-p4+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability involved a mass assignment bypass where attackers could set protected (guarded) model attributes by using fabricated keys with JSON path notation. The fix (commit 897d107 by Taylor Otwell, 2020-08-07) adds the isGuardableColumn() method that validates attribute keys against actual database columns, rejecting keys that don't correspond to real columns. This fix was already present in the upstream Laravel 11.44.0 release that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix commit predates the first TuxCare snapshot commit (c9a73e2b77b).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel Framework 11.44.0-p4+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability involved a mass assignment bypass where attackers could set protected (guarded) model attributes by using fabricated keys with JSON path notation. The fix (commit 897d107 by Taylor Otwell, 2020-08-07) adds the isGuardableColumn() method that validates attribute keys against actual database columns, rejecting keys that don't correspond to real columns. This fix was already present in the upstream Laravel 11.44.0 release that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix commit predates the first TuxCare snapshot commit (c9a73e2b77b)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 11.44.0-p3+tuxcare of laravel/framework. Laravel 11.44.0 is not affected by CVE-2021-21263. The vulnerability (query binding exploitation via unchecked array inputs) was fixed in the upstream Laravel release through commit d0954f4574 by Taylor Otwell on Jan 13, 2021. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() helper or array_slice() to limit bindings. The fix was already present in upstream Laravel 11.44.0 when TuxCare onboarded it via snapshot commit c9a73e2b77.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "Laravel 11.44.0 is not affected by CVE-2021-21263. The vulnerability (query binding exploitation via unchecked array inputs) was fixed in the upstream Laravel release through commit d0954f4574 by Taylor Otwell on Jan 13, 2021. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() helper or array_slice() to limit bindings. The fix was already present in upstream Laravel 11.44.0 when TuxCare onboarded it via snapshot commit c9a73e2b77." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:25:11.687376+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 11.44.0-p3+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 (XSS via predictable Blade parent placeholders) is not present in Laravel 11.44.0. The vulnerability pattern (deterministic sha1($section) hashes allowing placeholder prediction) was fixed by upstream Laravel in December 2021. The fix was already included in the v11.44.0 release before TuxCare onboarded it. Both critical files contain the defense: ManagesLayouts.php uses per-requ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 (XSS via predictable Blade parent placeholders) is not present in Laravel 11.44.0. The vulnerability pattern (deterministic sha1($section) hashes allowing placeholder prediction) was fixed by upstream Laravel in December 2021. The fix was already included in the v11.44.0 release before TuxCare onboarded it. Both critical files contain the defense: ManagesLayouts.php uses per-requ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 11.44.0-p3+tuxcare of laravel/framework. The target repository (laravel/framework v11.44.0-p4+tuxcare) is NOT AFFECTED by CVE-2024-52301. The vulnerability pattern has been removed by an upstream fix that was already present in Laravel v11.44.0 when TuxCare onboarded this version. The fix (commit 18b326d22d831e1fe05e737209e367e30796d5f3 by Taylor Otwell) adds a runningInConsole() check before using $_SERVER['argv'] for environment detection, preventing attackers from manipulating the application environment via crafted query strings when register_argc_argv is enabled.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target repository (laravel/framework v11.44.0-p4+tuxcare) is NOT AFFECTED by CVE-2024-52301. The vulnerability pattern has been removed by an upstream fix that was already present in Laravel v11.44.0 when TuxCare onboarded this version. The fix (commit 18b326d22d831e1fe05e737209e367e30796d5f3 by Taylor Otwell) adds a runningInConsole() check before using $_SERVER['argv'] for environment detection, preventing attackers from manipulating the application environment via crafted query strings when register_argc_argv is enabled." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-13T11:50:05.169855+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 11.44.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-13T11:50:05.169855+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 11.44.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is NOT affected by CVE-2026-102279. The vulnerability (DOM-based XSS via Tippy.js tooltips with allowHTML: true) was introduced in Laravel 12.x and never existed in version 11.x. The target uses Tippy.js v6.3.7 without setting allowHTML, relying on the library's safe default (allowHTML: false), which prevents HTML interpretation in tooltips. Although attacker-controlled input (H...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is NOT affected by CVE-2026-102279. The vulnerability (DOM-based XSS via Tippy.js tooltips with allowHTML: true) was introduced in Laravel 12.x and never existed in version 11.x. The target uses Tippy.js v6.3.7 without setting allowHTML, relying on the library's safe default (allowHTML: false), which prevents HTML interpretation in tooltips. Although attacker-controlled input (H..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 11.44.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource feature, which was introduced in Laravel 12.x (commit 2f30936319, first appearing in v12.45.0). The target version (11.44.0) predates the JsonApi feature entirely. The vulnerable code path - specifically the ResolvesJsonApiElements trait that processes relationship include parameters and c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource feature, which was introduced in Laravel 12.x (commit 2f30936319, first appearing in v12.45.0). The target version (11.44.0) predates the JsonApi feature entirely. The vulnerable code path - specifically the ResolvesJsonApiElements trait that processes relationship include parameters and c..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-27T09:58:59.407356+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 11.44.0-p3+tuxcare of laravel/framework, and is fixed in 11.44.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 11.44.0-p3+tuxcare of laravel/framework, and is fixed in 11.44.0-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:46:42.693041+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 11.44.0-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 11.44.0 is NOT affected by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input passed to limit/offset/skip/take functions when using SQL Server. The fix was authored by Taylor Otwell (upstream) in commit 09bf1457e9 (April 28, 2021) and was already present in the upstream Laravel 11.44.0 release before TuxCare onboarding. The fix adds integ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The target Laravel 11.44.0 is NOT affected by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input passed to limit/offset/skip/take functions when using SQL Server. The fix was authored by Taylor Otwell (upstream) in commit 09bf1457e9 (April 28, 2021) and was already present in the upstream Laravel 11.44.0 release before TuxCare onboarding. The fix adds integ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-13T11:50:05.169855+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 11.44.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:58:31.605031+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 11.44.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization RCE vulnerability). The security fix that disables cookie serialization was introduced by upstream Laravel in v5.6.30 (August 2018) and is fully present in the target version. The vulnerable pattern (automatic PHP object serialization/unserialization of encrypted cookies) has been removed. Cookie serialization is dis...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization RCE vulnerability). The security fix that disables cookie serialization was introduced by upstream Laravel in v5.6.30 (August 2018) and is fully present in the target version. The vulnerable pattern (automatic PHP object serialization/unserialization of encrypted cookies) has been removed. Cookie serialization is dis..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 11.44.0-p3+tuxcare of laravel/framework. not_affected \u2014 GHSA-7852-w36x-6mf6 is NOT present in laravel/framework 11.44.0-p4+tuxcare. The vulnerability was fixed upstream by Taylor Otwell on March 30, 2018 (commit 886d261df0), seven years before TuxCare onboarded this version in October 2025. The fix adds IV length validation in the Encrypter::validPayload() method at line 273, preventing manipulated encrypted payloads from causing silent decryption f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 GHSA-7852-w36x-6mf6 is NOT present in laravel/framework 11.44.0-p4+tuxcare. The vulnerability was fixed upstream by Taylor Otwell on March 30, 2018 (commit 886d261df0), seven years before TuxCare onboarded this version in October 2025. The fix adds IV length validation in the Encrypter::validPayload() method at line 273, preventing manipulated encrypted payloads from causing silent decryption f..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-13T11:50:05.169855+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp is fixed in version 11.44.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:15:38.790655+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 11.44.0-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v11.44.0 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability requires array values to bypass flattening before being added to query bindings. The target already contains the fix: all vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use flattenValue() or equivalent Arr::flatt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework v11.44.0 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability requires array values to bypass flattening before being added to query bindings. The target already contains the fix: all vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use flattenValue() or equivalent Arr::flatt..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:18:00.235397+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 11.44.0-p3+tuxcare of laravel/framework. The target Laravel framework v11.44.0 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (RCE via cookie session driver encryption oracle). The vulnerability was fixed by upstream Laravel in July 2020 (commits 5786aa4a38 and c9ce261a9f by Taylor Otwell), which changed cookie value prefixes from predictable SHA1 hashes to HMAC-based prefixes requiring the secret encryption key. The fix was already present in Laravel v11.44.0 when TuxCare onboarded it, as confirmed by the CookieValuePrefix class using hash_hmac('sha1', $cookieName.'v2', $key) at line 16. No vulnerable pattern (simple sha1 prefix) exists in the target code.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework v11.44.0 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (RCE via cookie session driver encryption oracle). The vulnerability was fixed by upstream Laravel in July 2020 (commits 5786aa4a38 and c9ce261a9f by Taylor Otwell), which changed cookie value prefixes from predictable SHA1 hashes to HMAC-based prefixes requiring the secret encryption key. The fix was already present in Laravel v11.44.0 when TuxCare onboarded it, as confirmed by the CookieValuePrefix class using hash_hmac('sha1', $cookieName.'v2', $key) at line 16. No vulnerable pattern (simple sha1 prefix) exists in the target code." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 11.44.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework 11.44.0 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in Laravel 6.20.26, 7.30.5, and 8.40.0 in April 2021. Version 11.44.0 already contains the complete upstream fix with comprehensive integer casting protections in both the Query Builder and SQL Server Grammar classes. The fix was present in the upstream v11.44....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Laravel Framework 11.44.0 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in Laravel 6.20.26, 7.30.5, and 8.40.0 in April 2021. Version 11.44.0 already contains the complete upstream fix with comprehensive integer casting protections in both the Query Builder and SQL Server Grammar classes. The fix was present in the upstream v11.44...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:41:49.287227+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 11.44.0-p3+tuxcare of laravel/framework. The target laravel/framework 11.44.0-p4+tuxcare is NOT AFFECTED by GHSA-x7p5-p2c9-phvg. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalar values. The upstream Laravel framework fixed this in January 2021 (commit 9d3752ca5f by Kane Cohen) by introducing the scalarValue/flattenValue helper method that normalizes array inputs to scalar values by extracting the first element using head(Arr::flatten()). This fix was already present in the upstream Laravel 11.44.0 release that TuxCare onboarded via snapshot commit c9a73e2b77 on 2025-10-10. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the flattenValue defense in the target code at HEAD (9e3c1203). The fix is attributed to upstream, not TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "The target laravel/framework 11.44.0-p4+tuxcare is NOT AFFECTED by GHSA-x7p5-p2c9-phvg. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalar values. The upstream Laravel framework fixed this in January 2021 (commit 9d3752ca5f by Kane Cohen) by introducing the scalarValue/flattenValue helper method that normalizes array inputs to scalar values by extracting the first element using head(Arr::flatten()). This fix was already present in the upstream Laravel 11.44.0 release that TuxCare onboarded via snapshot commit c9a73e2b77 on 2025-10-10. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the flattenValue defense in the target code at HEAD (9e3c1203). The fix is attributed to upstream, not TuxCare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/routing@v5.4.48-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v5.4.48-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:40:53.187521+00:00", "status_notes": "Vulnerability CVE-2026-118516 affects version v5.4.48-p1+tuxcare of symfony/routing, and is fixed in v5.4.48-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-118516" }, "action_statement": "Vulnerability CVE-2026-118516 affects version v5.4.48-p1+tuxcare of symfony/routing, and is fixed in v5.4.48-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v5.4.48-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v5.4.48-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45065 is fixed in version v5.4.48-p1+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-45065" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v5.4.48-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v5.4.48-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48784 is fixed in version v5.4.48-p1+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-48784" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/zendframework/zend-http@2.5.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zend-http@2.5.6-p1+tuxcare" } } ], "timestamp": "2026-10-29T01:50:17.417044+00:00", "status_notes": "Vulnerability CVE-2015-3154 is a false positive for zendframework/zend-http 2.5.6-p1+tuxcare. false_positive \u2014 CVE-2015-3154 is a wrong-project match. The CVE targets the Zend\\Mail component for email handling, but this repository is zendframework/zend-http (version 2.5.6), which is the HTTP protocol component. The Zend\\Mail code is completely absent from this repository\u2014no identity match, no vendored copy, no dependency relationship. All source files use the Zend\\Http namespace, never Zend\\Mail.", "vulnerability": { "name": "CVE-2015-3154" }, "impact_statement": "false_positive \u2014 CVE-2015-3154 is a wrong-project match. The CVE targets the Zend\\Mail component for email handling, but this repository is zendframework/zend-http (version 2.5.6), which is the HTTP protocol component. The Zend\\Mail code is completely absent from this repository\u2014no identity match, no vendored copy, no dependency relationship. All source files use the Zend\\Http namespace, never Zend\\Mail." }, { "status": "affected", "products": [ { "@id": "pkg:composer/zendframework/zend-http@2.5.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zend-http@2.5.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-cg8w-5jrc-675g affects version 2.5.6-p1+tuxcare of zendframework/zend-http, and is fixed in 2.5.6-p2+tuxcare.", "vulnerability": { "name": "GHSA-cg8w-5jrc-675g" }, "action_statement": "Vulnerability GHSA-cg8w-5jrc-675g affects version 2.5.6-p1+tuxcare of zendframework/zend-http, and is fixed in 2.5.6-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/zendframework/zend-http@2.5.6-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zend-http@2.5.6-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f6p5-76fp-m248 does not affect version 2.5.6-p1+tuxcare of zendframework/zend-http. already_fixed \u2014 The target repository has already been patched. The vulnerability (GHSA-f6p5-76fp-m248 / ZF2018-01) was fixed in commit 80b11a4c9a711ec50bca8892af91f809a2d1b958 ('Backport GHSA-cg8w-5jrc-675g to 2.5.6') dated 2026-06-24, which removed the code that unconditionally reads X-Rewrite-Url and X-Original-Url headers. The fix is identical to the upstream patch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-f6p5-76fp-m248" }, "impact_statement": "already_fixed \u2014 The target repository has already been patched. The vulnerability (GHSA-f6p5-76fp-m248 / ZF2018-01) was fixed in commit 80b11a4c9a711ec50bca8892af91f809a2d1b958 ('Backport GHSA-cg8w-5jrc-675g to 2.5.6') dated 2026-06-24, which removed the code that unconditionally reads X-Rewrite-Url and X-Original-Url headers. The fix is identical to the upstream patch." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-client@v6.0.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-client@v6.0.20-p1+tuxcare" } } ], "timestamp": "2026-10-28T18:23:12.853297+00:00", "status_notes": "Vulnerability CVE-2024-50342 is fixed in version v6.0.20-p1+tuxcare of symfony/http-client.", "vulnerability": { "name": "CVE-2024-50342" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-client@v6.0.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-client@v6.0.20-p1+tuxcare" } } ], "timestamp": "2026-11-05T16:37:00.052809+00:00", "status_notes": "Vulnerability CVE-2026-118517 affects version v6.0.20-p1+tuxcare of symfony/http-client.", "vulnerability": { "name": "CVE-2026-118517" }, "action_statement": "Vulnerability CVE-2026-118517 affects version v6.0.20-p1+tuxcare of symfony/http-client." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-client@v6.0.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-client@v6.0.20-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:31:00.060957+00:00", "status_notes": "Vulnerability CVE-2026-121971 affects version v6.0.20-p1+tuxcare of symfony/http-client, and is fixed in v6.0.20-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-121971" }, "action_statement": "Vulnerability CVE-2026-121971 affects version v6.0.20-p1+tuxcare of symfony/http-client, and is fixed in v6.0.20-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-client@v6.0.20-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-client@v6.0.20-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:31:00.060957+00:00", "status_notes": "Vulnerability CVE-2026-123119 affects version v6.0.20-p1+tuxcare of symfony/http-client, and is fixed in v6.0.20-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-123119" }, "action_statement": "Vulnerability CVE-2026-123119 affects version v6.0.20-p1+tuxcare of symfony/http-client, and is fixed in v6.0.20-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2018-14773 does not affect version 4.4.49-p1+tuxcare of symfony/http-foundation. not_affected \u2014 CVE-2018-14773 is NOT present in symfony/http-foundation v4.4.49-p3+tuxcare. The vulnerability involved legacy IIS headers (X-Original-URL and X-Rewrite-URL) that could override the request URI, enabling web cache poisoning. The fix was applied by upstream Symfony in version 4.1.3, which removed processing of these headers from the prepareRequestUri() method. Since the target version 4.4.49 is ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14773" }, "impact_statement": "not_affected \u2014 CVE-2018-14773 is NOT present in symfony/http-foundation v4.4.49-p3+tuxcare. The vulnerability involved legacy IIS headers (X-Original-URL and X-Rewrite-URL) that could override the request URI, enabling web cache poisoning. The fix was applied by upstream Symfony in version 4.1.3, which removed processing of these headers from the prepareRequestUri() method. Since the target version 4.4.49 is ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:19:23.616509+00:00", "status_notes": "Vulnerability CVE-2019-10913 does not affect version 4.4.49-p1+tuxcare of symfony/http-foundation. CVE-2019-10913 is NOT present in the target. The vulnerability involves unvalidated HTTP method override values that could enable SQL injection or XSS through arbitrary string injection. The fix (validation of method override strings via whitelist + regex check) was already present in the upstream Symfony v4.4.49 release that TuxCare onboarded. The target code at Request.php lines 1267-1273 contains the complete fix: whitelist validation for standard HTTP methods and regex validation rejecting any custom method with non-A-Z characters. This is an upstream fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10913" }, "impact_statement": "CVE-2019-10913 is NOT present in the target. The vulnerability involves unvalidated HTTP method override values that could enable SQL injection or XSS through arbitrary string injection. The fix (validation of method override strings via whitelist + regex check) was already present in the upstream Symfony v4.4.49 release that TuxCare onboarded. The target code at Request.php lines 1267-1273 contains the complete fix: whitelist validation for standard HTTP methods and regex validation rejecting any custom method with non-A-Z characters. This is an upstream fix, not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:19:00.032324+00:00", "status_notes": "Vulnerability CVE-2019-18888 does not affect version 4.4.49-p1+tuxcare of symfony/http-foundation. The target repository (symfony/http-foundation v4.4.49-p3+tuxcare) is NOT AFFECTED by CVE-2019-18888. The vulnerability pattern (unescaped dash-prefixed filenames passed to the file command) is not present in the target because the upstream vendor fix was already included in Symfony v4.4.49 when TuxCare onboarded it. The fix (adding `--` separator and prepending `./` to dash-prefixed paths) is present in File/MimeType/FileBinaryMimeTypeGuesser.php at lines 39 and 88. This fix was authored by Nicolas Grekas (upstream Symfony maintainer) in April 2019 and was part of the upstream release, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-18888" }, "impact_statement": "The target repository (symfony/http-foundation v4.4.49-p3+tuxcare) is NOT AFFECTED by CVE-2019-18888. The vulnerability pattern (unescaped dash-prefixed filenames passed to the file command) is not present in the target because the upstream vendor fix was already included in Symfony v4.4.49 when TuxCare onboarded it. The fix (adding `--` separator and prepending `./` to dash-prefixed paths) is present in File/MimeType/FileBinaryMimeTypeGuesser.php at lines 39 and 88. This fix was authored by Nicolas Grekas (upstream Symfony maintainer) in April 2019 and was part of the upstream release, not a TuxCare backport." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-50345 affects version 4.4.49-p1+tuxcare of symfony/http-foundation, and is fixed in 4.4.49-p2+tuxcare.", "vulnerability": { "name": "CVE-2024-50345" }, "action_statement": "Vulnerability CVE-2024-50345 affects version 4.4.49-p1+tuxcare of symfony/http-foundation, and is fixed in 4.4.49-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64500 is fixed in version 4.4.49-p1+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2025-64500" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare" } } ], "timestamp": "2026-10-20T20:45:05.425663+00:00", "status_notes": "Vulnerability CVE-2026-108082 affects version 4.4.49-p1+tuxcare of symfony/http-foundation, and is fixed in 4.4.49-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-108082" }, "action_statement": "Vulnerability CVE-2026-108082 affects version 4.4.49-p1+tuxcare of symfony/http-foundation, and is fixed in 4.4.49-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:36:00.072033+00:00", "status_notes": "Vulnerability CVE-2026-118514 affects version 4.4.49-p1+tuxcare of symfony/http-foundation, and is fixed in 4.4.49-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-118514" }, "action_statement": "Vulnerability CVE-2026-118514 affects version 4.4.49-p1+tuxcare of symfony/http-foundation, and is fixed in 4.4.49-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p1+tuxcare" } } ], "timestamp": "2026-10-29T01:02:19.900071+00:00", "status_notes": "Vulnerability CVE-2026-48736 does not affect version 4.4.49-p1+tuxcare of symfony/http-foundation. not_affected \u2014 Target version v4.4.49 is NOT AFFECTED. The vulnerable code pattern (IpUtils::PRIVATE_SUBNETS constant and IpUtils::isPrivateIp method with incomplete IPv6 transition form coverage) does not exist in this version. These features were introduced in later versions: isPrivateIp in v6.3.0 (March 2023) and PRIVATE_SUBNETS in v7.2.0 (September 2024). The CVE affects versions 5.4+ where NoPrivateNetwo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48736" }, "impact_statement": "not_affected \u2014 Target version v4.4.49 is NOT AFFECTED. The vulnerable code pattern (IpUtils::PRIVATE_SUBNETS constant and IpUtils::isPrivateIp method with incomplete IPv6 transition form coverage) does not exist in this version. These features were introduced in later versions: isPrivateIp in v6.3.0 (March 2023) and PRIVATE_SUBNETS in v7.2.0 (September 2024). The CVE affects versions 5.4+ where NoPrivateNetwo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/yiisoft/yii2-dev@2.0.54-p1+tuxcare", "identifiers": { "purl": "pkg:composer/yiisoft/yii2-dev@2.0.54-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-7269 does not affect version 2.0.54-p1+tuxcare of yiisoft/yii2-dev. CVE-2018-7269 affects Yii 2.x before version 2.0.15 due to SQL injection via unsanitized array input to findOne()/findAll() methods. The target repository is version 2.0.54-p1+tuxcare, which is far beyond the affected range. The vulnerability was fixed by upstream Yii in version 2.0.15 with the introduction of the filterCondition() method that validates array keys against valid column names before constructing SQL queries. This upstream fix is present in version 2.0.54 and was included when the version was snapshot'd for TuxCare ELS maintenance. The vulnerable code pattern is not present because the upstream vendor fixed it.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-7269" }, "impact_statement": "CVE-2018-7269 affects Yii 2.x before version 2.0.15 due to SQL injection via unsanitized array input to findOne()/findAll() methods. The target repository is version 2.0.54-p1+tuxcare, which is far beyond the affected range. The vulnerability was fixed by upstream Yii in version 2.0.15 with the introduction of the filterCondition() method that validates array keys against valid column names before constructing SQL queries. This upstream fix is present in version 2.0.54 and was included when the version was snapshot'd for TuxCare ELS maintenance. The vulnerable code pattern is not present because the upstream vendor fixed it." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2018-14773 does not affect version 4.4.49-p3+tuxcare of symfony/http-foundation. not_affected \u2014 CVE-2018-14773 is NOT present in symfony/http-foundation v4.4.49-p3+tuxcare. The vulnerability involved legacy IIS headers (X-Original-URL and X-Rewrite-URL) that could override the request URI, enabling web cache poisoning. The fix was applied by upstream Symfony in version 4.1.3, which removed processing of these headers from the prepareRequestUri() method. Since the target version 4.4.49 is ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14773" }, "impact_statement": "not_affected \u2014 CVE-2018-14773 is NOT present in symfony/http-foundation v4.4.49-p3+tuxcare. The vulnerability involved legacy IIS headers (X-Original-URL and X-Rewrite-URL) that could override the request URI, enabling web cache poisoning. The fix was applied by upstream Symfony in version 4.1.3, which removed processing of these headers from the prepareRequestUri() method. Since the target version 4.4.49 is ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare" } } ], "timestamp": "2026-11-03T10:19:23.616509+00:00", "status_notes": "Vulnerability CVE-2019-10913 does not affect version 4.4.49-p3+tuxcare of symfony/http-foundation. CVE-2019-10913 is NOT present in the target. The vulnerability involves unvalidated HTTP method override values that could enable SQL injection or XSS through arbitrary string injection. The fix (validation of method override strings via whitelist + regex check) was already present in the upstream Symfony v4.4.49 release that TuxCare onboarded. The target code at Request.php lines 1267-1273 contains the complete fix: whitelist validation for standard HTTP methods and regex validation rejecting any custom method with non-A-Z characters. This is an upstream fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10913" }, "impact_statement": "CVE-2019-10913 is NOT present in the target. The vulnerability involves unvalidated HTTP method override values that could enable SQL injection or XSS through arbitrary string injection. The fix (validation of method override strings via whitelist + regex check) was already present in the upstream Symfony v4.4.49 release that TuxCare onboarded. The target code at Request.php lines 1267-1273 contains the complete fix: whitelist validation for standard HTTP methods and regex validation rejecting any custom method with non-A-Z characters. This is an upstream fix, not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare" } } ], "timestamp": "2026-11-03T10:19:00.032324+00:00", "status_notes": "Vulnerability CVE-2019-18888 does not affect version 4.4.49-p3+tuxcare of symfony/http-foundation. The target repository (symfony/http-foundation v4.4.49-p3+tuxcare) is NOT AFFECTED by CVE-2019-18888. The vulnerability pattern (unescaped dash-prefixed filenames passed to the file command) is not present in the target because the upstream vendor fix was already included in Symfony v4.4.49 when TuxCare onboarded it. The fix (adding `--` separator and prepending `./` to dash-prefixed paths) is present in File/MimeType/FileBinaryMimeTypeGuesser.php at lines 39 and 88. This fix was authored by Nicolas Grekas (upstream Symfony maintainer) in April 2019 and was part of the upstream release, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-18888" }, "impact_statement": "The target repository (symfony/http-foundation v4.4.49-p3+tuxcare) is NOT AFFECTED by CVE-2019-18888. The vulnerability pattern (unescaped dash-prefixed filenames passed to the file command) is not present in the target because the upstream vendor fix was already included in Symfony v4.4.49 when TuxCare onboarded it. The fix (adding `--` separator and prepending `./` to dash-prefixed paths) is present in File/MimeType/FileBinaryMimeTypeGuesser.php at lines 39 and 88. This fix was authored by Nicolas Grekas (upstream Symfony maintainer) in April 2019 and was part of the upstream release, not a TuxCare backport." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare" } } ], "timestamp": "2026-10-20T20:45:05.425663+00:00", "status_notes": "Vulnerability CVE-2024-50345 is fixed in version 4.4.49-p3+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2024-50345" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare" } } ], "timestamp": "2026-10-20T20:45:05.425663+00:00", "status_notes": "Vulnerability CVE-2025-64500 is fixed in version 4.4.49-p3+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2025-64500" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare" } } ], "timestamp": "2026-10-20T20:45:05.425663+00:00", "status_notes": "Vulnerability CVE-2026-108082 is fixed in version 4.4.49-p3+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2026-108082" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare" } } ], "timestamp": "2026-11-10T15:36:00.072033+00:00", "status_notes": "Vulnerability CVE-2026-118514 affects version 4.4.49-p3+tuxcare of symfony/http-foundation, and is fixed in 4.4.49-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-118514" }, "action_statement": "Vulnerability CVE-2026-118514 affects version 4.4.49-p3+tuxcare of symfony/http-foundation, and is fixed in 4.4.49-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p3+tuxcare" } } ], "timestamp": "2026-10-29T01:02:19.900071+00:00", "status_notes": "Vulnerability CVE-2026-48736 does not affect version 4.4.49-p3+tuxcare of symfony/http-foundation. not_affected \u2014 Target version v4.4.49 is NOT AFFECTED. The vulnerable code pattern (IpUtils::PRIVATE_SUBNETS constant and IpUtils::isPrivateIp method with incomplete IPv6 transition form coverage) does not exist in this version. These features were introduced in later versions: isPrivateIp in v6.3.0 (March 2023) and PRIVATE_SUBNETS in v7.2.0 (September 2024). The CVE affects versions 5.4+ where NoPrivateNetwo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48736" }, "impact_statement": "not_affected \u2014 Target version v4.4.49 is NOT AFFECTED. The vulnerable code pattern (IpUtils::PRIVATE_SUBNETS constant and IpUtils::isPrivateIp method with incomplete IPv6 transition form coverage) does not exist in this version. These features were introduced in later versions: isPrivateIp in v6.3.0 (March 2023) and PRIVATE_SUBNETS in v7.2.0 (September 2024). The CVE affects versions 5.4+ where NoPrivateNetwo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/firebase/php-jwt@v5.5.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/firebase/php-jwt@v5.5.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-46743 does not affect version v5.5.1-p1+tuxcare of firebase/php-jwt. not_affected \u2014 The target firebase/php-jwt v5.5.1 is not affected by CVE-2021-46743. The upstream vendor (Google/Firebase) introduced the Key class and algorithm verification defense in v5.5.1 (November 2021), which is the version the target ships. The fix from patch 1 (commit bc0df6440dfe) is present: Key objects bind algorithms to key material, and JWT::decode verifies the JWT's algorithm header matches the...", "vulnerability": { "name": "CVE-2021-46743" }, "impact_statement": "not_affected \u2014 The target firebase/php-jwt v5.5.1 is not affected by CVE-2021-46743. The upstream vendor (Google/Firebase) introduced the Key class and algorithm verification defense in v5.5.1 (November 2021), which is the version the target ships. The fix from patch 1 (commit bc0df6440dfe) is present: Key objects bind algorithms to key material, and JWT::decode verifies the JWT's algorithm header matches the..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/firebase/php-jwt@v5.5.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/firebase/php-jwt@v5.5.1-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-45769 is fixed in version v5.5.1-p1+tuxcare of firebase/php-jwt.", "vulnerability": { "name": "CVE-2025-45769" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/firebase/php-jwt@v5.5.1-p1+tuxcare", "identifiers": { "purl": "pkg:composer/firebase/php-jwt@v5.5.1-p1+tuxcare" } } ], "timestamp": "2026-11-10T14:33:00.057870+00:00", "status_notes": "Vulnerability GHSA-h533-5v22-8vcp affects version v5.5.1-p1+tuxcare of firebase/php-jwt.", "vulnerability": { "name": "GHSA-h533-5v22-8vcp" }, "action_statement": "Vulnerability GHSA-h533-5v22-8vcp affects version v5.5.1-p1+tuxcare of firebase/php-jwt." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:53:32.685451+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 11.44.0-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is not affected by CVE-2017-14775. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database-level token comparison with constant-time hash_equals() comparison. The target version 11.44.0 already contains this fix as it was present in the upstream release when TuxCare onboarded it. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() fo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is not affected by CVE-2017-14775. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database-level token comparison with constant-time hash_equals() comparison. The target version 11.44.0 already contains this fix as it was present in the upstream release when TuxCare onboarded it. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() fo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:53:32.685451+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 11.44.0-p5+tuxcare of laravel/framework. CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, allowing RCE via PHP object injection when untrusted X-XSRF-TOKEN values are unserialized. The target (Laravel 11.44.0-p4+tuxcare) is NOT AFFECTED because upstream Laravel fixed this vulnerability in August 2018 (commit c0eb9073eb by Taylor Otwell), long before version 11.44.0 was released. The fix prevents automatic PHP unserialization of decrypted cookies/headers by passing `false` to the decrypt method's serialize parameter, blocking the RCE attack chain. The vulnerable code pattern (automatic unserialization) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, allowing RCE via PHP object injection when untrusted X-XSRF-TOKEN values are unserialized. The target (Laravel 11.44.0-p4+tuxcare) is NOT AFFECTED because upstream Laravel fixed this vulnerability in August 2018 (commit c0eb9073eb by Taylor Otwell), long before version 11.44.0 was released. The fix prevents automatic PHP unserialization of decrypted cookies/headers by passing `false` to the decrypt method's serialize parameter, blocking the RCE attack chain. The vulnerable code pattern (automatic unserialization) is not present in the target." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:54:00.052758+00:00", "status_notes": "Vulnerability CVE-2019-9081 is fixed in version 11.44.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:53:32.685451+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 11.44.0-p5+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework versions before 5.8.17 due to OS command injection in the link() function of Filesystem.php. The vulnerability allowed attackers to inject arbitrary shell commands through unescaped $target and $link parameters passed to exec(). The target version 11.44.0 is NOT affected because the upstream fix (commit 44c3feb604) was already included in the upstream release when TuxCare onboarded it. The fix wraps both parameters with escapeshellarg() to prevent shell metacharacter injection. This was an upstream fix by Taylor Otwell applied in v5.8.17 (May 2019), well before version 11.44.0.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework versions before 5.8.17 due to OS command injection in the link() function of Filesystem.php. The vulnerability allowed attackers to inject arbitrary shell commands through unescaped $target and $link parameters passed to exec(). The target version 11.44.0 is NOT affected because the upstream fix (commit 44c3feb604) was already included in the upstream release when TuxCare onboarded it. The fix wraps both parameters with escapeshellarg() to prevent shell metacharacter injection. This was an upstream fix by Taylor Otwell applied in v5.8.17 (May 2019), well before version 11.44.0." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:53:32.685451+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 11.44.0-p5+tuxcare of laravel/framework. The target Laravel Framework 11.44.0-p4+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability involved a mass assignment bypass where attackers could set protected (guarded) model attributes by using fabricated keys with JSON path notation. The fix (commit 897d107 by Taylor Otwell, 2020-08-07) adds the isGuardableColumn() method that validates attribute keys against actual database columns, rejecting keys that don't correspond to real columns. This fix was already present in the upstream Laravel 11.44.0 release that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix commit predates the first TuxCare snapshot commit (c9a73e2b77b).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel Framework 11.44.0-p4+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability involved a mass assignment bypass where attackers could set protected (guarded) model attributes by using fabricated keys with JSON path notation. The fix (commit 897d107 by Taylor Otwell, 2020-08-07) adds the isGuardableColumn() method that validates attribute keys against actual database columns, rejecting keys that don't correspond to real columns. This fix was already present in the upstream Laravel 11.44.0 release that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix commit predates the first TuxCare snapshot commit (c9a73e2b77b)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:53:32.685451+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 11.44.0-p5+tuxcare of laravel/framework. Laravel 11.44.0 is not affected by CVE-2021-21263. The vulnerability (query binding exploitation via unchecked array inputs) was fixed in the upstream Laravel release through commit d0954f4574 by Taylor Otwell on Jan 13, 2021. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() helper or array_slice() to limit bindings. The fix was already present in upstream Laravel 11.44.0 when TuxCare onboarded it via snapshot commit c9a73e2b77.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "Laravel 11.44.0 is not affected by CVE-2021-21263. The vulnerability (query binding exploitation via unchecked array inputs) was fixed in the upstream Laravel release through commit d0954f4574 by Taylor Otwell on Jan 13, 2021. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() helper or array_slice() to limit bindings. The fix was already present in upstream Laravel 11.44.0 when TuxCare onboarded it via snapshot commit c9a73e2b77." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:53:32.685451+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 11.44.0-p5+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 (XSS via predictable Blade parent placeholders) is not present in Laravel 11.44.0. The vulnerability pattern (deterministic sha1($section) hashes allowing placeholder prediction) was fixed by upstream Laravel in December 2021. The fix was already included in the v11.44.0 release before TuxCare onboarded it. Both critical files contain the defense: ManagesLayouts.php uses per-requ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 (XSS via predictable Blade parent placeholders) is not present in Laravel 11.44.0. The vulnerability pattern (deterministic sha1($section) hashes allowing placeholder prediction) was fixed by upstream Laravel in December 2021. The fix was already included in the v11.44.0 release before TuxCare onboarded it. Both critical files contain the defense: ManagesLayouts.php uses per-requ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:53:32.685451+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 11.44.0-p5+tuxcare of laravel/framework. The target repository (laravel/framework v11.44.0-p4+tuxcare) is NOT AFFECTED by CVE-2024-52301. The vulnerability pattern has been removed by an upstream fix that was already present in Laravel v11.44.0 when TuxCare onboarded this version. The fix (commit 18b326d22d831e1fe05e737209e367e30796d5f3 by Taylor Otwell) adds a runningInConsole() check before using $_SERVER['argv'] for environment detection, preventing attackers from manipulating the application environment via crafted query strings when register_argc_argv is enabled.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target repository (laravel/framework v11.44.0-p4+tuxcare) is NOT AFFECTED by CVE-2024-52301. The vulnerability pattern has been removed by an upstream fix that was already present in Laravel v11.44.0 when TuxCare onboarded this version. The fix (commit 18b326d22d831e1fe05e737209e367e30796d5f3 by Taylor Otwell) adds a runningInConsole() check before using $_SERVER['argv'] for environment detection, preventing attackers from manipulating the application environment via crafted query strings when register_argc_argv is enabled." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:53:32.685451+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 11.44.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:53:32.685451+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 11.44.0-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is NOT affected by CVE-2026-102279. The vulnerability (DOM-based XSS via Tippy.js tooltips with allowHTML: true) was introduced in Laravel 12.x and never existed in version 11.x. The target uses Tippy.js v6.3.7 without setting allowHTML, relying on the library's safe default (allowHTML: false), which prevents HTML interpretation in tooltips. Although attacker-controlled input (H...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is NOT affected by CVE-2026-102279. The vulnerability (DOM-based XSS via Tippy.js tooltips with allowHTML: true) was introduced in Laravel 12.x and never existed in version 11.x. The target uses Tippy.js v6.3.7 without setting allowHTML, relying on the library's safe default (allowHTML: false), which prevents HTML interpretation in tooltips. Although attacker-controlled input (H..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:53:32.685451+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 11.44.0-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource feature, which was introduced in Laravel 12.x (commit 2f30936319, first appearing in v12.45.0). The target version (11.44.0) predates the JsonApi feature entirely. The vulnerable code path - specifically the ResolvesJsonApiElements trait that processes relationship include parameters and c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource feature, which was introduced in Laravel 12.x (commit 2f30936319, first appearing in v12.45.0). The target version (11.44.0) predates the JsonApi feature entirely. The vulnerable code path - specifically the ResolvesJsonApiElements trait that processes relationship include parameters and c..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:53:32.685451+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 11.44.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:53:32.685451+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 11.44.0-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 11.44.0 is NOT affected by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input passed to limit/offset/skip/take functions when using SQL Server. The fix was authored by Taylor Otwell (upstream) in commit 09bf1457e9 (April 28, 2021) and was already present in the upstream Laravel 11.44.0 release before TuxCare onboarding. The fix adds integ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The target Laravel 11.44.0 is NOT affected by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input passed to limit/offset/skip/take functions when using SQL Server. The fix was authored by Taylor Otwell (upstream) in commit 09bf1457e9 (April 28, 2021) and was already present in the upstream Laravel 11.44.0 release before TuxCare onboarding. The fix adds integ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:53:32.685451+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 11.44.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:53:32.685451+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 11.44.0-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization RCE vulnerability). The security fix that disables cookie serialization was introduced by upstream Laravel in v5.6.30 (August 2018) and is fully present in the target version. The vulnerable pattern (automatic PHP object serialization/unserialization of encrypted cookies) has been removed. Cookie serialization is dis...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization RCE vulnerability). The security fix that disables cookie serialization was introduced by upstream Laravel in v5.6.30 (August 2018) and is fully present in the target version. The vulnerable pattern (automatic PHP object serialization/unserialization of encrypted cookies) has been removed. Cookie serialization is dis..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:53:32.685451+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 11.44.0-p5+tuxcare of laravel/framework. not_affected \u2014 GHSA-7852-w36x-6mf6 is NOT present in laravel/framework 11.44.0-p4+tuxcare. The vulnerability was fixed upstream by Taylor Otwell on March 30, 2018 (commit 886d261df0), seven years before TuxCare onboarded this version in October 2025. The fix adds IV length validation in the Encrypter::validPayload() method at line 273, preventing manipulated encrypted payloads from causing silent decryption f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 GHSA-7852-w36x-6mf6 is NOT present in laravel/framework 11.44.0-p4+tuxcare. The vulnerability was fixed upstream by Taylor Otwell on March 30, 2018 (commit 886d261df0), seven years before TuxCare onboarded this version in October 2025. The fix adds IV length validation in the Encrypter::validPayload() method at line 273, preventing manipulated encrypted payloads from causing silent decryption f..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:53:32.685451+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp is fixed in version 11.44.0-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:53:32.685451+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 11.44.0-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v11.44.0 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability requires array values to bypass flattening before being added to query bindings. The target already contains the fix: all vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use flattenValue() or equivalent Arr::flatt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework v11.44.0 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability requires array values to bypass flattening before being added to query bindings. The target already contains the fix: all vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use flattenValue() or equivalent Arr::flatt..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:53:32.685451+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 11.44.0-p5+tuxcare of laravel/framework. The target Laravel framework v11.44.0 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (RCE via cookie session driver encryption oracle). The vulnerability was fixed by upstream Laravel in July 2020 (commits 5786aa4a38 and c9ce261a9f by Taylor Otwell), which changed cookie value prefixes from predictable SHA1 hashes to HMAC-based prefixes requiring the secret encryption key. The fix was already present in Laravel v11.44.0 when TuxCare onboarded it, as confirmed by the CookieValuePrefix class using hash_hmac('sha1', $cookieName.'v2', $key) at line 16. No vulnerable pattern (simple sha1 prefix) exists in the target code.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework v11.44.0 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (RCE via cookie session driver encryption oracle). The vulnerability was fixed by upstream Laravel in July 2020 (commits 5786aa4a38 and c9ce261a9f by Taylor Otwell), which changed cookie value prefixes from predictable SHA1 hashes to HMAC-based prefixes requiring the secret encryption key. The fix was already present in Laravel v11.44.0 when TuxCare onboarded it, as confirmed by the CookieValuePrefix class using hash_hmac('sha1', $cookieName.'v2', $key) at line 16. No vulnerable pattern (simple sha1 prefix) exists in the target code." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:53:32.685451+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 11.44.0-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework 11.44.0 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in Laravel 6.20.26, 7.30.5, and 8.40.0 in April 2021. Version 11.44.0 already contains the complete upstream fix with comprehensive integer casting protections in both the Query Builder and SQL Server Grammar classes. The fix was present in the upstream v11.44....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Laravel Framework 11.44.0 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in Laravel 6.20.26, 7.30.5, and 8.40.0 in April 2021. Version 11.44.0 already contains the complete upstream fix with comprehensive integer casting protections in both the Query Builder and SQL Server Grammar classes. The fix was present in the upstream v11.44...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:53:32.685451+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 11.44.0-p5+tuxcare of laravel/framework. The target laravel/framework 11.44.0-p4+tuxcare is NOT AFFECTED by GHSA-x7p5-p2c9-phvg. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalar values. The upstream Laravel framework fixed this in January 2021 (commit 9d3752ca5f by Kane Cohen) by introducing the scalarValue/flattenValue helper method that normalizes array inputs to scalar values by extracting the first element using head(Arr::flatten()). This fix was already present in the upstream Laravel 11.44.0 release that TuxCare onboarded via snapshot commit c9a73e2b77 on 2025-10-10. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the flattenValue defense in the target code at HEAD (9e3c1203). The fix is attributed to upstream, not TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "The target laravel/framework 11.44.0-p4+tuxcare is NOT AFFECTED by GHSA-x7p5-p2c9-phvg. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalar values. The upstream Laravel framework fixed this in January 2021 (commit 9d3752ca5f by Kane Cohen) by introducing the scalarValue/flattenValue helper method that normalizes array inputs to scalar values by extracting the first element using head(Arr::flatten()). This fix was already present in the upstream Laravel 11.44.0 release that TuxCare onboarded via snapshot commit c9a73e2b77 on 2025-10-10. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the flattenValue defense in the target code at HEAD (9e3c1203). The fix is attributed to upstream, not TuxCare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/zendframework/zend-http@2.5.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zend-http@2.5.6-p2+tuxcare" } } ], "timestamp": "2026-10-29T01:50:17.417044+00:00", "status_notes": "Vulnerability CVE-2015-3154 is a false positive for zendframework/zend-http 2.5.6-p2+tuxcare. false_positive \u2014 CVE-2015-3154 is a wrong-project match. The CVE targets the Zend\\Mail component for email handling, but this repository is zendframework/zend-http (version 2.5.6), which is the HTTP protocol component. The Zend\\Mail code is completely absent from this repository\u2014no identity match, no vendored copy, no dependency relationship. All source files use the Zend\\Http namespace, never Zend\\Mail.", "vulnerability": { "name": "CVE-2015-3154" }, "impact_statement": "false_positive \u2014 CVE-2015-3154 is a wrong-project match. The CVE targets the Zend\\Mail component for email handling, but this repository is zendframework/zend-http (version 2.5.6), which is the HTTP protocol component. The Zend\\Mail code is completely absent from this repository\u2014no identity match, no vendored copy, no dependency relationship. All source files use the Zend\\Http namespace, never Zend\\Mail." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/zendframework/zend-http@2.5.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zend-http@2.5.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-cg8w-5jrc-675g is fixed in version 2.5.6-p2+tuxcare of zendframework/zend-http.", "vulnerability": { "name": "GHSA-cg8w-5jrc-675g" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/zendframework/zend-http@2.5.6-p2+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zend-http@2.5.6-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f6p5-76fp-m248 does not affect version 2.5.6-p2+tuxcare of zendframework/zend-http. already_fixed \u2014 The target repository has already been patched. The vulnerability (GHSA-f6p5-76fp-m248 / ZF2018-01) was fixed in commit 80b11a4c9a711ec50bca8892af91f809a2d1b958 ('Backport GHSA-cg8w-5jrc-675g to 2.5.6') dated 2026-06-24, which removed the code that unconditionally reads X-Rewrite-Url and X-Original-Url headers. The fix is identical to the upstream patch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-f6p5-76fp-m248" }, "impact_statement": "already_fixed \u2014 The target repository has already been patched. The vulnerability (GHSA-f6p5-76fp-m248 / ZF2018-01) was fixed in commit 80b11a4c9a711ec50bca8892af91f809a2d1b958 ('Backport GHSA-cg8w-5jrc-675g to 2.5.6') dated 2026-06-24, which removed the code that unconditionally reads X-Rewrite-Url and X-Original-Url headers. The fix is identical to the upstream patch." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v7.4.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v7.4.9-p2+tuxcare" } } ], "timestamp": "2026-11-10T15:42:54.752183+00:00", "status_notes": "Vulnerability CVE-2026-118516 is fixed in version v7.4.9-p2+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-118516" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v7.4.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v7.4.9-p2+tuxcare" } } ], "timestamp": "2026-11-10T15:42:04.326114+00:00", "status_notes": "Vulnerability CVE-2026-45065 is fixed in version v7.4.9-p2+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-45065" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v7.4.9-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v7.4.9-p2+tuxcare" } } ], "timestamp": "2026-11-10T15:42:04.326114+00:00", "status_notes": "Vulnerability CVE-2026-48784 is fixed in version v7.4.9-p2+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-48784" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework@2.5.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework@2.5.3-p1+tuxcare" } } ], "timestamp": "2026-10-08T13:06:25.576695+00:00", "status_notes": "Vulnerability CVE-2021-3007 does not affect version 2.5.3-p1+tuxcare of zendframework/zendframework. The target repository (zendframework/zendframework v2.5.3) is a pure meta-package aggregator with no library source code. The vulnerable Zend\\Http\\Response\\Stream class exists in the separate zendframework/zend-http component package (v2.8.4), which is declared as a dependency but NOT vendored in this repository. The target contains only 3 CLI utility scripts that do not use deserialization, Stream classes, or HTTP functionality. The vulnerability pattern is absent because no code in this repository receives serialized data or instantiates Stream objects.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-3007" }, "impact_statement": "The target repository (zendframework/zendframework v2.5.3) is a pure meta-package aggregator with no library source code. The vulnerable Zend\\Http\\Response\\Stream class exists in the separate zendframework/zend-http component package (v2.8.4), which is declared as a dependency but NOT vendored in this repository. The target contains only 3 CLI utility scripts that do not use deserialization, Stream classes, or HTTP functionality. The vulnerability pattern is absent because no code in this repository receives serialized data or instantiates Stream objects." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/zendframework/zendframework@2.5.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/zendframework/zendframework@2.5.3-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:16:38.201074+00:00", "status_notes": "Vulnerability GHSA-fh7r-58q4-6387 does not affect version 2.5.3-p1+tuxcare of zendframework/zendframework. not_affected \u2014 This repository (zendframework/zendframework 2.5.3-p1+tuxcare) is a metapackage that contains no runtime source code. The CVE describes a URL rewrite exploit in zend-http and zend-feed components where malicious HTTP headers (X-Original-URL, X-Rewrite-URL) can manipulate the request URI to access arbitrary content. However, in Zend Framework 2.5.x, the architecture changed from monolithic (2.4....", "vulnerability": { "name": "GHSA-fh7r-58q4-6387" }, "impact_statement": "not_affected \u2014 This repository (zendframework/zendframework 2.5.3-p1+tuxcare) is a metapackage that contains no runtime source code. The CVE describes a URL rewrite exploit in zend-http and zend-feed components where malicious HTTP headers (X-Original-URL, X-Rewrite-URL) can manipulate the request URI to access arbitrary content. However, in Zend Framework 2.5.x, the architecture changed from monolithic (2.4...." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/validator@v4.4.48-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/validator@v4.4.48-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:37:00.058249+00:00", "status_notes": "Vulnerability CVE-2024-50343 is fixed in version v4.4.48-p1+tuxcare of symfony/validator.", "vulnerability": { "name": "CVE-2024-50343" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/validator@v4.4.48-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/validator@v4.4.48-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:37:00.058249+00:00", "status_notes": "Vulnerability CVE-2026-123125 is fixed in version v4.4.48-p1+tuxcare of symfony/validator.", "vulnerability": { "name": "CVE-2026-123125" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2018-14773 does not affect version v6.4.35-p1+tuxcare of symfony/http-foundation. not_affected \u2014 The target repository (Symfony HttpFoundation v6.4.35-p1+tuxcare) is not affected by CVE-2018-14773. The vulnerability involved legacy IIS headers (X-Original-URL and X-Rewrite-URL) that could override the request URI without verification. The fix, which removed support for these headers, was applied by upstream Symfony in version 4.1.3 (July 2018). Version 6.4.35, released in 2024 and onboarde...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14773" }, "impact_statement": "not_affected \u2014 The target repository (Symfony HttpFoundation v6.4.35-p1+tuxcare) is not affected by CVE-2018-14773. The vulnerability involved legacy IIS headers (X-Original-URL and X-Rewrite-URL) that could override the request URI without verification. The fix, which removed support for these headers, was applied by upstream Symfony in version 4.1.3 (July 2018). Version 6.4.35, released in 2024 and onboarde..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:19:23.616509+00:00", "status_notes": "Vulnerability CVE-2019-10913 does not affect version v6.4.35-p1+tuxcare of symfony/http-foundation. The target symfony/http-foundation v6.4.35 is not affected by CVE-2019-10913. The vulnerability (unvalidated HTTP method override allowing injection attacks) is not present because the security fix was already included in the upstream Symfony v6.4.35 release that TuxCare onboarded. The getMethod() function at Request.php:1233-1266 contains complete validation: whitelist check for standard HTTP methods (line 1257) and regex validation for non-standard methods (line 1261), throwing SuspiciousOperationException for invalid input (line 1262). This is an upstream fix by nicolas.grekas@gmail.com from 2019 (commit d325ae59), which was present in v6.4.35 before TuxCare's onboarding snapshot.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10913" }, "impact_statement": "The target symfony/http-foundation v6.4.35 is not affected by CVE-2019-10913. The vulnerability (unvalidated HTTP method override allowing injection attacks) is not present because the security fix was already included in the upstream Symfony v6.4.35 release that TuxCare onboarded. The getMethod() function at Request.php:1233-1266 contains complete validation: whitelist check for standard HTTP methods (line 1257) and regex validation for non-standard methods (line 1261), throwing SuspiciousOperationException for invalid input (line 1262). This is an upstream fix by nicolas.grekas@gmail.com from 2019 (commit d325ae59), which was present in v6.4.35 before TuxCare's onboarding snapshot." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:19:23.616509+00:00", "status_notes": "Vulnerability CVE-2019-18888 does not affect version v6.4.35-p1+tuxcare of symfony/http-foundation. CVE-2019-18888 affects the FileBinaryMimeTypeGuesser class in symfony/http-foundation versions 2.8.x through 4.3.7, where filenames starting with '-' could inject arbitrary arguments into the underlying 'file' command. However, the target version v6.4.35 does not contain this vulnerability. The entire MimeType namespace (including FileBinaryMimeTypeGuesser) was removed from symfony/http-foundation in upstream v5.0.0 as part of an architectural extraction to the separate symfony/mime component. Version v6.4.35 delegates all MIME type guessing to Symfony\\Component\\Mime\\MimeTypes (lines 16, 77 of File/File.php) and contains no file command invocation code. The vulnerable code never existed in v6.4.35\u2014it was removed years before this version was released.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-18888" }, "impact_statement": "CVE-2019-18888 affects the FileBinaryMimeTypeGuesser class in symfony/http-foundation versions 2.8.x through 4.3.7, where filenames starting with '-' could inject arbitrary arguments into the underlying 'file' command. However, the target version v6.4.35 does not contain this vulnerability. The entire MimeType namespace (including FileBinaryMimeTypeGuesser) was removed from symfony/http-foundation in upstream v5.0.0 as part of an architectural extraction to the separate symfony/mime component. Version v6.4.35 delegates all MIME type guessing to Symfony\\Component\\Mime\\MimeTypes (lines 16, 77 of File/File.php) and contains no file command invocation code. The vulnerable code never existed in v6.4.35\u2014it was removed years before this version was released." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare" } } ], "timestamp": "2026-10-21T07:32:07.005141+00:00", "status_notes": "Vulnerability CVE-2024-50345 does not affect version v6.4.35-p1+tuxcare of symfony/http-foundation. already_fixed \u2014 The target repository (symfony/http-foundation v6.4.35) already contains the complete fix for CVE-2024-50345. The URI validation checks added by the upstream patch are present at lines 369-377 of Request.php, preventing URIs with special characters from being parsed differently than browsers.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-50345" }, "impact_statement": "already_fixed \u2014 The target repository (symfony/http-foundation v6.4.35) already contains the complete fix for CVE-2024-50345. The URI validation checks added by the upstream patch are present at lines 369-377 of Request.php, preventing URIs with special characters from being parsed differently than browsers." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare" } } ], "timestamp": "2026-10-21T07:32:07.005141+00:00", "status_notes": "Vulnerability CVE-2025-64500 does not affect version v6.4.35-p1+tuxcare of symfony/http-foundation. already_fixed \u2014 The target repository (Symfony HttpFoundation v6.4.35) already contains the fix for CVE-2025-64500. The defense code at Request.php:1944-1945 ensures that all URL paths start with '/', preventing the vulnerability where crafted PATH_INFO could result in paths not starting with '/' and bypassing access control rules.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-64500" }, "impact_statement": "already_fixed \u2014 The target repository (Symfony HttpFoundation v6.4.35) already contains the fix for CVE-2025-64500. The defense code at Request.php:1944-1945 ensures that all URL paths start with '/', preventing the vulnerability where crafted PATH_INFO could result in paths not starting with '/' and bypassing access control rules." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare" } } ], "timestamp": "2026-10-21T07:32:07.005141+00:00", "status_notes": "Vulnerability CVE-2026-108082 is fixed in version v6.4.35-p1+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2026-108082" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:33:00.088355+00:00", "status_notes": "Vulnerability CVE-2026-118514 affects version v6.4.35-p1+tuxcare of symfony/http-foundation, and is fixed in v6.4.35-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-118514" }, "action_statement": "Vulnerability CVE-2026-118514 affects version v6.4.35-p1+tuxcare of symfony/http-foundation, and is fixed in v6.4.35-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare" } } ], "timestamp": "2026-10-21T07:32:07.005141+00:00", "status_notes": "Vulnerability CVE-2026-48736 does not affect version v6.4.35-p1+tuxcare of symfony/http-foundation. not_affected \u2014 CVE-2026-48736 affects IpUtils::PRIVATE_SUBNETS, which omits IPv6 transition prefixes (6to4, NAT64, Teredo, IPv4-compatible). The incomplete constant exists in this repository (IpUtils.php lines 21-34), missing 5 critical ranges that the upstream fix (commit 3ebc78a9, not in HEAD) adds. However, symfony/http-foundation is a library that only EXPORTS isPrivateIp() and PRIVATE_SUBNETS\u2014its own pro...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-48736" }, "impact_statement": "not_affected \u2014 CVE-2026-48736 affects IpUtils::PRIVATE_SUBNETS, which omits IPv6 transition prefixes (6to4, NAT64, Teredo, IPv4-compatible). The incomplete constant exists in this repository (IpUtils.php lines 21-34), missing 5 critical ranges that the upstream fix (commit 3ebc78a9, not in HEAD) adds. However, symfony/http-foundation is a library that only EXPORTS isPrivateIp() and PRIVATE_SUBNETS\u2014its own pro..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v5.4.51-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v5.4.51-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:43:32.053580+00:00", "status_notes": "Vulnerability CVE-2022-24894 does not affect version v5.4.51-p1+tuxcare of symfony/http-kernel. not_affected \u2014 The target repository (symfony/http-kernel v5.4.51) is not affected by CVE-2022-24894. The vulnerability involves the HTTP cache system storing and returning Set-Cookie headers to unauthorized clients, potentially allowing session hijacking. The fix, which removes private headers (specifically Set-Cookie by default) before caching responses, was implemented by Nicolas Grekas in upstream commit ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-24894" }, "impact_statement": "not_affected \u2014 The target repository (symfony/http-kernel v5.4.51) is not affected by CVE-2022-24894. The vulnerability involves the HTTP cache system storing and returning Set-Cookie headers to unauthorized clients, potentially allowing session hijacking. The fix, which removes private headers (specifically Set-Cookie by default) before caching responses, was implemented by Nicolas Grekas in upstream commit ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v5.4.51-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v5.4.51-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:44:00.062264+00:00", "status_notes": "Vulnerability CVE-2026-123339 is fixed in version v5.4.51-p1+tuxcare of symfony/http-kernel.", "vulnerability": { "name": "CVE-2026-123339" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v5.4.51-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v5.4.51-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:43:32.053580+00:00", "status_notes": "Vulnerability CVE-2026-45075 does not affect version v5.4.51-p1+tuxcare of symfony/http-kernel. The target symfony/http-kernel v5.4.51 is NOT AFFECTED by CVE-2026-45075. This vulnerability concerns the `#[IsSignatureValid]` attribute allowing HEAD requests to bypass method-filtered security checks. However, this attribute does not exist in v5.4.51 - it was introduced in Symfony 7.4.0. Exhaustive searches confirmed no trace of IsSignatureValid, IsGranted, or IsCsrfTokenValid attributes in the target. The vulnerable code pattern cannot exist when the feature itself is absent. This is Rule 5 Type A1: the Input (HTTP HEAD requests to controllers protected by these attributes) cannot occur because the attributes don't exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45075" }, "impact_statement": "The target symfony/http-kernel v5.4.51 is NOT AFFECTED by CVE-2026-45075. This vulnerability concerns the `#[IsSignatureValid]` attribute allowing HEAD requests to bypass method-filtered security checks. However, this attribute does not exist in v5.4.51 - it was introduced in Symfony 7.4.0. Exhaustive searches confirmed no trace of IsSignatureValid, IsGranted, or IsCsrfTokenValid attributes in the target. The vulnerable code pattern cannot exist when the feature itself is absent. This is Rule 5 Type A1: the Input (HTTP HEAD requests to controllers protected by these attributes) cannot occur because the attributes don't exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p4+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p4+tuxcare" } } ], "timestamp": "2026-11-10T15:35:13.276683+00:00", "status_notes": "Vulnerability CVE-2018-14773 does not affect version 4.4.49-p4+tuxcare of symfony/http-foundation. not_affected \u2014 CVE-2018-14773 is NOT present in symfony/http-foundation v4.4.49-p3+tuxcare. The vulnerability involved legacy IIS headers (X-Original-URL and X-Rewrite-URL) that could override the request URI, enabling web cache poisoning. The fix was applied by upstream Symfony in version 4.1.3, which removed processing of these headers from the prepareRequestUri() method. Since the target version 4.4.49 is ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14773" }, "impact_statement": "not_affected \u2014 CVE-2018-14773 is NOT present in symfony/http-foundation v4.4.49-p3+tuxcare. The vulnerability involved legacy IIS headers (X-Original-URL and X-Rewrite-URL) that could override the request URI, enabling web cache poisoning. The fix was applied by upstream Symfony in version 4.1.3, which removed processing of these headers from the prepareRequestUri() method. Since the target version 4.4.49 is ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p4+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p4+tuxcare" } } ], "timestamp": "2026-11-10T15:35:13.276683+00:00", "status_notes": "Vulnerability CVE-2019-10913 does not affect version 4.4.49-p4+tuxcare of symfony/http-foundation. CVE-2019-10913 is NOT present in the target. The vulnerability involves unvalidated HTTP method override values that could enable SQL injection or XSS through arbitrary string injection. The fix (validation of method override strings via whitelist + regex check) was already present in the upstream Symfony v4.4.49 release that TuxCare onboarded. The target code at Request.php lines 1267-1273 contains the complete fix: whitelist validation for standard HTTP methods and regex validation rejecting any custom method with non-A-Z characters. This is an upstream fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10913" }, "impact_statement": "CVE-2019-10913 is NOT present in the target. The vulnerability involves unvalidated HTTP method override values that could enable SQL injection or XSS through arbitrary string injection. The fix (validation of method override strings via whitelist + regex check) was already present in the upstream Symfony v4.4.49 release that TuxCare onboarded. The target code at Request.php lines 1267-1273 contains the complete fix: whitelist validation for standard HTTP methods and regex validation rejecting any custom method with non-A-Z characters. This is an upstream fix, not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p4+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p4+tuxcare" } } ], "timestamp": "2026-11-10T15:35:13.276683+00:00", "status_notes": "Vulnerability CVE-2019-18888 does not affect version 4.4.49-p4+tuxcare of symfony/http-foundation. The target repository (symfony/http-foundation v4.4.49-p3+tuxcare) is NOT AFFECTED by CVE-2019-18888. The vulnerability pattern (unescaped dash-prefixed filenames passed to the file command) is not present in the target because the upstream vendor fix was already included in Symfony v4.4.49 when TuxCare onboarded it. The fix (adding `--` separator and prepending `./` to dash-prefixed paths) is present in File/MimeType/FileBinaryMimeTypeGuesser.php at lines 39 and 88. This fix was authored by Nicolas Grekas (upstream Symfony maintainer) in April 2019 and was part of the upstream release, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-18888" }, "impact_statement": "The target repository (symfony/http-foundation v4.4.49-p3+tuxcare) is NOT AFFECTED by CVE-2019-18888. The vulnerability pattern (unescaped dash-prefixed filenames passed to the file command) is not present in the target because the upstream vendor fix was already included in Symfony v4.4.49 when TuxCare onboarded it. The fix (adding `--` separator and prepending `./` to dash-prefixed paths) is present in File/MimeType/FileBinaryMimeTypeGuesser.php at lines 39 and 88. This fix was authored by Nicolas Grekas (upstream Symfony maintainer) in April 2019 and was part of the upstream release, not a TuxCare backport." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p4+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p4+tuxcare" } } ], "timestamp": "2026-11-10T15:35:13.276683+00:00", "status_notes": "Vulnerability CVE-2024-50345 is fixed in version 4.4.49-p4+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2024-50345" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p4+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p4+tuxcare" } } ], "timestamp": "2026-11-10T15:35:13.276683+00:00", "status_notes": "Vulnerability CVE-2025-64500 is fixed in version 4.4.49-p4+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2025-64500" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p4+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p4+tuxcare" } } ], "timestamp": "2026-11-10T15:35:13.276683+00:00", "status_notes": "Vulnerability CVE-2026-108082 is fixed in version 4.4.49-p4+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2026-108082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p4+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p4+tuxcare" } } ], "timestamp": "2026-11-10T15:36:00.072033+00:00", "status_notes": "Vulnerability CVE-2026-118514 is fixed in version 4.4.49-p4+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2026-118514" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@4.4.49-p4+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@4.4.49-p4+tuxcare" } } ], "timestamp": "2026-11-10T15:35:13.276683+00:00", "status_notes": "Vulnerability CVE-2026-48736 does not affect version 4.4.49-p4+tuxcare of symfony/http-foundation. not_affected \u2014 Target version v4.4.49 is NOT AFFECTED. The vulnerable code pattern (IpUtils::PRIVATE_SUBNETS constant and IpUtils::isPrivateIp method with incomplete IPv6 transition form coverage) does not exist in this version. These features were introduced in later versions: isPrivateIp in v6.3.0 (March 2023) and PRIVATE_SUBNETS in v7.2.0 (September 2024). The CVE affects versions 5.4+ where NoPrivateNetwo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48736" }, "impact_statement": "not_affected \u2014 Target version v4.4.49 is NOT AFFECTED. The vulnerable code pattern (IpUtils::PRIVATE_SUBNETS constant and IpUtils::isPrivateIp method with incomplete IPv6 transition form coverage) does not exist in this version. These features were introduced in later versions: isPrivateIp in v6.3.0 (March 2023) and PRIVATE_SUBNETS in v7.2.0 (September 2024). The CVE affects versions 5.4+ where NoPrivateNetwo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v6.4.35-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v6.4.35-p2+tuxcare" } } ], "timestamp": "2026-11-10T15:32:14.706692+00:00", "status_notes": "Vulnerability CVE-2018-14773 does not affect version v6.4.35-p2+tuxcare of symfony/http-foundation. not_affected \u2014 The target repository (Symfony HttpFoundation v6.4.35-p1+tuxcare) is not affected by CVE-2018-14773. The vulnerability involved legacy IIS headers (X-Original-URL and X-Rewrite-URL) that could override the request URI without verification. The fix, which removed support for these headers, was applied by upstream Symfony in version 4.1.3 (July 2018). Version 6.4.35, released in 2024 and onboarde...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14773" }, "impact_statement": "not_affected \u2014 The target repository (Symfony HttpFoundation v6.4.35-p1+tuxcare) is not affected by CVE-2018-14773. The vulnerability involved legacy IIS headers (X-Original-URL and X-Rewrite-URL) that could override the request URI without verification. The fix, which removed support for these headers, was applied by upstream Symfony in version 4.1.3 (July 2018). Version 6.4.35, released in 2024 and onboarde..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v6.4.35-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v6.4.35-p2+tuxcare" } } ], "timestamp": "2026-11-10T15:32:14.706692+00:00", "status_notes": "Vulnerability CVE-2019-10913 does not affect version v6.4.35-p2+tuxcare of symfony/http-foundation. The target symfony/http-foundation v6.4.35 is not affected by CVE-2019-10913. The vulnerability (unvalidated HTTP method override allowing injection attacks) is not present because the security fix was already included in the upstream Symfony v6.4.35 release that TuxCare onboarded. The getMethod() function at Request.php:1233-1266 contains complete validation: whitelist check for standard HTTP methods (line 1257) and regex validation for non-standard methods (line 1261), throwing SuspiciousOperationException for invalid input (line 1262). This is an upstream fix by nicolas.grekas@gmail.com from 2019 (commit d325ae59), which was present in v6.4.35 before TuxCare's onboarding snapshot.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10913" }, "impact_statement": "The target symfony/http-foundation v6.4.35 is not affected by CVE-2019-10913. The vulnerability (unvalidated HTTP method override allowing injection attacks) is not present because the security fix was already included in the upstream Symfony v6.4.35 release that TuxCare onboarded. The getMethod() function at Request.php:1233-1266 contains complete validation: whitelist check for standard HTTP methods (line 1257) and regex validation for non-standard methods (line 1261), throwing SuspiciousOperationException for invalid input (line 1262). This is an upstream fix by nicolas.grekas@gmail.com from 2019 (commit d325ae59), which was present in v6.4.35 before TuxCare's onboarding snapshot." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v6.4.35-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v6.4.35-p2+tuxcare" } } ], "timestamp": "2026-11-10T15:32:14.706692+00:00", "status_notes": "Vulnerability CVE-2019-18888 does not affect version v6.4.35-p2+tuxcare of symfony/http-foundation. CVE-2019-18888 affects the FileBinaryMimeTypeGuesser class in symfony/http-foundation versions 2.8.x through 4.3.7, where filenames starting with '-' could inject arbitrary arguments into the underlying 'file' command. However, the target version v6.4.35 does not contain this vulnerability. The entire MimeType namespace (including FileBinaryMimeTypeGuesser) was removed from symfony/http-foundation in upstream v5.0.0 as part of an architectural extraction to the separate symfony/mime component. Version v6.4.35 delegates all MIME type guessing to Symfony\\Component\\Mime\\MimeTypes (lines 16, 77 of File/File.php) and contains no file command invocation code. The vulnerable code never existed in v6.4.35\u2014it was removed years before this version was released.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-18888" }, "impact_statement": "CVE-2019-18888 affects the FileBinaryMimeTypeGuesser class in symfony/http-foundation versions 2.8.x through 4.3.7, where filenames starting with '-' could inject arbitrary arguments into the underlying 'file' command. However, the target version v6.4.35 does not contain this vulnerability. The entire MimeType namespace (including FileBinaryMimeTypeGuesser) was removed from symfony/http-foundation in upstream v5.0.0 as part of an architectural extraction to the separate symfony/mime component. Version v6.4.35 delegates all MIME type guessing to Symfony\\Component\\Mime\\MimeTypes (lines 16, 77 of File/File.php) and contains no file command invocation code. The vulnerable code never existed in v6.4.35\u2014it was removed years before this version was released." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v6.4.35-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v6.4.35-p2+tuxcare" } } ], "timestamp": "2026-11-10T15:32:14.706692+00:00", "status_notes": "Vulnerability CVE-2024-50345 does not affect version v6.4.35-p2+tuxcare of symfony/http-foundation. already_fixed \u2014 The target repository (symfony/http-foundation v6.4.35) already contains the complete fix for CVE-2024-50345. The URI validation checks added by the upstream patch are present at lines 369-377 of Request.php, preventing URIs with special characters from being parsed differently than browsers.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-50345" }, "impact_statement": "already_fixed \u2014 The target repository (symfony/http-foundation v6.4.35) already contains the complete fix for CVE-2024-50345. The URI validation checks added by the upstream patch are present at lines 369-377 of Request.php, preventing URIs with special characters from being parsed differently than browsers." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v6.4.35-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v6.4.35-p2+tuxcare" } } ], "timestamp": "2026-11-10T15:32:14.706692+00:00", "status_notes": "Vulnerability CVE-2025-64500 does not affect version v6.4.35-p2+tuxcare of symfony/http-foundation. already_fixed \u2014 The target repository (Symfony HttpFoundation v6.4.35) already contains the fix for CVE-2025-64500. The defense code at Request.php:1944-1945 ensures that all URL paths start with '/', preventing the vulnerability where crafted PATH_INFO could result in paths not starting with '/' and bypassing access control rules.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-64500" }, "impact_statement": "already_fixed \u2014 The target repository (Symfony HttpFoundation v6.4.35) already contains the fix for CVE-2025-64500. The defense code at Request.php:1944-1945 ensures that all URL paths start with '/', preventing the vulnerability where crafted PATH_INFO could result in paths not starting with '/' and bypassing access control rules." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v6.4.35-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v6.4.35-p2+tuxcare" } } ], "timestamp": "2026-11-10T15:32:14.706692+00:00", "status_notes": "Vulnerability CVE-2026-108082 is fixed in version v6.4.35-p2+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2026-108082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v6.4.35-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v6.4.35-p2+tuxcare" } } ], "timestamp": "2026-11-10T15:33:00.088355+00:00", "status_notes": "Vulnerability CVE-2026-118514 is fixed in version v6.4.35-p2+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2026-118514" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@v6.4.35-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@v6.4.35-p2+tuxcare" } } ], "timestamp": "2026-11-10T15:32:14.706692+00:00", "status_notes": "Vulnerability CVE-2026-48736 does not affect version v6.4.35-p2+tuxcare of symfony/http-foundation. not_affected \u2014 CVE-2026-48736 affects IpUtils::PRIVATE_SUBNETS, which omits IPv6 transition prefixes (6to4, NAT64, Teredo, IPv4-compatible). The incomplete constant exists in this repository (IpUtils.php lines 21-34), missing 5 critical ranges that the upstream fix (commit 3ebc78a9, not in HEAD) adds. However, symfony/http-foundation is a library that only EXPORTS isPrivateIp() and PRIVATE_SUBNETS\u2014its own pro...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-48736" }, "impact_statement": "not_affected \u2014 CVE-2026-48736 affects IpUtils::PRIVATE_SUBNETS, which omits IPv6 transition prefixes (6to4, NAT64, Teredo, IPv4-compatible). The incomplete constant exists in this repository (IpUtils.php lines 21-34), missing 5 critical ranges that the upstream fix (commit 3ebc78a9, not in HEAD) adds. However, symfony/http-foundation is a library that only EXPORTS isPrivateIp() and PRIVATE_SUBNETS\u2014its own pro..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 11.44.0-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is not affected by CVE-2017-14775. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database-level token comparison with constant-time hash_equals() comparison. The target version 11.44.0 already contains this fix as it was present in the upstream release when TuxCare onboarded it. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() fo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is not affected by CVE-2017-14775. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database-level token comparison with constant-time hash_equals() comparison. The target version 11.44.0 already contains this fix as it was present in the upstream release when TuxCare onboarded it. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() fo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 11.44.0-p2+tuxcare of laravel/framework. CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, allowing RCE via PHP object injection when untrusted X-XSRF-TOKEN values are unserialized. The target (Laravel 11.44.0-p4+tuxcare) is NOT AFFECTED because upstream Laravel fixed this vulnerability in August 2018 (commit c0eb9073eb by Taylor Otwell), long before version 11.44.0 was released. The fix prevents automatic PHP unserialization of decrypted cookies/headers by passing `false` to the decrypt method's serialize parameter, blocking the RCE attack chain. The vulnerable code pattern (automatic unserialization) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, allowing RCE via PHP object injection when untrusted X-XSRF-TOKEN values are unserialized. The target (Laravel 11.44.0-p4+tuxcare) is NOT AFFECTED because upstream Laravel fixed this vulnerability in August 2018 (commit c0eb9073eb by Taylor Otwell), long before version 11.44.0 was released. The fix prevents automatic PHP unserialization of decrypted cookies/headers by passing `false` to the decrypt method's serialize parameter, blocking the RCE attack chain. The vulnerable code pattern (automatic unserialization) is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-11-04T11:54:00.052758+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 11.44.0-p2+tuxcare of laravel/framework, and is fixed in 11.44.0-p5+tuxcare.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 11.44.0-p2+tuxcare of laravel/framework, and is fixed in 11.44.0-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 11.44.0-p2+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework versions before 5.8.17 due to OS command injection in the link() function of Filesystem.php. The vulnerability allowed attackers to inject arbitrary shell commands through unescaped $target and $link parameters passed to exec(). The target version 11.44.0 is NOT affected because the upstream fix (commit 44c3feb604) was already included in the upstream release when TuxCare onboarded it. The fix wraps both parameters with escapeshellarg() to prevent shell metacharacter injection. This was an upstream fix by Taylor Otwell applied in v5.8.17 (May 2019), well before version 11.44.0.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework versions before 5.8.17 due to OS command injection in the link() function of Filesystem.php. The vulnerability allowed attackers to inject arbitrary shell commands through unescaped $target and $link parameters passed to exec(). The target version 11.44.0 is NOT affected because the upstream fix (commit 44c3feb604) was already included in the upstream release when TuxCare onboarded it. The fix wraps both parameters with escapeshellarg() to prevent shell metacharacter injection. This was an upstream fix by Taylor Otwell applied in v5.8.17 (May 2019), well before version 11.44.0." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:41:49.287227+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 11.44.0-p2+tuxcare of laravel/framework. The target Laravel Framework 11.44.0-p4+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability involved a mass assignment bypass where attackers could set protected (guarded) model attributes by using fabricated keys with JSON path notation. The fix (commit 897d107 by Taylor Otwell, 2020-08-07) adds the isGuardableColumn() method that validates attribute keys against actual database columns, rejecting keys that don't correspond to real columns. This fix was already present in the upstream Laravel 11.44.0 release that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix commit predates the first TuxCare snapshot commit (c9a73e2b77b).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel Framework 11.44.0-p4+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability involved a mass assignment bypass where attackers could set protected (guarded) model attributes by using fabricated keys with JSON path notation. The fix (commit 897d107 by Taylor Otwell, 2020-08-07) adds the isGuardableColumn() method that validates attribute keys against actual database columns, rejecting keys that don't correspond to real columns. This fix was already present in the upstream Laravel 11.44.0 release that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix commit predates the first TuxCare snapshot commit (c9a73e2b77b)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 11.44.0-p2+tuxcare of laravel/framework. Laravel 11.44.0 is not affected by CVE-2021-21263. The vulnerability (query binding exploitation via unchecked array inputs) was fixed in the upstream Laravel release through commit d0954f4574 by Taylor Otwell on Jan 13, 2021. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() helper or array_slice() to limit bindings. The fix was already present in upstream Laravel 11.44.0 when TuxCare onboarded it via snapshot commit c9a73e2b77.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "Laravel 11.44.0 is not affected by CVE-2021-21263. The vulnerability (query binding exploitation via unchecked array inputs) was fixed in the upstream Laravel release through commit d0954f4574 by Taylor Otwell on Jan 13, 2021. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() helper or array_slice() to limit bindings. The fix was already present in upstream Laravel 11.44.0 when TuxCare onboarded it via snapshot commit c9a73e2b77." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:25:11.687376+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 11.44.0-p2+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 (XSS via predictable Blade parent placeholders) is not present in Laravel 11.44.0. The vulnerability pattern (deterministic sha1($section) hashes allowing placeholder prediction) was fixed by upstream Laravel in December 2021. The fix was already included in the v11.44.0 release before TuxCare onboarded it. Both critical files contain the defense: ManagesLayouts.php uses per-requ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 (XSS via predictable Blade parent placeholders) is not present in Laravel 11.44.0. The vulnerability pattern (deterministic sha1($section) hashes allowing placeholder prediction) was fixed by upstream Laravel in December 2021. The fix was already included in the v11.44.0 release before TuxCare onboarded it. Both critical files contain the defense: ManagesLayouts.php uses per-requ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 11.44.0-p2+tuxcare of laravel/framework. The target repository (laravel/framework v11.44.0-p4+tuxcare) is NOT AFFECTED by CVE-2024-52301. The vulnerability pattern has been removed by an upstream fix that was already present in Laravel v11.44.0 when TuxCare onboarded this version. The fix (commit 18b326d22d831e1fe05e737209e367e30796d5f3 by Taylor Otwell) adds a runningInConsole() check before using $_SERVER['argv'] for environment detection, preventing attackers from manipulating the application environment via crafted query strings when register_argc_argv is enabled.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target repository (laravel/framework v11.44.0-p4+tuxcare) is NOT AFFECTED by CVE-2024-52301. The vulnerability pattern has been removed by an upstream fix that was already present in Laravel v11.44.0 when TuxCare onboarded this version. The fix (commit 18b326d22d831e1fe05e737209e367e30796d5f3 by Taylor Otwell) adds a runningInConsole() check before using $_SERVER['argv'] for environment detection, preventing attackers from manipulating the application environment via crafted query strings when register_argc_argv is enabled." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 11.44.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:20:00.418969+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 11.44.0-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is NOT affected by CVE-2026-102279. The vulnerability (DOM-based XSS via Tippy.js tooltips with allowHTML: true) was introduced in Laravel 12.x and never existed in version 11.x. The target uses Tippy.js v6.3.7 without setting allowHTML, relying on the library's safe default (allowHTML: false), which prevents HTML interpretation in tooltips. Although attacker-controlled input (H...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is NOT affected by CVE-2026-102279. The vulnerability (DOM-based XSS via Tippy.js tooltips with allowHTML: true) was introduced in Laravel 12.x and never existed in version 11.x. The target uses Tippy.js v6.3.7 without setting allowHTML, relying on the library's safe default (allowHTML: false), which prevents HTML interpretation in tooltips. Although attacker-controlled input (H..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 11.44.0-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource feature, which was introduced in Laravel 12.x (commit 2f30936319, first appearing in v12.45.0). The target version (11.44.0) predates the JsonApi feature entirely. The vulnerable code path - specifically the ResolvesJsonApiElements trait that processes relationship include parameters and c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource feature, which was introduced in Laravel 12.x (commit 2f30936319, first appearing in v12.45.0). The target version (11.44.0) predates the JsonApi feature entirely. The vulnerable code path - specifically the ResolvesJsonApiElements trait that processes relationship include parameters and c..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-27T09:58:59.407356+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 11.44.0-p2+tuxcare of laravel/framework, and is fixed in 11.44.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 11.44.0-p2+tuxcare of laravel/framework, and is fixed in 11.44.0-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:46:42.693041+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 11.44.0-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 11.44.0 is NOT affected by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input passed to limit/offset/skip/take functions when using SQL Server. The fix was authored by Taylor Otwell (upstream) in commit 09bf1457e9 (April 28, 2021) and was already present in the upstream Laravel 11.44.0 release before TuxCare onboarding. The fix adds integ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The target Laravel 11.44.0 is NOT affected by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input passed to limit/offset/skip/take functions when using SQL Server. The fix was authored by Taylor Otwell (upstream) in commit 09bf1457e9 (April 28, 2021) and was already present in the upstream Laravel 11.44.0 release before TuxCare onboarding. The fix adds integ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 11.44.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:58:31.605031+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 11.44.0-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization RCE vulnerability). The security fix that disables cookie serialization was introduced by upstream Laravel in v5.6.30 (August 2018) and is fully present in the target version. The vulnerable pattern (automatic PHP object serialization/unserialization of encrypted cookies) has been removed. Cookie serialization is dis...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization RCE vulnerability). The security fix that disables cookie serialization was introduced by upstream Laravel in v5.6.30 (August 2018) and is fully present in the target version. The vulnerable pattern (automatic PHP object serialization/unserialization of encrypted cookies) has been removed. Cookie serialization is dis..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 11.44.0-p2+tuxcare of laravel/framework. not_affected \u2014 GHSA-7852-w36x-6mf6 is NOT present in laravel/framework 11.44.0-p4+tuxcare. The vulnerability was fixed upstream by Taylor Otwell on March 30, 2018 (commit 886d261df0), seven years before TuxCare onboarded this version in October 2025. The fix adds IV length validation in the Encrypter::validPayload() method at line 273, preventing manipulated encrypted payloads from causing silent decryption f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 GHSA-7852-w36x-6mf6 is NOT present in laravel/framework 11.44.0-p4+tuxcare. The vulnerability was fixed upstream by Taylor Otwell on March 30, 2018 (commit 886d261df0), seven years before TuxCare onboarded this version in October 2025. The fix adds IV length validation in the Encrypter::validPayload() method at line 273, preventing manipulated encrypted payloads from causing silent decryption f..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp is fixed in version 11.44.0-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:15:38.790655+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 11.44.0-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v11.44.0 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability requires array values to bypass flattening before being added to query bindings. The target already contains the fix: all vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use flattenValue() or equivalent Arr::flatt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework v11.44.0 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability requires array values to bypass flattening before being added to query bindings. The target already contains the fix: all vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use flattenValue() or equivalent Arr::flatt..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:18:00.235397+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 11.44.0-p2+tuxcare of laravel/framework. The target Laravel framework v11.44.0 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (RCE via cookie session driver encryption oracle). The vulnerability was fixed by upstream Laravel in July 2020 (commits 5786aa4a38 and c9ce261a9f by Taylor Otwell), which changed cookie value prefixes from predictable SHA1 hashes to HMAC-based prefixes requiring the secret encryption key. The fix was already present in Laravel v11.44.0 when TuxCare onboarded it, as confirmed by the CookieValuePrefix class using hash_hmac('sha1', $cookieName.'v2', $key) at line 16. No vulnerable pattern (simple sha1 prefix) exists in the target code.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework v11.44.0 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (RCE via cookie session driver encryption oracle). The vulnerability was fixed by upstream Laravel in July 2020 (commits 5786aa4a38 and c9ce261a9f by Taylor Otwell), which changed cookie value prefixes from predictable SHA1 hashes to HMAC-based prefixes requiring the secret encryption key. The fix was already present in Laravel v11.44.0 when TuxCare onboarded it, as confirmed by the CookieValuePrefix class using hash_hmac('sha1', $cookieName.'v2', $key) at line 16. No vulnerable pattern (simple sha1 prefix) exists in the target code." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 11.44.0-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework 11.44.0 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in Laravel 6.20.26, 7.30.5, and 8.40.0 in April 2021. Version 11.44.0 already contains the complete upstream fix with comprehensive integer casting protections in both the Query Builder and SQL Server Grammar classes. The fix was present in the upstream v11.44....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Laravel Framework 11.44.0 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in Laravel 6.20.26, 7.30.5, and 8.40.0 in April 2021. Version 11.44.0 already contains the complete upstream fix with comprehensive integer casting protections in both the Query Builder and SQL Server Grammar classes. The fix was present in the upstream v11.44...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:41:49.287227+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 11.44.0-p2+tuxcare of laravel/framework. The target laravel/framework 11.44.0-p4+tuxcare is NOT AFFECTED by GHSA-x7p5-p2c9-phvg. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalar values. The upstream Laravel framework fixed this in January 2021 (commit 9d3752ca5f by Kane Cohen) by introducing the scalarValue/flattenValue helper method that normalizes array inputs to scalar values by extracting the first element using head(Arr::flatten()). This fix was already present in the upstream Laravel 11.44.0 release that TuxCare onboarded via snapshot commit c9a73e2b77 on 2025-10-10. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the flattenValue defense in the target code at HEAD (9e3c1203). The fix is attributed to upstream, not TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "The target laravel/framework 11.44.0-p4+tuxcare is NOT AFFECTED by GHSA-x7p5-p2c9-phvg. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalar values. The upstream Laravel framework fixed this in January 2021 (commit 9d3752ca5f by Kane Cohen) by introducing the scalarValue/flattenValue helper method that normalizes array inputs to scalar values by extracting the first element using head(Arr::flatten()). This fix was already present in the upstream Laravel 11.44.0 release that TuxCare onboarded via snapshot commit c9a73e2b77 on 2025-10-10. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the flattenValue defense in the target code at HEAD (9e3c1203). The fix is attributed to upstream, not TuxCare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 11.44.0-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is not affected by CVE-2017-14775. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database-level token comparison with constant-time hash_equals() comparison. The target version 11.44.0 already contains this fix as it was present in the upstream release when TuxCare onboarded it. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() fo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is not affected by CVE-2017-14775. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database-level token comparison with constant-time hash_equals() comparison. The target version 11.44.0 already contains this fix as it was present in the upstream release when TuxCare onboarded it. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() fo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 11.44.0-p1+tuxcare of laravel/framework. CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, allowing RCE via PHP object injection when untrusted X-XSRF-TOKEN values are unserialized. The target (Laravel 11.44.0-p4+tuxcare) is NOT AFFECTED because upstream Laravel fixed this vulnerability in August 2018 (commit c0eb9073eb by Taylor Otwell), long before version 11.44.0 was released. The fix prevents automatic PHP unserialization of decrypted cookies/headers by passing `false` to the decrypt method's serialize parameter, blocking the RCE attack chain. The vulnerable code pattern (automatic unserialization) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 affects Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, allowing RCE via PHP object injection when untrusted X-XSRF-TOKEN values are unserialized. The target (Laravel 11.44.0-p4+tuxcare) is NOT AFFECTED because upstream Laravel fixed this vulnerability in August 2018 (commit c0eb9073eb by Taylor Otwell), long before version 11.44.0 was released. The fix prevents automatic PHP unserialization of decrypted cookies/headers by passing `false` to the decrypt method's serialize parameter, blocking the RCE attack chain. The vulnerable code pattern (automatic unserialization) is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-11-04T11:54:00.052758+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 11.44.0-p1+tuxcare of laravel/framework, and is fixed in 11.44.0-p5+tuxcare.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 11.44.0-p1+tuxcare of laravel/framework, and is fixed in 11.44.0-p5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 11.44.0-p1+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework versions before 5.8.17 due to OS command injection in the link() function of Filesystem.php. The vulnerability allowed attackers to inject arbitrary shell commands through unescaped $target and $link parameters passed to exec(). The target version 11.44.0 is NOT affected because the upstream fix (commit 44c3feb604) was already included in the upstream release when TuxCare onboarded it. The fix wraps both parameters with escapeshellarg() to prevent shell metacharacter injection. This was an upstream fix by Taylor Otwell applied in v5.8.17 (May 2019), well before version 11.44.0.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework versions before 5.8.17 due to OS command injection in the link() function of Filesystem.php. The vulnerability allowed attackers to inject arbitrary shell commands through unescaped $target and $link parameters passed to exec(). The target version 11.44.0 is NOT affected because the upstream fix (commit 44c3feb604) was already included in the upstream release when TuxCare onboarded it. The fix wraps both parameters with escapeshellarg() to prevent shell metacharacter injection. This was an upstream fix by Taylor Otwell applied in v5.8.17 (May 2019), well before version 11.44.0." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:41:49.287227+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 11.44.0-p1+tuxcare of laravel/framework. The target Laravel Framework 11.44.0-p4+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability involved a mass assignment bypass where attackers could set protected (guarded) model attributes by using fabricated keys with JSON path notation. The fix (commit 897d107 by Taylor Otwell, 2020-08-07) adds the isGuardableColumn() method that validates attribute keys against actual database columns, rejecting keys that don't correspond to real columns. This fix was already present in the upstream Laravel 11.44.0 release that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix commit predates the first TuxCare snapshot commit (c9a73e2b77b).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel Framework 11.44.0-p4+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability involved a mass assignment bypass where attackers could set protected (guarded) model attributes by using fabricated keys with JSON path notation. The fix (commit 897d107 by Taylor Otwell, 2020-08-07) adds the isGuardableColumn() method that validates attribute keys against actual database columns, rejecting keys that don't correspond to real columns. This fix was already present in the upstream Laravel 11.44.0 release that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix commit predates the first TuxCare snapshot commit (c9a73e2b77b)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 11.44.0-p1+tuxcare of laravel/framework. Laravel 11.44.0 is not affected by CVE-2021-21263. The vulnerability (query binding exploitation via unchecked array inputs) was fixed in the upstream Laravel release through commit d0954f4574 by Taylor Otwell on Jan 13, 2021. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() helper or array_slice() to limit bindings. The fix was already present in upstream Laravel 11.44.0 when TuxCare onboarded it via snapshot commit c9a73e2b77.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "Laravel 11.44.0 is not affected by CVE-2021-21263. The vulnerability (query binding exploitation via unchecked array inputs) was fixed in the upstream Laravel release through commit d0954f4574 by Taylor Otwell on Jan 13, 2021. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() helper or array_slice() to limit bindings. The fix was already present in upstream Laravel 11.44.0 when TuxCare onboarded it via snapshot commit c9a73e2b77." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:25:11.687376+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 11.44.0-p1+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 (XSS via predictable Blade parent placeholders) is not present in Laravel 11.44.0. The vulnerability pattern (deterministic sha1($section) hashes allowing placeholder prediction) was fixed by upstream Laravel in December 2021. The fix was already included in the v11.44.0 release before TuxCare onboarded it. Both critical files contain the defense: ManagesLayouts.php uses per-requ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 (XSS via predictable Blade parent placeholders) is not present in Laravel 11.44.0. The vulnerability pattern (deterministic sha1($section) hashes allowing placeholder prediction) was fixed by upstream Laravel in December 2021. The fix was already included in the v11.44.0 release before TuxCare onboarded it. Both critical files contain the defense: ManagesLayouts.php uses per-requ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 11.44.0-p1+tuxcare of laravel/framework. The target repository (laravel/framework v11.44.0-p4+tuxcare) is NOT AFFECTED by CVE-2024-52301. The vulnerability pattern has been removed by an upstream fix that was already present in Laravel v11.44.0 when TuxCare onboarded this version. The fix (commit 18b326d22d831e1fe05e737209e367e30796d5f3 by Taylor Otwell) adds a runningInConsole() check before using $_SERVER['argv'] for environment detection, preventing attackers from manipulating the application environment via crafted query strings when register_argc_argv is enabled.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target repository (laravel/framework v11.44.0-p4+tuxcare) is NOT AFFECTED by CVE-2024-52301. The vulnerability pattern has been removed by an upstream fix that was already present in Laravel v11.44.0 when TuxCare onboarded this version. The fix (commit 18b326d22d831e1fe05e737209e367e30796d5f3 by Taylor Otwell) adds a runningInConsole() check before using $_SERVER['argv'] for environment detection, preventing attackers from manipulating the application environment via crafted query strings when register_argc_argv is enabled." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 11.44.0-p1+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-09-29T20:20:00.418969+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 11.44.0-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is NOT affected by CVE-2026-102279. The vulnerability (DOM-based XSS via Tippy.js tooltips with allowHTML: true) was introduced in Laravel 12.x and never existed in version 11.x. The target uses Tippy.js v6.3.7 without setting allowHTML, relying on the library's safe default (allowHTML: false), which prevents HTML interpretation in tooltips. Although attacker-controlled input (H...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is NOT affected by CVE-2026-102279. The vulnerability (DOM-based XSS via Tippy.js tooltips with allowHTML: true) was introduced in Laravel 12.x and never existed in version 11.x. The target uses Tippy.js v6.3.7 without setting allowHTML, relying on the library's safe default (allowHTML: false), which prevents HTML interpretation in tooltips. Although attacker-controlled input (H..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 11.44.0-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource feature, which was introduced in Laravel 12.x (commit 2f30936319, first appearing in v12.45.0). The target version (11.44.0) predates the JsonApi feature entirely. The vulnerable code path - specifically the ResolvesJsonApiElements trait that processes relationship include parameters and c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is NOT AFFECTED by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource feature, which was introduced in Laravel 12.x (commit 2f30936319, first appearing in v12.45.0). The target version (11.44.0) predates the JsonApi feature entirely. The vulnerable code path - specifically the ResolvesJsonApiElements trait that processes relationship include parameters and c..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-27T09:58:59.407356+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 11.44.0-p1+tuxcare of laravel/framework, and is fixed in 11.44.0-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 11.44.0-p1+tuxcare of laravel/framework, and is fixed in 11.44.0-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:46:42.693041+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 11.44.0-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 11.44.0 is NOT affected by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input passed to limit/offset/skip/take functions when using SQL Server. The fix was authored by Taylor Otwell (upstream) in commit 09bf1457e9 (April 28, 2021) and was already present in the upstream Laravel 11.44.0 release before TuxCare onboarding. The fix adds integ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The target Laravel 11.44.0 is NOT affected by GHSA-4mg9-vhxq-vm7j. The vulnerability concerns SQL injection via unvalidated user input passed to limit/offset/skip/take functions when using SQL Server. The fix was authored by Taylor Otwell (upstream) in commit 09bf1457e9 (April 28, 2021) and was already present in the upstream Laravel 11.44.0 release before TuxCare onboarding. The fix adds integ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 11.44.0-p1+tuxcare of laravel/framework, and is fixed in 11.44.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 11.44.0-p1+tuxcare of laravel/framework, and is fixed in 11.44.0-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:58:31.605031+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 11.44.0-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel 11.44.0 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization RCE vulnerability). The security fix that disables cookie serialization was introduced by upstream Laravel in v5.6.30 (August 2018) and is fully present in the target version. The vulnerable pattern (automatic PHP object serialization/unserialization of encrypted cookies) has been removed. Cookie serialization is dis...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 11.44.0 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization RCE vulnerability). The security fix that disables cookie serialization was introduced by upstream Laravel in v5.6.30 (August 2018) and is fully present in the target version. The vulnerable pattern (automatic PHP object serialization/unserialization of encrypted cookies) has been removed. Cookie serialization is dis..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 11.44.0-p1+tuxcare of laravel/framework. not_affected \u2014 GHSA-7852-w36x-6mf6 is NOT present in laravel/framework 11.44.0-p4+tuxcare. The vulnerability was fixed upstream by Taylor Otwell on March 30, 2018 (commit 886d261df0), seven years before TuxCare onboarded this version in October 2025. The fix adds IV length validation in the Encrypter::validPayload() method at line 273, preventing manipulated encrypted payloads from causing silent decryption f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 GHSA-7852-w36x-6mf6 is NOT present in laravel/framework 11.44.0-p4+tuxcare. The vulnerability was fixed upstream by Taylor Otwell on March 30, 2018 (commit 886d261df0), seven years before TuxCare onboarded this version in October 2025. The fix adds IV length validation in the Encrypter::validPayload() method at line 273, preventing manipulated encrypted payloads from causing silent decryption f..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp affects version 11.44.0-p1+tuxcare of laravel/framework, and is fixed in 11.44.0-p2+tuxcare.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "action_statement": "Vulnerability GHSA-crmm-hgp2-wgrp affects version 11.44.0-p1+tuxcare of laravel/framework, and is fixed in 11.44.0-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T21:15:38.790655+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 11.44.0-p1+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v11.44.0 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability requires array values to bypass flattening before being added to query bindings. The target already contains the fix: all vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use flattenValue() or equivalent Arr::flatt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework v11.44.0 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability requires array values to bypass flattening before being added to query bindings. The target already contains the fix: all vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use flattenValue() or equivalent Arr::flatt..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:18:00.235397+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 11.44.0-p1+tuxcare of laravel/framework. The target Laravel framework v11.44.0 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (RCE via cookie session driver encryption oracle). The vulnerability was fixed by upstream Laravel in July 2020 (commits 5786aa4a38 and c9ce261a9f by Taylor Otwell), which changed cookie value prefixes from predictable SHA1 hashes to HMAC-based prefixes requiring the secret encryption key. The fix was already present in Laravel v11.44.0 when TuxCare onboarded it, as confirmed by the CookieValuePrefix class using hash_hmac('sha1', $cookieName.'v2', $key) at line 16. No vulnerable pattern (simple sha1 prefix) exists in the target code.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework v11.44.0 is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (RCE via cookie session driver encryption oracle). The vulnerability was fixed by upstream Laravel in July 2020 (commits 5786aa4a38 and c9ce261a9f by Taylor Otwell), which changed cookie value prefixes from predictable SHA1 hashes to HMAC-based prefixes requiring the secret encryption key. The fix was already present in Laravel v11.44.0 when TuxCare onboarded it, as confirmed by the CookieValuePrefix class using hash_hmac('sha1', $cookieName.'v2', $key) at line 16. No vulnerable pattern (simple sha1 prefix) exists in the target code." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 11.44.0-p1+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework 11.44.0 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in Laravel 6.20.26, 7.30.5, and 8.40.0 in April 2021. Version 11.44.0 already contains the complete upstream fix with comprehensive integer casting protections in both the Query Builder and SQL Server Grammar classes. The fix was present in the upstream v11.44....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Laravel Framework 11.44.0 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in Laravel 6.20.26, 7.30.5, and 8.40.0 in April 2021. Version 11.44.0 already contains the complete upstream fix with comprehensive integer casting protections in both the Query Builder and SQL Server Grammar classes. The fix was present in the upstream v11.44...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@11.44.0-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:41:49.287227+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 11.44.0-p1+tuxcare of laravel/framework. The target laravel/framework 11.44.0-p4+tuxcare is NOT AFFECTED by GHSA-x7p5-p2c9-phvg. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalar values. The upstream Laravel framework fixed this in January 2021 (commit 9d3752ca5f by Kane Cohen) by introducing the scalarValue/flattenValue helper method that normalizes array inputs to scalar values by extracting the first element using head(Arr::flatten()). This fix was already present in the upstream Laravel 11.44.0 release that TuxCare onboarded via snapshot commit c9a73e2b77 on 2025-10-10. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the flattenValue defense in the target code at HEAD (9e3c1203). The fix is attributed to upstream, not TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "The target laravel/framework 11.44.0-p4+tuxcare is NOT AFFECTED by GHSA-x7p5-p2c9-phvg. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalar values. The upstream Laravel framework fixed this in January 2021 (commit 9d3752ca5f by Kane Cohen) by introducing the scalarValue/flattenValue helper method that normalizes array inputs to scalar values by extracting the first element using head(Arr::flatten()). This fix was already present in the upstream Laravel 11.44.0 release that TuxCare onboarded via snapshot commit c9a73e2b77 on 2025-10-10. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the flattenValue defense in the target code at HEAD (9e3c1203). The fix is attributed to upstream, not TuxCare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v6.4.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v6.4.38-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:44:59.861604+00:00", "status_notes": "Vulnerability CVE-2022-24894 does not affect version v6.4.38-p1+tuxcare of symfony/http-kernel. not_affected \u2014 The target repository (Symfony http-kernel v6.4.38) is NOT affected by CVE-2022-24894. The vulnerability fix is already present in the codebase. The upstream Symfony v6.4.38 release shipped with the security fix (originally applied in March 2022) that prevents Set-Cookie headers from being stored in the HTTP cache. The TuxCare snapshot commit 92ea54b3 onboarded this already-fixed version. The d...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-24894" }, "impact_statement": "not_affected \u2014 The target repository (Symfony http-kernel v6.4.38) is NOT affected by CVE-2022-24894. The vulnerability fix is already present in the codebase. The upstream Symfony v6.4.38 release shipped with the security fix (originally applied in March 2022) that prevents Set-Cookie headers from being stored in the HTTP cache. The TuxCare snapshot commit 92ea54b3 onboarded this already-fixed version. The d..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v6.4.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v6.4.38-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:45:13.518225+00:00", "status_notes": "Vulnerability CVE-2026-123339 is fixed in version v6.4.38-p1+tuxcare of symfony/http-kernel.", "vulnerability": { "name": "CVE-2026-123339" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v6.4.38-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v6.4.38-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:44:59.861604+00:00", "status_notes": "Vulnerability CVE-2026-45075 does not affect version v6.4.38-p1+tuxcare of symfony/http-kernel. The target (symfony/http-kernel v6.4.38) is NOT AFFECTED by CVE-2026-45075. The vulnerable code\u2014the IsSignatureValid attribute with methods filtering\u2014was introduced in v7.4.0 and does not exist in v6.4.38. The CVE describes a HEAD request bypass vulnerability in security attributes (IsGranted, IsCsrfTokenValid, IsSignatureValid) that accept a methods parameter. In symfony/http-kernel, only IsSignatureValid is relevant, and it was added in commit e129d986 (included in v7.4.0 tag). The target predates this feature entirely. No other security attributes with methods filtering exist in v6.4.38 (only CacheAttributeListener exists, which has no methods parameter). This is Rule 5 Type A1: the INPUT (HEAD requests to endpoints protected by IsSignatureValid with methods=['GET']) cannot be received because the IsSignatureValid attribute code is not present in the target codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45075" }, "impact_statement": "The target (symfony/http-kernel v6.4.38) is NOT AFFECTED by CVE-2026-45075. The vulnerable code\u2014the IsSignatureValid attribute with methods filtering\u2014was introduced in v7.4.0 and does not exist in v6.4.38. The CVE describes a HEAD request bypass vulnerability in security attributes (IsGranted, IsCsrfTokenValid, IsSignatureValid) that accept a methods parameter. In symfony/http-kernel, only IsSignatureValid is relevant, and it was added in commit e129d986 (included in v7.4.0 tag). The target predates this feature entirely. No other security attributes with methods filtering exist in v6.4.38 (only CacheAttributeListener exists, which has no methods parameter). This is Rule 5 Type A1: the INPUT (HEAD requests to endpoints protected by IsSignatureValid with methods=['GET']) cannot be received because the IsSignatureValid attribute code is not present in the target codebase." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:10:35.682492+00:00", "status_notes": "Vulnerability CVE-2022-29248 affects version 7.9.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-29248" }, "action_statement": "Vulnerability CVE-2022-29248 affects version 7.9.3-p2+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:10:35.682492+00:00", "status_notes": "Vulnerability CVE-2022-31042 affects version 7.9.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31042" }, "action_statement": "Vulnerability CVE-2022-31042 affects version 7.9.3-p2+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:10:35.682492+00:00", "status_notes": "Vulnerability CVE-2022-31043 affects version 7.9.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31043" }, "action_statement": "Vulnerability CVE-2022-31043 affects version 7.9.3-p2+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:10:35.682492+00:00", "status_notes": "Vulnerability CVE-2022-31090 affects version 7.9.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31090" }, "action_statement": "Vulnerability CVE-2022-31090 affects version 7.9.3-p2+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:10:35.682492+00:00", "status_notes": "Vulnerability CVE-2022-31091 affects version 7.9.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31091" }, "action_statement": "Vulnerability CVE-2022-31091 affects version 7.9.3-p2+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:10:35.682492+00:00", "status_notes": "Vulnerability CVE-2026-55568 affects version 7.9.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55568" }, "action_statement": "Vulnerability CVE-2026-55568 affects version 7.9.3-p2+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:10:35.682492+00:00", "status_notes": "Vulnerability CVE-2026-55767 affects version 7.9.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55767" }, "action_statement": "Vulnerability CVE-2026-55767 affects version 7.9.3-p2+tuxcare of guzzlehttp/guzzle." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:10:35.682492+00:00", "status_notes": "Vulnerability CVE-2026-59883 is fixed in version 7.9.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-59883" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:10:35.682492+00:00", "status_notes": "Vulnerability CVE-2026-67339 affects version 7.9.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67339" }, "action_statement": "Vulnerability CVE-2026-67339 affects version 7.9.3-p2+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:10:35.682492+00:00", "status_notes": "Vulnerability CVE-2026-67353 affects version 7.9.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67353" }, "action_statement": "Vulnerability CVE-2026-67353 affects version 7.9.3-p2+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:10:35.682492+00:00", "status_notes": "Vulnerability CVE-2026-67354 affects version 7.9.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67354" }, "action_statement": "Vulnerability CVE-2026-67354 affects version 7.9.3-p2+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:10:35.682492+00:00", "status_notes": "Vulnerability CVE-2026-67355 affects version 7.9.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67355" }, "action_statement": "Vulnerability CVE-2026-67355 affects version 7.9.3-p2+tuxcare of guzzlehttp/guzzle." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:11:00.031462+00:00", "status_notes": "Vulnerability CVE-2026-69245 is fixed in version 7.9.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-69245" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:10:35.682492+00:00", "status_notes": "Vulnerability CVE-2026-69246 affects version 7.9.3-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-69246" }, "action_statement": "Vulnerability CVE-2026-69246 affects version 7.9.3-p2+tuxcare of guzzlehttp/guzzle." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:10:35.682492+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 7.9.3-p2+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:10:35.682492+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 7.9.3-p2+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:10:35.682492+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 7.9.3-p2+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:10:35.682492+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 7.9.3-p2+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p3+tuxcare" } } ], "timestamp": "2026-11-11T15:12:08.923304+00:00", "status_notes": "Vulnerability CVE-2018-14773 does not affect version 2.8.52-p3+tuxcare of symfony/http-foundation. not_affected \u2014 CVE-2018-14773 affects Symfony HttpFoundation 2.8.0-2.8.43 via untrusted X_ORIGINAL_URL and X_REWRITE_URL headers that override request URIs. The target (v2.8.52) is NOT AFFECTED\u2014the vulnerable code was removed by upstream Symfony in v2.8.44 (commit 5097611b by Nicolas Grekas). TuxCare onboarded v2.8.52 as a snapshot (commit 877d4cd2), and the fix was already present in that upstream release. N...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14773" }, "impact_statement": "not_affected \u2014 CVE-2018-14773 affects Symfony HttpFoundation 2.8.0-2.8.43 via untrusted X_ORIGINAL_URL and X_REWRITE_URL headers that override request URIs. The target (v2.8.52) is NOT AFFECTED\u2014the vulnerable code was removed by upstream Symfony in v2.8.44 (commit 5097611b by Nicolas Grekas). TuxCare onboarded v2.8.52 as a snapshot (commit 877d4cd2), and the fix was already present in that upstream release. N..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p3+tuxcare" } } ], "timestamp": "2026-11-11T15:12:08.923304+00:00", "status_notes": "Vulnerability CVE-2019-10913 does not affect version 2.8.52-p3+tuxcare of symfony/http-foundation. CVE-2019-10913 does not affect this version. The target is symfony/http-foundation v2.8.52-p2+tuxcare, which already contains the security fix. The CVE affects \"Symfony 2.8.x before 2.8.50\" - version 2.8.52 is after 2.8.50 and includes the upstream fix. The vulnerable pattern (unvalidated HTTP method override) is not present. The target code validates method overrides against a whitelist and rejects invalid characters, matching the security patch behavior.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10913" }, "impact_statement": "CVE-2019-10913 does not affect this version. The target is symfony/http-foundation v2.8.52-p2+tuxcare, which already contains the security fix. The CVE affects \"Symfony 2.8.x before 2.8.50\" - version 2.8.52 is after 2.8.50 and includes the upstream fix. The vulnerable pattern (unvalidated HTTP method override) is not present. The target code validates method overrides against a whitelist and rejects invalid characters, matching the security patch behavior." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p3+tuxcare" } } ], "timestamp": "2026-11-11T15:12:08.923304+00:00", "status_notes": "Vulnerability CVE-2019-18888 does not affect version 2.8.52-p3+tuxcare of symfony/http-foundation. The target repository symfony/http-foundation v2.8.52-p2+tuxcare is NOT AFFECTED by CVE-2019-18888. The vulnerability was fixed by upstream Symfony in version 2.8.52 (commit 3929d9fe by Nicolas Grekas on 2019-04-19), which added both `--` to the file command and `./` prepending for paths starting with `-`. The CVE lists affected versions as \"2.8.0 through 2.8.50\". TuxCare onboarded v2.8.52 which already contained the upstream fix, so the vulnerable code pattern is not present in this target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-18888" }, "impact_statement": "The target repository symfony/http-foundation v2.8.52-p2+tuxcare is NOT AFFECTED by CVE-2019-18888. The vulnerability was fixed by upstream Symfony in version 2.8.52 (commit 3929d9fe by Nicolas Grekas on 2019-04-19), which added both `--` to the file command and `./` prepending for paths starting with `-`. The CVE lists affected versions as \"2.8.0 through 2.8.50\". TuxCare onboarded v2.8.52 which already contained the upstream fix, so the vulnerable code pattern is not present in this target." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p3+tuxcare" } } ], "timestamp": "2026-11-11T15:12:08.923304+00:00", "status_notes": "Vulnerability CVE-2024-50345 is fixed in version 2.8.52-p3+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2024-50345" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p3+tuxcare" } } ], "timestamp": "2026-11-11T15:12:08.923304+00:00", "status_notes": "Vulnerability CVE-2025-64500 is fixed in version 2.8.52-p3+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2025-64500" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p3+tuxcare" } } ], "timestamp": "2026-11-11T15:12:08.923304+00:00", "status_notes": "Vulnerability CVE-2026-108082 does not affect version 2.8.52-p3+tuxcare of symfony/http-foundation. Target version v2.8.52 is NOT AFFECTED by CVE-2026-108082. The vulnerable HeaderUtils::split() method with its exponential-backtracking regex pattern does not exist in this version. HeaderUtils was introduced in Symfony HttpFoundation v4.1.0 (April 2018), while v2.8.52 is from the older 2.x series. Cache-Control header parsing in v2.8.52 uses HeaderBag::parseCacheControl() with a different regex pattern that does not exhibit the ReDoS vulnerability. This is a Type A2 case: HTTP headers are received (Input present), but the vulnerable code path does not exist, and no alternative mechanism causes exponential CPU consumption (Goal not reachable).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-108082" }, "impact_statement": "Target version v2.8.52 is NOT AFFECTED by CVE-2026-108082. The vulnerable HeaderUtils::split() method with its exponential-backtracking regex pattern does not exist in this version. HeaderUtils was introduced in Symfony HttpFoundation v4.1.0 (April 2018), while v2.8.52 is from the older 2.x series. Cache-Control header parsing in v2.8.52 uses HeaderBag::parseCacheControl() with a different regex pattern that does not exhibit the ReDoS vulnerability. This is a Type A2 case: HTTP headers are received (Input present), but the vulnerable code path does not exist, and no alternative mechanism causes exponential CPU consumption (Goal not reachable)." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p3+tuxcare" } } ], "timestamp": "2026-11-11T15:13:00.039900+00:00", "status_notes": "Vulnerability CVE-2026-118514 is fixed in version 2.8.52-p3+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2026-118514" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p3+tuxcare" } } ], "timestamp": "2026-11-11T15:12:08.923304+00:00", "status_notes": "Vulnerability CVE-2026-48736 does not affect version 2.8.52-p3+tuxcare of symfony/http-foundation. not_affected \u2014 Version 2.8.52 of symfony/http-foundation is NOT AFFECTED by CVE-2026-48736. The vulnerability requires the PRIVATE_SUBNETS constant (introduced in 6.4+) and the isPrivateIp() method, neither of which exist in version 2.8.52. This version only provides generic IP validation utilities (checkIp, checkIp4, checkIp6) without built-in private subnet detection. The vulnerable code pattern - a pre-def...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48736" }, "impact_statement": "not_affected \u2014 Version 2.8.52 of symfony/http-foundation is NOT AFFECTED by CVE-2026-48736. The vulnerability requires the PRIVATE_SUBNETS constant (introduced in 6.4+) and the isPrivateIp() method, neither of which exist in version 2.8.52. This version only provides generic IP validation utilities (checkIp, checkIp4, checkIp6) without built-in private subnet detection. The vulnerable code pattern - a pre-def..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v7.4.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v7.4.10-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:19:34.519475+00:00", "status_notes": "Vulnerability CVE-2022-24894 does not affect version v7.4.10-p2+tuxcare of symfony/http-kernel. not_affected \u2014 CVE-2022-24894 is not present in symfony/http-kernel v7.4.10-p1+tuxcare. The vulnerability (HTTP cache storing and serving Set-Cookie headers to unintended clients) was fixed in upstream Symfony versions 4.4.48, 5.4.20, and 6.0.20 (released March 2022). The target version 7.4.10 is much newer and includes the complete upstream fix: Store constructor accepts a private_headers option (defaulting ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-24894" }, "impact_statement": "not_affected \u2014 CVE-2022-24894 is not present in symfony/http-kernel v7.4.10-p1+tuxcare. The vulnerability (HTTP cache storing and serving Set-Cookie headers to unintended clients) was fixed in upstream Symfony versions 4.4.48, 5.4.20, and 6.0.20 (released March 2022). The target version 7.4.10 is much newer and includes the complete upstream fix: Store constructor accepts a private_headers option (defaulting ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v7.4.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v7.4.10-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:20:03.450498+00:00", "status_notes": "Vulnerability CVE-2026-123339 is fixed in version v7.4.10-p2+tuxcare of symfony/http-kernel.", "vulnerability": { "name": "CVE-2026-123339" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v7.4.10-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v7.4.10-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:19:34.519475+00:00", "status_notes": "Vulnerability CVE-2026-45075 is fixed in version v7.4.10-p2+tuxcare of symfony/http-kernel.", "vulnerability": { "name": "CVE-2026-45075" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p4+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p4+tuxcare" } } ], "timestamp": "2026-11-11T15:06:05.603049+00:00", "status_notes": "Vulnerability CVE-2015-8379 is fixed in version 2.10.24-p4+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2015-8379" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p4+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p4+tuxcare" } } ], "timestamp": "2026-11-11T15:06:05.603049+00:00", "status_notes": "Vulnerability CVE-2020-15400 is fixed in version 2.10.24-p4+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2020-15400" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p4+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p4+tuxcare" } } ], "timestamp": "2026-11-11T15:07:00.053303+00:00", "status_notes": "Vulnerability CVE-2026-119415 is fixed in version 2.10.24-p4+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119415" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p4+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p4+tuxcare" } } ], "timestamp": "2026-11-11T15:06:05.603049+00:00", "status_notes": "Vulnerability CVE-2026-119416 does not affect version 2.10.24-p4+tuxcare of cakephp/cakephp. not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-119416. The vulnerability describes unanchored suffix matching in the Http Client CookieCollection class, which exists in CakePHP 4.x/5.x but not in version 2.10.24. Version 2.10.24 uses a fundamentally different HTTP client architecture (HttpSocket/HttpSocketResponse) that stores cookies per-originating-host without any domain attribute matching logi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-119416" }, "impact_statement": "not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-119416. The vulnerability describes unanchored suffix matching in the Http Client CookieCollection class, which exists in CakePHP 4.x/5.x but not in version 2.10.24. Version 2.10.24 uses a fundamentally different HTTP client architecture (HttpSocket/HttpSocketResponse) that stores cookies per-originating-host without any domain attribute matching logi..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p4+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p4+tuxcare" } } ], "timestamp": "2026-11-11T15:07:00.053303+00:00", "status_notes": "Vulnerability CVE-2026-119417 is fixed in version 2.10.24-p4+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-119417" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p4+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p4+tuxcare" } } ], "timestamp": "2026-11-11T15:06:05.603049+00:00", "status_notes": "Vulnerability CVE-2026-119418 does not affect version 2.10.24-p4+tuxcare of cakephp/cakephp. not_affected \u2014 CakePHP 2.10.24-p3+tuxcare is not affected by CVE-2026-119418. The vulnerability exists in the WindowExpression class (specifically the range() and frame() methods) which was introduced in CakePHP 4.1.0. The target version 2.10.24 predates this feature by two major versions and uses the older DboSource-based query system without any Expression-based query builder architecture. The vulnerable co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-119418" }, "impact_statement": "not_affected \u2014 CakePHP 2.10.24-p3+tuxcare is not affected by CVE-2026-119418. The vulnerability exists in the WindowExpression class (specifically the range() and frame() methods) which was introduced in CakePHP 4.1.0. The target version 2.10.24 predates this feature by two major versions and uses the older DboSource-based query system without any Expression-based query builder architecture. The vulnerable co..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p4+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p4+tuxcare" } } ], "timestamp": "2026-11-11T15:06:05.603049+00:00", "status_notes": "Vulnerability CVE-2026-119419 does not affect version 2.10.24-p4+tuxcare of cakephp/cakephp. not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-119419. The vulnerability specifically targets StringExpression and IdentifierExpression classes with unvalidated collation parameters that were introduced in CakePHP 4.x (October 2020). These classes do not exist in CakePHP 2.x, which uses a completely different architecture (lib/Cake/Model/Datasource vs src/Database/Expression). While CakePHP 2.x ha...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-119419" }, "impact_statement": "not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-119419. The vulnerability specifically targets StringExpression and IdentifierExpression classes with unvalidated collation parameters that were introduced in CakePHP 4.x (October 2020). These classes do not exist in CakePHP 2.x, which uses a completely different architecture (lib/Cake/Model/Datasource vs src/Database/Expression). While CakePHP 2.x ha..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p4+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p4+tuxcare" } } ], "timestamp": "2026-11-11T15:06:05.603049+00:00", "status_notes": "Vulnerability CVE-2026-48820 is fixed in version 2.10.24-p4+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-48820" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p4+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p4+tuxcare" } } ], "timestamp": "2026-11-11T15:06:05.603049+00:00", "status_notes": "Vulnerability CVE-2026-77634 is fixed in version 2.10.24-p4+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-77634" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p4+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p4+tuxcare" } } ], "timestamp": "2026-11-11T15:06:05.603049+00:00", "status_notes": "Vulnerability CVE-2026-79752 does not affect version 2.10.24-p4+tuxcare of cakephp/cakephp. not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-79752. The vulnerable FunctionsBuilder class and its methods (cast, extract, datePart, dateAdd) do not exist in this version. The CVE describes SQL injection in CakePHP's Query Builder system introduced in version 3.x. CakePHP 2.x uses a different architecture (DboSource with active record pattern) that predates the Query Builder. Exhaustive search of...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-79752" }, "impact_statement": "not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-79752. The vulnerable FunctionsBuilder class and its methods (cast, extract, datePart, dateAdd) do not exist in this version. The CVE describes SQL injection in CakePHP's Query Builder system introduced in version 3.x. CakePHP 2.x uses a different architecture (DboSource with active record pattern) that predates the Query Builder. Exhaustive search of..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v7.4.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v7.4.10-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:23:28.883016+00:00", "status_notes": "Vulnerability CVE-2022-24894 does not affect version v7.4.10-p1+tuxcare of symfony/http-kernel. not_affected \u2014 CVE-2022-24894 is not present in symfony/http-kernel v7.4.10-p1+tuxcare. The vulnerability (HTTP cache storing and serving Set-Cookie headers to unintended clients) was fixed in upstream Symfony versions 4.4.48, 5.4.20, and 6.0.20 (released March 2022). The target version 7.4.10 is much newer and includes the complete upstream fix: Store constructor accepts a private_headers option (defaulting ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-24894" }, "impact_statement": "not_affected \u2014 CVE-2022-24894 is not present in symfony/http-kernel v7.4.10-p1+tuxcare. The vulnerability (HTTP cache storing and serving Set-Cookie headers to unintended clients) was fixed in upstream Symfony versions 4.4.48, 5.4.20, and 6.0.20 (released March 2022). The target version 7.4.10 is much newer and includes the complete upstream fix: Store constructor accepts a private_headers option (defaulting ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v7.4.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v7.4.10-p1+tuxcare" } } ], "timestamp": "2026-11-11T15:20:03.450498+00:00", "status_notes": "Vulnerability CVE-2026-123339 affects version v7.4.10-p1+tuxcare of symfony/http-kernel, and is fixed in v7.4.10-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-123339" }, "action_statement": "Vulnerability CVE-2026-123339 affects version v7.4.10-p1+tuxcare of symfony/http-kernel, and is fixed in v7.4.10-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v7.4.10-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v7.4.10-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45075 is fixed in version v7.4.10-p1+tuxcare of symfony/http-kernel.", "vulnerability": { "name": "CVE-2026-45075" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/routing@v6.4.37-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v6.4.37-p1+tuxcare" } } ], "timestamp": "2026-11-11T15:14:00.035229+00:00", "status_notes": "Vulnerability CVE-2026-118516 affects version v6.4.37-p1+tuxcare of symfony/routing, and is fixed in v6.4.37-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-118516" }, "action_statement": "Vulnerability CVE-2026-118516 affects version v6.4.37-p1+tuxcare of symfony/routing, and is fixed in v6.4.37-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v6.4.37-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v6.4.37-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45065 is fixed in version v6.4.37-p1+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-45065" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v6.4.37-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v6.4.37-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48784 is fixed in version v6.4.37-p1+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-48784" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v6.4.37-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v6.4.37-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:14:00.035229+00:00", "status_notes": "Vulnerability CVE-2026-118516 is fixed in version v6.4.37-p2+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-118516" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v6.4.37-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v6.4.37-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:13:41.754613+00:00", "status_notes": "Vulnerability CVE-2026-45065 is fixed in version v6.4.37-p2+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-45065" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v6.4.37-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v6.4.37-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:13:41.754613+00:00", "status_notes": "Vulnerability CVE-2026-48784 is fixed in version v6.4.37-p2+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-48784" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v3.4.49-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v3.4.49-p3+tuxcare" } } ], "timestamp": "2026-11-11T15:16:41.647235+00:00", "status_notes": "Vulnerability CVE-2022-24894 is fixed in version v3.4.49-p3+tuxcare of symfony/http-kernel.", "vulnerability": { "name": "CVE-2022-24894" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v3.4.49-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v3.4.49-p3+tuxcare" } } ], "timestamp": "2026-11-11T15:17:00.051144+00:00", "status_notes": "Vulnerability CVE-2026-123339 is fixed in version v3.4.49-p3+tuxcare of symfony/http-kernel.", "vulnerability": { "name": "CVE-2026-123339" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v3.4.49-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v3.4.49-p3+tuxcare" } } ], "timestamp": "2026-11-11T15:16:41.647235+00:00", "status_notes": "Vulnerability CVE-2026-45075 does not affect version v3.4.49-p3+tuxcare of symfony/http-kernel. The target repository (Symfony http-kernel v3.4.49-p1+tuxcare) does not contain the vulnerable PHP 8 attribute-based security features described in CVE-2026-45075. This version predates PHP 8 attributes by approximately 3 years and targets PHP 5.5.9+/7.0+, while the vulnerability affects PHP 8 attributes (#[IsGranted], #[IsSignatureValid], #[IsCsrfTokenValid]) introduced in Symfony 5.2+ (November 2020). The Attribute/ directory does not exist, no attribute-based security event listeners are present, and exhaustive searches confirm the complete absence of the vulnerable component. The target version is structurally incapable of having this vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45075" }, "impact_statement": "The target repository (Symfony http-kernel v3.4.49-p1+tuxcare) does not contain the vulnerable PHP 8 attribute-based security features described in CVE-2026-45075. This version predates PHP 8 attributes by approximately 3 years and targets PHP 5.5.9+/7.0+, while the vulnerability affects PHP 8 attributes (#[IsGranted], #[IsSignatureValid], #[IsCsrfTokenValid]) introduced in Symfony 5.2+ (November 2020). The Attribute/ directory does not exist, no attribute-based security event listeners are present, and exhaustive searches confirm the complete absence of the vulnerable component. The target version is structurally incapable of having this vulnerability." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v3.4.49-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v3.4.49-p2+tuxcare" } } ], "timestamp": "2026-11-04T12:50:04.472788+00:00", "status_notes": "Vulnerability CVE-2022-24894 is fixed in version v3.4.49-p2+tuxcare of symfony/http-kernel.", "vulnerability": { "name": "CVE-2022-24894" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v3.4.49-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v3.4.49-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:17:00.051144+00:00", "status_notes": "Vulnerability CVE-2026-123339 affects version v3.4.49-p2+tuxcare of symfony/http-kernel, and is fixed in v3.4.49-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-123339" }, "action_statement": "Vulnerability CVE-2026-123339 affects version v3.4.49-p2+tuxcare of symfony/http-kernel, and is fixed in v3.4.49-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v3.4.49-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v3.4.49-p2+tuxcare" } } ], "timestamp": "2026-11-04T12:50:04.472788+00:00", "status_notes": "Vulnerability CVE-2026-45075 does not affect version v3.4.49-p2+tuxcare of symfony/http-kernel. The target repository (Symfony http-kernel v3.4.49-p1+tuxcare) does not contain the vulnerable PHP 8 attribute-based security features described in CVE-2026-45075. This version predates PHP 8 attributes by approximately 3 years and targets PHP 5.5.9+/7.0+, while the vulnerability affects PHP 8 attributes (#[IsGranted], #[IsSignatureValid], #[IsCsrfTokenValid]) introduced in Symfony 5.2+ (November 2020). The Attribute/ directory does not exist, no attribute-based security event listeners are present, and exhaustive searches confirm the complete absence of the vulnerable component. The target version is structurally incapable of having this vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45075" }, "impact_statement": "The target repository (Symfony http-kernel v3.4.49-p1+tuxcare) does not contain the vulnerable PHP 8 attribute-based security features described in CVE-2026-45075. This version predates PHP 8 attributes by approximately 3 years and targets PHP 5.5.9+/7.0+, while the vulnerability affects PHP 8 attributes (#[IsGranted], #[IsSignatureValid], #[IsCsrfTokenValid]) introduced in Symfony 5.2+ (November 2020). The Attribute/ directory does not exist, no attribute-based security event listeners are present, and exhaustive searches confirm the complete absence of the vulnerable component. The target version is structurally incapable of having this vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:53:07.144747+00:00", "status_notes": "Vulnerability CVE-2022-25270 does not affect version 9.5.11-p8+tuxcare of drupal/core. not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25270" }, "impact_statement": "not_affected \u2014 The target Drupal 9.5.11 repository is NOT AFFECTED by CVE-2022-25270. The vulnerability (QuickEdit module exposing entity labels without proper access checks) was fixed by upstream Drupal in SA-CORE-2022-004 (February 2022), and this fix was already included in the Drupal 9.5.11 release that TuxCare onboarded. The fix adds an entity access check `$entity->access('view label')` before exposing ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:53:07.144747+00:00", "status_notes": "Vulnerability CVE-2022-25271 does not affect version 9.5.11-p8+tuxcare of drupal/core. CVE-2022-25271 is NOT present in the target. The vulnerable pattern (allowing user input to overwrite 'value' type form elements) was fixed in upstream Drupal releases SA-CORE-2022-003 (Feb 2022) and SA-CORE-2022-008 (Apr 2022). Drupal 9.5.11 (released Sept 2023) shipped with the comprehensive fix that excludes both 'item' and 'value' type elements from being processed as user input. The target repository's snapshot commit imported this already-fixed upstream version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25271" }, "impact_statement": "CVE-2022-25271 is NOT present in the target. The vulnerable pattern (allowing user input to overwrite 'value' type form elements) was fixed in upstream Drupal releases SA-CORE-2022-003 (Feb 2022) and SA-CORE-2022-008 (Apr 2022). Drupal 9.5.11 (released Sept 2023) shipped with the comprehensive fix that excludes both 'item' and 'value' type elements from being processed as user input. The target repository's snapshot commit imported this already-fixed upstream version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:53:07.144747+00:00", "status_notes": "Vulnerability CVE-2022-25273 does not affect version 9.5.11-p8+tuxcare of drupal/core. CVE-2022-25273 is not present in Drupal 9.5.11-p7+tuxcare. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-008 (April 2022), and the fix was already included in the Drupal 9.5.11 release (September 2023) that TuxCare later imported. The target code contains the patched version that excludes both 'item' and 'value' type form elements from input processing, preventing attackers from overwriting display-only form element values.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25273" }, "impact_statement": "CVE-2022-25273 is not present in Drupal 9.5.11-p7+tuxcare. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-008 (April 2022), and the fix was already included in the Drupal 9.5.11 release (September 2023) that TuxCare later imported. The target code contains the patched version that excludes both 'item' and 'value' type form elements from input processing, preventing attackers from overwriting display-only form element values." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:53:07.144747+00:00", "status_notes": "Vulnerability CVE-2022-25275 does not affect version 9.5.11-p8+tuxcare of drupal/core. The target repository (Drupal 9.5.11) is not affected by CVE-2022-25275. The SA-CORE-2022-012 security fix was already present in the upstream Drupal 9.5.11 release when TuxCare created the initial snapshot (commit 8233a54800). All three components of the fix are present: (1) ImageStyleDownloadController.php uses `$is_public` logic with `file_additional_public_schemes` support instead of hardcoded `$scheme == 'private'` check; (2) PublicStream.php has the `getLocalPath()` override that prevents accessing private files via public scheme; (3) system.module implements `system_file_download()` hook for additional public schemes. No TuxCare backport was required for version 9.5.11 (backport e12f4968b6 exists only for 8.9.20). The vulnerable pattern is not present in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25275" }, "impact_statement": "The target repository (Drupal 9.5.11) is not affected by CVE-2022-25275. The SA-CORE-2022-012 security fix was already present in the upstream Drupal 9.5.11 release when TuxCare created the initial snapshot (commit 8233a54800). All three components of the fix are present: (1) ImageStyleDownloadController.php uses `$is_public` logic with `file_additional_public_schemes` support instead of hardcoded `$scheme == 'private'` check; (2) PublicStream.php has the `getLocalPath()` override that prevents accessing private files via public scheme; (3) system.module implements `system_file_download()` hook for additional public schemes. No TuxCare backport was required for version 9.5.11 (backport e12f4968b6 exists only for 8.9.20). The vulnerable pattern is not present in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:53:07.144747+00:00", "status_notes": "Vulnerability CVE-2022-25276 does not affect version 9.5.11-p8+tuxcare of drupal/core. not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25276" }, "impact_statement": "not_affected \u2014 The target (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25276. The security fix for this vulnerability was already present in the upstream Drupal 9.5.11 release (commit d251a5f1ff, SA-CORE-2022-015) before TuxCare onboarded the version. The vulnerable code pattern\u2014missing domain validation for oEmbed iframe requests\u2014is not present in HEAD. The fix validates that incoming requests to t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:53:07.144747+00:00", "status_notes": "Vulnerability CVE-2022-25277 does not affect version 9.5.11-p8+tuxcare of drupal/core. The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25277. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-014 on July 20, 2022, and the fix was already present in the upstream Drupal 9.5.11 release (September 19, 2023) that TuxCare imported via snapshot commit 8233a54800. Both required defenses are present: (1) 'htaccess' added to INSECURE_EXTENSIONS array, and (2) special handling for dot-files that are also insecure extensions (e.g., .htaccess) to prevent bypass when administrators configure htaccess as an allowed extension.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25277" }, "impact_statement": "The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2022-25277. The vulnerability was fixed in upstream Drupal via SA-CORE-2022-014 on July 20, 2022, and the fix was already present in the upstream Drupal 9.5.11 release (September 19, 2023) that TuxCare imported via snapshot commit 8233a54800. Both required defenses are present: (1) 'htaccess' added to INSECURE_EXTENSIONS array, and (2) special handling for dot-files that are also insecure extensions (e.g., .htaccess) to prevent bypass when administrators configure htaccess as an allowed extension." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:53:07.144747+00:00", "status_notes": "Vulnerability CVE-2022-25278 does not affect version 9.5.11-p8+tuxcare of drupal/core. not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25278" }, "impact_statement": "not_affected \u2014 The target Drupal core 9.5.11-p7+tuxcare is NOT AFFECTED by CVE-2022-25278. The fix for the form element access evaluation vulnerability was already present in the upstream Drupal 9.5.11 release when TuxCare onboarded it. The vulnerable code pattern (loose truthy evaluation of $element['#access']) has been replaced with strict type checking that requires #access to be exactly TRUE or an AccessR..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:53:07.144747+00:00", "status_notes": "Vulnerability CVE-2023-5256 does not affect version 9.5.11-p8+tuxcare of drupal/core. The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2023-5256. The vulnerability fix (SA-CORE-2023-006) was already included in the upstream Drupal 9.5.11 release that TuxCare onboarded. The fix prevents sensitive error backtraces from being cached and exposed to unauthorized users by adding two protections: (1) setting cache max-age to 0 when verbose error reporting is enabled, and (2) requiring both 'access site reports' permission AND ERROR_REPORTING_DISPLAY_VERBOSE setting to show backtraces, instead of only checking the permission.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-5256" }, "impact_statement": "The target repository (Drupal 9.5.11-p7+tuxcare) is not affected by CVE-2023-5256. The vulnerability fix (SA-CORE-2023-006) was already included in the upstream Drupal 9.5.11 release that TuxCare onboarded. The fix prevents sensitive error backtraces from being cached and exposed to unauthorized users by adding two protections: (1) setting cache max-age to 0 when verbose error reporting is enabled, and (2) requiring both 'access site reports' permission AND ERROR_REPORTING_DISPLAY_VERBOSE setting to show backtraces, instead of only checking the permission." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:53:07.144747+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 9.5.11-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:53:07.144747+00:00", "status_notes": "Vulnerability CVE-2024-45440 is fixed in version 9.5.11-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-45440" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:53:07.144747+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 9.5.11-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:53:07.144747+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 9.5.11-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:53:07.144747+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 9.5.11-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:53:07.144747+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 9.5.11-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:53:07.144747+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 9.5.11-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:53:07.144747+00:00", "status_notes": "Vulnerability CVE-2025-13081 is fixed in version 9.5.11-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13081" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:53:07.144747+00:00", "status_notes": "Vulnerability CVE-2025-13082 is fixed in version 9.5.11-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:53:07.144747+00:00", "status_notes": "Vulnerability CVE-2025-13083 is fixed in version 9.5.11-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13083" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:53:07.144747+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 9.5.11-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:53:07.144747+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 9.5.11-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:53:07.144747+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 9.5.11-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:53:07.144747+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 9.5.11-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:53:07.144747+00:00", "status_notes": "Vulnerability CVE-2026-108097 is fixed in version 9.5.11-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-108097" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:53:07.144747+00:00", "status_notes": "Vulnerability CVE-2026-108515 does not affect version 9.5.11-p8+tuxcare of drupal/core. not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-108515" }, "impact_statement": "not_affected \u2014 CVE-2026-108515 describes an XSS vulnerability where the Link module fails to filter htmx attributes (hx-*, data-hx-*) in AttributeXss.php. While this vulnerable code pattern exists in Drupal 9.5.11-p6+tuxcare (AttributeXss.php lines 37-42 lack htmx filtering), the attack chain is broken: htmx attributes require htmx.js to execute JavaScript. Exhaustive search confirms htmx.js is completely abs..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:53:07.144747+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 9.5.11-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:53:07.144747+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 9.5.11-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:53:07.144747+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 9.5.11-p8+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:53:07.144747+00:00", "status_notes": "Vulnerability GHSA-6CCV-8FGF-CJPW is fixed in version 9.5.11-p8+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6CCV-8FGF-CJPW" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/drupal/core@9.5.11-p8+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@9.5.11-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:53:07.144747+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw does not affect version 9.5.11-p8+tuxcare of drupal/core. already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" }, "impact_statement": "already_fixed \u2014 Target repository already contains the security fix for GHSA-6ccv-8fgf-cjpw. TuxCare backported the upstream patch in commit 2de76611 (PHPELSCVE-331), adding the missing NotFoundHttpException catch block to PathBasedBreadcrumbBuilder::getRequestForPath() that prevents denial-of-service attacks via crafted comment reply URLs." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:54:42.724389+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.7.29-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 due to non-constant-time token comparison in remember_me authentication. Version 5.7.29 was released after the fix (5.5.10) and contains the upstream security patch that replaced database-level string comparison with hash_equals() constant-time comparison in both DatabaseUserProvider and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 due to non-constant-time token comparison in remember_me authentication. Version 5.7.29 was released after the fix (5.5.10) and contains the upstream security patch that replaced database-level string comparison with hash_equals() constant-time comparison in both DatabaseUserProvider and ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:54:42.724389+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.7.29-p6+tuxcare of laravel/framework. CVE-2018-15133 (RCE via unserialize on X-XSRF-TOKEN) is NOT present in Laravel 5.7.29-p4+tuxcare. The vulnerability required automatic deserialization of decrypted cookie data. The upstream fix (commit c0eb9073eb by Taylor Otwell, Aug 2018) disabled serialization by setting `static $serialize = false` and passing it to all encrypt/decrypt operations. Laravel 5.7.29 was released AFTER the fix and already includes it. The TuxCare onboarding (ba2c65e51a) imported the fixed upstream release. All decrypt operations now pass `static::serialized()` which returns `false`, preventing unserialize() from being called on user-controlled data. The vulnerable pattern is absent because the upstream fix shipped in the release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 (RCE via unserialize on X-XSRF-TOKEN) is NOT present in Laravel 5.7.29-p4+tuxcare. The vulnerability required automatic deserialization of decrypted cookie data. The upstream fix (commit c0eb9073eb by Taylor Otwell, Aug 2018) disabled serialization by setting `static $serialize = false` and passing it to all encrypt/decrypt operations. Laravel 5.7.29 was released AFTER the fix and already includes it. The TuxCare onboarding (ba2c65e51a) imported the fixed upstream release. All decrypt operations now pass `static::serialized()` which returns `false`, preventing unserialize() from being called on user-controlled data. The vulnerable pattern is absent because the upstream fix shipped in the release." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:54:42.724389+00:00", "status_notes": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.7.29-p6+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19).", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:54:42.724389+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.7.29-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:54:42.724389+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.7.29-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:54:42.724389+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.7.29-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:54:42.724389+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.7.29-p6+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:54:42.724389+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.7.29-p6+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:54:42.724389+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.7.29-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:54:42.724389+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.7.29-p6+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:54:42.724389+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.7.29-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:54:42.724389+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.7.29-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:54:42.724389+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.7.29-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework version 5.7.29 is not affected by CVE-2026-102279. This version uses the Whoops library for debug exception rendering, not Laravel's custom exception renderer with Tippy.js tooltips. The vulnerable code path (Tippy.js initialization with `allowHTML: true` for `data-tippy-content` elements) does not exist in version 5.7.29. The custom Laravel exception renderer was introduced i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel Framework version 5.7.29 is not affected by CVE-2026-102279. This version uses the Whoops library for debug exception rendering, not Laravel's custom exception renderer with Tippy.js tooltips. The vulnerable code path (Tippy.js initialization with `allowHTML: true` for `data-tippy-content` elements) does not exist in version 5.7.29. The custom Laravel exception renderer was introduced i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:54:42.724389+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.7.29-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources feature, which was introduced in Laravel 12.x (December 2025). Laravel 5.7.29 predates this feature by approximately 6 years and 5+ major versions. The target version contains only the older Json resources (not JsonApi) which do not process relationship inclusion parameters from URLs, making th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources feature, which was introduced in Laravel 12.x (December 2025). Laravel 5.7.29 predates this feature by approximately 6 years and 5+ major versions. The target version contains only the older Json resources (not JsonApi) which do not process relationship inclusion parameters from URLs, making th..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:54:42.724389+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 5.7.29-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:54:42.724389+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.7.29-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:54:42.724389+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.7.29-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 uses SwiftMailer, not Symfony Mailer. The GHSA-5vg9-5847-vvmq vulnerability specifically requires Symfony Mailer's handling of CRLF sequences. SwiftMailer employs EmailValidator which rejects CRLF in email addresses, breaking the attack chain.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 uses SwiftMailer, not Symfony Mailer. The GHSA-5vg9-5847-vvmq vulnerability specifically requires Symfony Mailer's handling of CRLF sequences. SwiftMailer employs EmailValidator which rejects CRLF in email addresses, breaking the attack chain." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:54:42.724389+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.7.29-p6+tuxcare of laravel/framework. not_affected \u2014 Target repository Laravel 5.7.29-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The fix for this vulnerability was already present in the upstream Laravel 5.7.29 release (September 2018), which shipped after the vulnerability was fixed in Laravel 5.6.30 (August 2018). The target's cookie encryption middleware disables serialization for all cookies via ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target repository Laravel 5.7.29-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The fix for this vulnerability was already present in the upstream Laravel 5.7.29 release (September 2018), which shipped after the vulnerability was fixed in Laravel 5.6.30 (August 2018). The target's cookie encryption middleware disables serialization for all cookies via ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:54:42.724389+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.7.29-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 5.7.29 code is not affected by GHSA-7852-w36x-6mf6. The IV length validation fix (checking that base64-decoded IV length matches openssl_cipher_iv_length) is already present in the Encrypter.php validPayload() method at line 210. This fix was included in the upstream Laravel 5.7.29 release (authored by Taylor Otwell in March 2018, before Laravel 5.7 was released in September ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel 5.7.29 code is not affected by GHSA-7852-w36x-6mf6. The IV length validation fix (checking that base64-decoded IV length matches openssl_cipher_iv_length) is already present in the Encrypter.php validPayload() method at line 210. This fix was included in the upstream Laravel 5.7.29 release (authored by Taylor Otwell in March 2018, before Laravel 5.7 was released in September ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:54:42.724389+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.7.29-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 does not support temporary signed URLs for local filesystem storage. The vulnerable feature (LocalFilesystemAdapter with temporaryUrl/temporaryUploadUrl methods) does not exist in this version. The FilesystemAdapter::temporaryUrl() method explicitly throws RuntimeException when used with LocalAdapter.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.7.29 does not support temporary signed URLs for local filesystem storage. The vulnerable feature (LocalFilesystemAdapter with temporaryUrl/temporaryUploadUrl methods) does not exist in this version. The FilesystemAdapter::temporaryUrl() method explicitly throws RuntimeException when used with LocalAdapter." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:54:42.724389+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.7.29-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.7.29-p6+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:54:42.724389+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.7.29-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:54:42.724389+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.7.29-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.7.29-p6+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.7.29-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:54:42.724389+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.7.29-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/routing@v4.4.44-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v4.4.44-p1+tuxcare" } } ], "timestamp": "2026-11-11T15:08:00.036701+00:00", "status_notes": "Vulnerability CVE-2026-118516 affects version v4.4.44-p1+tuxcare of symfony/routing, and is fixed in v4.4.44-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-118516" }, "action_statement": "Vulnerability CVE-2026-118516 affects version v4.4.44-p1+tuxcare of symfony/routing, and is fixed in v4.4.44-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v4.4.44-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v4.4.44-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45065 is fixed in version v4.4.44-p1+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-45065" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v4.4.44-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v4.4.44-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48784 is fixed in version v4.4.44-p1+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-48784" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v4.4.44-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v4.4.44-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:08:00.036701+00:00", "status_notes": "Vulnerability CVE-2026-118516 is fixed in version v4.4.44-p2+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-118516" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v4.4.44-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v4.4.44-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:07:35.187835+00:00", "status_notes": "Vulnerability CVE-2026-45065 is fixed in version v4.4.44-p2+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-45065" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/routing@v4.4.44-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/routing@v4.4.44-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:07:35.187835+00:00", "status_notes": "Vulnerability CVE-2026-48784 is fixed in version v4.4.44-p2+tuxcare of symfony/routing.", "vulnerability": { "name": "CVE-2026-48784" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:57:41.831258+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 6.20.45-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:57:41.831258+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 6.20.45-p8+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:57:41.831258+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 6.20.45-p8+tuxcare of laravel/framework. CVE-2018-15133 is NOT present in Laravel 6.20.45-p6+tuxcare. The vulnerability (RCE via unserialize on X-XSRF-TOKEN) was fixed in upstream Laravel 5.6.30/5.5.41 (August 2018) by disabling cookie serialization. The fix (protected static $serialize = false; using static::serialized() in decrypt calls) was already present when Laravel 6.20.45 was released and onboarded by TuxCare. The vulnerable code pattern does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 is NOT present in Laravel 6.20.45-p6+tuxcare. The vulnerability (RCE via unserialize on X-XSRF-TOKEN) was fixed in upstream Laravel 5.6.30/5.5.41 (August 2018) by disabling cookie serialization. The fix (protected static $serialize = false; using static::serialized() in decrypt calls) was already present when Laravel 6.20.45 was released and onboarded by TuxCare. The vulnerable code pattern does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:57:41.831258+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 6.20.45-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 6.20.45-p8+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:57:41.831258+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 6.20.45-p8+tuxcare of laravel/framework. The target Laravel Framework 6.20.45 is NOT vulnerable to CVE-2020-19316. The vulnerable code pattern (unescaped parameters in Windows mklink exec call) is not present. The fix using escapeshellarg() was already included in the upstream Laravel v6.20.45 release that TuxCare onboarded. The vulnerability affected Laravel before 5.8.17 (patched May 2019), and version 6.20.45 already contains the upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target Laravel Framework 6.20.45 is NOT vulnerable to CVE-2020-19316. The vulnerable code pattern (unescaped parameters in Windows mklink exec call) is not present. The fix using escapeshellarg() was already included in the upstream Laravel v6.20.45 release that TuxCare onboarded. The vulnerability affected Laravel before 5.8.17 (patched May 2019), and version 6.20.45 already contains the upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:57:41.831258+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 6.20.45-p8+tuxcare of laravel/framework. The target Laravel framework version 6.20.45-p6+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability (mass assignment bypass via non-existent column names) was fixed in upstream Laravel v6.18.35 (commit 897d107775 by Taylor Otwell). The target version 6.20.45 already contains this fix, which validates that attribute keys exist as actual database columns via the isGuardableColumn() method. The fix was shipped in the upstream release and onboarded to TuxCare via snapshot commit abbc62d18a. The vulnerable pattern (allowing mass assignment to arbitrary non-column attributes) is not present in the target code.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel framework version 6.20.45-p6+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability (mass assignment bypass via non-existent column names) was fixed in upstream Laravel v6.18.35 (commit 897d107775 by Taylor Otwell). The target version 6.20.45 already contains this fix, which validates that attribute keys exist as actual database columns via the isGuardableColumn() method. The fix was shipped in the upstream release and onboarded to TuxCare via snapshot commit abbc62d18a. The vulnerable pattern (allowing mass assignment to arbitrary non-column attributes) is not present in the target code." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:57:41.831258+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 6.20.45-p8+tuxcare of laravel/framework. CVE-2021-21263 affects Laravel versions <6.20.12. The target is version 6.20.45, which includes the upstream fix that prevents query binding exploitation. The vulnerability allowed array values to be passed to query builder methods where scalar values were expected, causing incorrect binding counts and corrupted query results. The target contains comprehensive protections using a `flattenValue()` helper method across all affected methods (where, having, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, whereBetween). The fix was present in the upstream v6.20.45 release and was imported via TuxCare's snapshot commit abbc62d18a, with no subsequent modifications to the query builder.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "CVE-2021-21263 affects Laravel versions <6.20.12. The target is version 6.20.45, which includes the upstream fix that prevents query binding exploitation. The vulnerability allowed array values to be passed to query builder methods where scalar values were expected, causing incorrect binding counts and corrupted query results. The target contains comprehensive protections using a `flattenValue()` helper method across all affected methods (where, having, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, whereBetween). The fix was present in the upstream v6.20.45 release and was imported via TuxCare's snapshot commit abbc62d18a, with no subsequent modifications to the query builder." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:57:41.831258+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 6.20.45-p8+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:57:41.831258+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 6.20.45-p8+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:57:41.831258+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 6.20.45-p8+tuxcare of laravel/framework. The target repository (Laravel framework 6.20.45-p6+tuxcare) is not affected by CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled, allowing attackers to control environment detection through $_SERVER['argv']. The fix adds a runningInConsole() check before using argv values. This fix was already present in the upstream Laravel v6.20.45 release (authored by Taylor Otwell, taylor@laravel.com, Nov 2024) before TuxCare created their snapshot. The TuxCare branch started from a snapshot of v6.20.45 (commit abbc62d18a) which already contained the fixed code. No TuxCare backport was necessary as the vulnerable code pattern never existed in this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target repository (Laravel framework 6.20.45-p6+tuxcare) is not affected by CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled, allowing attackers to control environment detection through $_SERVER['argv']. The fix adds a runningInConsole() check before using argv values. This fix was already present in the upstream Laravel v6.20.45 release (authored by Taylor Otwell, taylor@laravel.com, Nov 2024) before TuxCare created their snapshot. The TuxCare branch started from a snapshot of v6.20.45 (commit abbc62d18a) which already contained the fixed code. No TuxCare backport was necessary as the vulnerable code pattern never existed in this branch." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:57:41.831258+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 6.20.45-p8+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:57:41.831258+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 6.20.45-p8+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:57:41.831258+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 6.20.45-p8+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:57:41.831258+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 6.20.45-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:57:41.831258+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 6.20.45-p8+tuxcare of laravel/framework. not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:57:41.831258+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 6.20.45-p8+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:57:41.831258+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 6.20.45-p8+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:57:41.831258+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 6.20.45-p8+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:57:41.831258+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 6.20.45-p8+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:57:41.831258+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 6.20.45-p8+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:57:41.831258+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 6.20.45-p8+tuxcare of laravel/framework. Laravel Framework 6.20.45 is not affected by GHSA-qm5c-m76r-2hfr (encryption oracle RCE via cookie session driver). The vulnerability was fixed by upstream Laravel in version 6.18.31 on July 27, 2020, by replacing predictable SHA1 hash prefixes with keyed HMAC values in cookie encryption. Version 6.20.45 was released after this fix and already includes the CookieValuePrefix class with hash_hmac() implementation. The target contains the secure code pattern, not the vulnerable one.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel Framework 6.20.45 is not affected by GHSA-qm5c-m76r-2hfr (encryption oracle RCE via cookie session driver). The vulnerability was fixed by upstream Laravel in version 6.18.31 on July 27, 2020, by replacing predictable SHA1 hash prefixes with keyed HMAC values in cookie encryption. Version 6.20.45 was released after this fix and already includes the CookieValuePrefix class with hash_hmac() implementation. The target contains the secure code pattern, not the vulnerable one." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:57:41.831258+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 6.20.45-p8+tuxcare of laravel/framework. not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p8+tuxcare" } } ], "timestamp": "2026-11-11T16:57:41.831258+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 6.20.45-p8+tuxcare of laravel/framework. The target repository (Laravel 6.20.45) is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involving unexpected query bindings from array values has already been fixed in the upstream Laravel release v6.20.11 (Jan 13, 2021) and v6.20.14 (Jan 21, 2021), which were released well before v6.20.45. All query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the `flattenValue()` helper method to extract scalar values from array inputs, preventing the SQL binding mismatch vulnerability. The fix was authored by Taylor Otwell for the upstream Laravel framework and was included in the v6.20.45 release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "The target repository (Laravel 6.20.45) is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involving unexpected query bindings from array values has already been fixed in the upstream Laravel release v6.20.11 (Jan 13, 2021) and v6.20.14 (Jan 21, 2021), which were released well before v6.20.45. All query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the `flattenValue()` helper method to extract scalar values from array inputs, preventing the SQL binding mismatch vulnerability. The fix was authored by Taylor Otwell for the upstream Laravel framework and was included in the v6.20.45 release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-27902 is an XSS vulnerability in Craft CMS allowing malicious script execution via uploaded HTML files. The vendor patch (commit 8ee85a8f03c143fa2420e7d6f311d95cae3b19ce, Jan 2021) removed 'htm' and 'html' from the default allowedFileExtensions array in src/config/GeneralConfig.php. Analysis of the target repository (craftcms/cms 4.18.9-p1+tuxcare at SHA 9f8c824e72) confirms the allowe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 CVE-2021-27902 is an XSS vulnerability in Craft CMS allowing malicious script execution via uploaded HTML files. The vendor patch (commit 8ee85a8f03c143fa2420e7d6f311d95cae3b19ce, Jan 2021) removed 'htm' and 'html' from the default allowedFileExtensions array in src/config/GeneralConfig.php. Analysis of the target repository (craftcms/cms 4.18.9-p1+tuxcare at SHA 9f8c824e72) confirms the allowe..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 4.18.9-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 4.18.9-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is not affected by CVE-2021-32470. The vulnerability (XSS via unescaped prompt input in FieldLayoutDesigner.js) was fixed in upstream Craft CMS 3.6.13. Version 4.18.9 inherited this fix from upstream - the code at src/web/assets/cp/src/js/FieldLayoutDesigner.js:150-151 properly wraps the prompt() result with Craft.escapeHtml() before DOM insertion, preventing the XSS attac...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is not affected by CVE-2021-32470. The vulnerability (XSS via unescaped prompt input in FieldLayoutDesigner.js) was fixed in upstream Craft CMS 3.6.13. Version 4.18.9 inherited this fix from upstream - the code at src/web/assets/cp/src/js/FieldLayoutDesigner.js:150-151 properly wraps the prompt() result with Craft.escapeHtml() before DOM insertion, preventing the XSS attac..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 4.18.9-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 4.18.9-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 is an XSS vulnerability in Craft CMS FeedWidget where malicious feed data with javascript: URLs in permalink fields could execute arbitrary JavaScript. The fix validates that permalinks start with http:// or https:// before processing. Target version 4.18.9 already contains this fix - it was present in the upstream release when TuxCare onboarded it. The vulnerable pattern (unvali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 is an XSS vulnerability in Craft CMS FeedWidget where malicious feed data with javascript: URLs in permalink fields could execute arbitrary JavaScript. The fix validates that permalinks start with http:// or https:// before processing. Target version 4.18.9 already contains this fix - it was present in the upstream release when TuxCare onboarded it. The vulnerable pattern (unvali..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2022-29933 is fixed in version 4.18.9-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS version 4.2.0.1. The target is running version 4.18.9, which already contains all the XSS fixes from the upstream vendor. The vulnerability pattern (unescaped HTML rendering of user-controlled strings) is not present in the target because HTML encoding (`Html::encode()`, Twig `|e` filter, `Craft.escapeHtml()`) has been applied to all affected f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS version 4.2.0.1. The target is running version 4.18.9, which already contains all the XSS fixes from the upstream vendor. The vulnerability pattern (unescaped HTML rendering of user-controlled strings) is not present in the target because HTML encoding (`Html::encode()`, Twig `|e` filter, `Craft.escapeHtml()`) has been applied to all affected f..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 4.18.9-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 4.18.9-p4+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 4.18.9-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 4.18.9-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-30177 affects CraftCMS prior to version 3.7.68 due to XSS via unencoded volume name output. The target version 4.18.9-p1+tuxcare is NOT vulnerable. The fix was already present in the upstream 4.18.9 release when TuxCare onboarded it. Both output locations use HTML encoding: src/elements/Asset.php line 2804 applies Html::encode() directly, and line 1424 breadcrumbs are auto-encoded by t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 CVE-2023-30177 affects CraftCMS prior to version 3.7.68 due to XSS via unencoded volume name output. The target version 4.18.9-p1+tuxcare is NOT vulnerable. The fix was already present in the upstream 4.18.9 release when TuxCare onboarded it. Both output locations use HTML encoding: src/elements/Asset.php line 2804 applies Html::encode() directly, and line 1424 breadcrumbs are auto-encoded by t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-31144 (XSS via malformed feed widget titles) is NOT present in CraftCMS 4.18.9-p1+tuxcare. The vulnerability required JSON_UNESCAPED_SLASHES flag to be set, allowing unescaped forward slashes in JSON output that could break out of script contexts (e.g., via \"\" in feed titles). The upstream vendor (Pixel & Tonic) fixed this by removing JSON_UNESCAPED_SLASHES from the default en...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "not_affected \u2014 CVE-2023-31144 (XSS via malformed feed widget titles) is NOT present in CraftCMS 4.18.9-p1+tuxcare. The vulnerability required JSON_UNESCAPED_SLASHES flag to be set, allowing unescaped forward slashes in JSON output that could break out of script contexts (e.g., via \"\" in feed titles). The upstream vendor (Pixel & Tonic) fixed this by removing JSON_UNESCAPED_SLASHES from the default en..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is not present in the target. The fix was authored by brandon@pixelandtonic.com (Pixel & Tonic - upstream vendor) on April 3, 2023 in commit 9d0cd0bda7, and shipped with upstream Craft CMS 4.18.9. TuxCare onboarded version 4.18.9 on October 3, 2026, which already contained the fix. The vulnerable pattern (HTML string concatenation) is...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is not present in the target. The fix was authored by brandon@pixelandtonic.com (Pixel & Tonic - upstream vendor) on April 3, 2023 in commit 9d0cd0bda7, and shipped with upstream Craft CMS 4.18.9. TuxCare onboarded version 4.18.9 on October 3, 2026, which already contained the fix. The vulnerable pattern (HTML string concatenation) is..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2023-33495 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33495 (HTML injection in Craft CMS through 4.4.9) is not present in version 4.18.9. The vulnerable pattern (unsafe HTML rendering of exporter names via `html: option.label` in UI.js) was fixed by upstream vendor Pixel & Tonic in commit 57334cd435 (2026-01-04). The fix uses jQuery's `.text()` method which safely escapes HTML. This fix was already present in the upstream 4.18.9 release w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33495" }, "impact_statement": "not_affected \u2014 CVE-2023-33495 (HTML injection in Craft CMS through 4.4.9) is not present in version 4.18.9. The vulnerable pattern (unsafe HTML rendering of exporter names via `html: option.label` in UI.js) was fixed by upstream vendor Pixel & Tonic in commit 57334cd435 (2026-01-04). The fix uses jQuery's `.text()` method which safely escapes HTML. This fix was already present in the upstream 4.18.9 release w..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2023-36260 is a false positive for craftcms/cms 4.18.9-p4+tuxcare. CVE-2023-36260 is a false positive for this repository. The CVE describes a DoS vulnerability in the Feed-Me plugin (craftcms/feed-me) related to saving feeds with asset element types and no volume selected. This repository is craftcms/cms (Craft CMS core version 4.18.9), which does not include, vendor, or depend on the Feed-Me plugin. The Feed-Me plugin is a separate package for content import functionality. The core CMS contains only a simple Feed widget for displaying RSS feeds, which lacks the asset/volume functionality described in the CVE.", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "CVE-2023-36260 is a false positive for this repository. The CVE describes a DoS vulnerability in the Feed-Me plugin (craftcms/feed-me) related to saving feeds with asset element types and no volume selected. This repository is craftcms/cms (Craft CMS core version 4.18.9), which does not include, vendor, or depend on the Feed-Me plugin. The Feed-Me plugin is a separate package for content import functionality. The core CMS contains only a simple Feed widget for displaying RSS feeds, which lacks the asset/volume functionality described in the CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2023-40035 affects version 4.18.9-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-40035" }, "action_statement": "Vulnerability CVE-2023-40035 affects version 4.18.9-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2024-21622 describes a privilege escalation vulnerability in Craft CMS that was fixed in versions 4.4.16 and 3.9.6. The target is running Craft CMS 4.18.9, which is significantly newer than the fixed version. Analysis confirms both security patches are present in the target code: (1) ElementsController.php implements double authorization checks before and after applying POST parameters, and...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "not_affected \u2014 CVE-2024-21622 describes a privilege escalation vulnerability in Craft CMS that was fixed in versions 4.4.16 and 3.9.6. The target is running Craft CMS 4.18.9, which is significantly newer than the fixed version. Analysis confirms both security patches are present in the target code: (1) ElementsController.php implements double authorization checks before and after applying POST parameters, and..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 4.18.9-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 4.18.9-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 4.18.9 is not affected by CVE-2024-41800. The vulnerability concerns TOTP token reuse in Craft CMS 5's two-factor authentication system. TOTP authentication functionality was introduced in Craft CMS 5 and does not exist in Craft 4. The target repository contains no TOTP implementation code, no Google2FA dependency, no authenticator database tables, and no TOTP verification methods. Th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 4.18.9 is not affected by CVE-2024-41800. The vulnerability concerns TOTP token reuse in Craft CMS 5's two-factor authentication system. TOTP authentication functionality was introduced in Craft CMS 5 and does not exist in Craft 4. The target repository contains no TOTP implementation code, no Google2FA dependency, no authenticator database tables, and no TOTP verification methods. Th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2024-52291 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. CVE-2024-52291 is NOT present in CraftCMS 4.18.9. The vulnerability involved bypassing local filesystem validation using double file:// schemes (e.g., file://file:////), but the upstream fix was already included in version 4.18.9 when TuxCare onboarded it. The vulnerable code pattern (StringHelper::removeLeft) was replaced with a secure regex pattern that removes all consecutive file:// prefixes.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52291" }, "impact_statement": "CVE-2024-52291 is NOT present in CraftCMS 4.18.9. The vulnerability involved bypassing local filesystem validation using double file:// schemes (e.g., file://file:////), but the upstream fix was already included in version 4.18.9 when TuxCare onboarded it. The vulnerable code pattern (StringHelper::removeLeft) was replaced with a secure regex pattern that removes all consecutive file:// prefixes." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2024-52292 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. The target repository (Craft CMS 4.18.9) is NOT affected by CVE-2024-52292. The vulnerability pattern\u2014unrestricted absolute file path reading via the dataUrl() function\u2014is not present. The fix (path containment validation at src/helpers/Html.php:995-999) was included in upstream Craft CMS 4.18.9 before TuxCare onboarded the version on 2026-09-24. The snapshot commit imported the already-fixed codebase, and no subsequent modifications were made to the dataUrl() function on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52292" }, "impact_statement": "The target repository (Craft CMS 4.18.9) is NOT affected by CVE-2024-52292. The vulnerability pattern\u2014unrestricted absolute file path reading via the dataUrl() function\u2014is not present. The fix (path containment validation at src/helpers/Html.php:995-999) was included in upstream Craft CMS 4.18.9 before TuxCare onboarded the version on 2026-09-24. The snapshot commit imported the already-fixed codebase, and no subsequent modifications were made to the dataUrl() function on this branch." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. CVE-2024-52293 is NOT present in the target. The vulnerability (missing normalizePath in FileHelper::absolutePath) was fixed by upstream Craft CMS in version 4.12.2 (commit 123e48a696, 2024-09-11, author brandon@pixelandtonic.com). The target version 4.18.9 already includes this fix from the upstream release. Line 136 of FileHelper.php contains 'return static::normalizePath($from . $ds . $to, $ds);', which is the fixed version that prevents directory traversal attacks. The vulnerable pattern (raw concatenation without normalization) is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 is NOT present in the target. The vulnerability (missing normalizePath in FileHelper::absolutePath) was fixed by upstream Craft CMS in version 4.12.2 (commit 123e48a696, 2024-09-11, author brandon@pixelandtonic.com). The target version 4.18.9 already includes this fix from the upstream release. Line 136 of FileHelper.php contains 'return static::normalizePath($from . $ds . $to, $ds);', which is the fixed version that prevents directory traversal attacks. The vulnerable pattern (raw concatenation without normalization) is not present." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 4.18.9-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 4.18.9-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. The target repository (Craft CMS 4.18.9) is not affected by CVE-2025-23209. The vulnerable method UpdaterController::actionRestoreDb() has been completely disabled and now throws NotSupportedException, preventing any path traversal attack that could lead to RCE. This fix was already present in upstream Craft CMS 4.18.9 before TuxCare onboarded the version. The fixing commit a19d46be78 by brandon@pixelandtonic.com (upstream vendor) shipped in the 4.18.9 release, which TuxCare subsequently onboarded via snapshot commit b1a16b0026.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "The target repository (Craft CMS 4.18.9) is not affected by CVE-2025-23209. The vulnerable method UpdaterController::actionRestoreDb() has been completely disabled and now throws NotSupportedException, preventing any path traversal attack that could lead to RCE. This fix was already present in upstream Craft CMS 4.18.9 before TuxCare onboarded the version. The fixing commit a19d46be78 by brandon@pixelandtonic.com (upstream vendor) shipped in the 4.18.9 release, which TuxCare subsequently onboarded via snapshot commit b1a16b0026." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. The target repository (craftcms/cms version 4.18.9) is not affected by CVE-2025-32432. The RCE vulnerability, which exploited missing type validation on the transform handle parameter, was fixed in upstream version 4.14.15. The fix is present in the target's version 4.18.9, which was imported via snapshot commit b1a16b0026 on 2026-09-24. The type check at src/controllers/AssetsController.php:1208-1210 prevents non-string values (objects/arrays) from reaching the vulnerable ImageTransforms::normalizeTransform() method, blocking the RCE attack vector.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "The target repository (craftcms/cms version 4.18.9) is not affected by CVE-2025-32432. The RCE vulnerability, which exploited missing type validation on the transform handle parameter, was fixed in upstream version 4.14.15. The fix is present in the target's version 4.18.9, which was imported via snapshot commit b1a16b0026 on 2026-09-24. The type check at src/controllers/AssetsController.php:1208-1210 prevents non-string values (objects/arrays) from reaching the vulnerable ImageTransforms::normalizeTransform() method, blocking the RCE attack vector." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2025-35939 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is NOT affected by CVE-2025-35939. The vulnerability (storing unsanitized return URLs with arbitrary content/PHP code in session files) is absent because the upstream Craft CMS 4.18.9 release already included the fix. The target's src/web/User.php:473-480 contains a setReturnUrl() method that applies strip_tags() to remove HTML/PHP tags and validates URL schemes before sto...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-35939" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is NOT affected by CVE-2025-35939. The vulnerability (storing unsanitized return URLs with arbitrary content/PHP code in session files) is absent because the upstream Craft CMS 4.18.9 release already included the fix. The target's src/web/User.php:473-480 contains a setReturnUrl() method that applies strip_tags() to remove HTML/PHP tags and validates URL schemes before sto..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2025-46731 is fixed in version 4.18.9-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-46731" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2025-57811 is fixed in version 4.18.9-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-57811" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is NOT vulnerable to CVE-2025-68436. The fix that prevents mass assignment of the photoId attribute was released upstream in Craft CMS version 4.16.17 (December 2025). Version 4.18.9, released September 2026, inherits this fix. The defense code (safeAttributes() method removing 'photoId' from mass-assignable attributes) is present in the target at src/elements/User.php:924...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is NOT vulnerable to CVE-2025-68436. The fix that prevents mass assignment of the photoId attribute was released upstream in Craft CMS version 4.16.17 (December 2025). Version 4.18.9, released September 2026, inherits this fix. The defense code (safeAttributes() method removing 'photoId' from mass-assignable attributes) is present in the target at src/elements/User.php:924..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2025-68437 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 4.18.9 is not affected by CVE-2025-68437 (SSRF via GraphQL save__Asset mutation). The vulnerable pattern is not present because the upstream 4.18.9 release already includes comprehensive SSRF protection via the craftcms/url-validator package. The fix validates URLs and rejects those containing IP addresses or targeting internal resources before any connection is ma...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68437" }, "impact_statement": "not_affected \u2014 Craft CMS version 4.18.9 is not affected by CVE-2025-68437 (SSRF via GraphQL save__Asset mutation). The vulnerable pattern is not present because the upstream 4.18.9 release already includes comprehensive SSRF protection via the craftcms/url-validator package. The fix validates URLs and rejects those containing IP addresses or targeting internal resources before any connection is ma..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2025-68454 is fixed in version 4.18.9-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68454" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. The target version 4.18.9 is not affected by CVE-2025-68455. The vulnerability was fixed by the upstream vendor in version 4.16.17 (released 2025-12-04) via commits that add Component::cleanseConfig() calls to sanitize configuration arrays before object instantiation. Version 4.18.9 (released 2026-09-17) already contains these fixes from the upstream vendor. The fix prevents RCE via malicious Yii2 behaviors by removing \"on \" and \"as \" keys from user-provided configuration arrays, which would otherwise allow attackers to attach malicious behaviors or event handlers to dynamically configured objects.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "The target version 4.18.9 is not affected by CVE-2025-68455. The vulnerability was fixed by the upstream vendor in version 4.16.17 (released 2025-12-04) via commits that add Component::cleanseConfig() calls to sanitize configuration arrays before object instantiation. Version 4.18.9 (released 2026-09-17) already contains these fixes from the upstream vendor. The fix prevents RCE via malicious Yii2 behaviors by removing \"on \" and \"as \" keys from user-provided configuration arrays, which would otherwise allow attackers to attach malicious behaviors or event handlers to dynamically configured objects." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2025-68456 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. The target repository (craftcms/cms version 4.18.9) is NOT AFFECTED by CVE-2025-68456. The upstream vendor fix that prevents unauthenticated database backup triggering is already present in the codebase at src/controllers/UpdaterController.php lines 72-75. This fix was shipped in upstream release 4.18.9 (commit 1718011a5f by brandon@pixelandtonic.com) before TuxCare onboarded the version. The fix adds a precondition check that only allows the actionBackup() method to execute database backups when migrations are pending, effectively preventing the DoS attack via repeated arbitrary backup requests described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68456" }, "impact_statement": "The target repository (craftcms/cms version 4.18.9) is NOT AFFECTED by CVE-2025-68456. The upstream vendor fix that prevents unauthenticated database backup triggering is already present in the codebase at src/controllers/UpdaterController.php lines 72-75. This fix was shipped in upstream release 4.18.9 (commit 1718011a5f by brandon@pixelandtonic.com) before TuxCare onboarded the version. The fix adds a precondition check that only allows the actionBackup() method to execute database backups when migrations are pending, effectively preventing the DoS attack via repeated arbitrary backup requests described in the CVE." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-115934 affects version 4.18.9-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115934" }, "action_statement": "Vulnerability CVE-2026-115934 affects version 4.18.9-p4+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-115935 affects version 4.18.9-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115935" }, "action_statement": "Vulnerability CVE-2026-115935 affects version 4.18.9-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-115938 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 The target Craft CMS 4.18.9-p2+tuxcare is NOT AFFECTED by CVE-2026-115938. The vulnerability (Twig sandbox escape in element-search conditions leading to securityKey leakage and RCE) was fixed in upstream Craft CMS 4.17.4 (Feb 11, 2026) via commit 8d4903647d by brandon@pixelandtonic.com, which changed BaseElementSelectConditionRule.php to use renderSandboxedObjectTemplate() instead of the unsan...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-115938" }, "impact_statement": "not_affected \u2014 The target Craft CMS 4.18.9-p2+tuxcare is NOT AFFECTED by CVE-2026-115938. The vulnerability (Twig sandbox escape in element-search conditions leading to securityKey leakage and RCE) was fixed in upstream Craft CMS 4.17.4 (Feb 11, 2026) via commit 8d4903647d by brandon@pixelandtonic.com, which changed BaseElementSelectConditionRule.php to use renderSandboxedObjectTemplate() instead of the unsan..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 4.18.9 is not affected by CVE-2026-25491. While the Twig template does not apply the |e escape filter to entry type names (line 28 of _entrytypes/index.twig), the architecture uses Vue.js client-side rendering with automatic HTML escaping via {{ }} interpolation syntax (App.vue:115,120). Additionally, JSON encoding provides JavaScript context protection. The CVE affects versions 5.0.0...", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Craft CMS 4.18.9 is not affected by CVE-2026-25491. While the Twig template does not apply the |e escape filter to entry type names (line 28 of _entrytypes/index.twig), the architecture uses Vue.js client-side rendering with automatic HTML escaping via {{ }} interpolation syntax (App.vue:115,120). Additionally, JSON encoding provides JavaScript context protection. The CVE affects versions 5.0.0..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-25493 (SSRF via HTTP redirect bypass) is NOT present in craftcms/cms 4.18.9. The target version already contains the upstream vendor fix (RequestOptions::ALLOW_REDIRECTS => false) from Craft CMS 4.16.18+. The vulnerability affected versions 4.0.0-RC1 through 4.16.17; target version 4.18.9 is beyond the patched threshold. The fix was implemented by Pixel & Tonic (upstream vendor) in com...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 CVE-2026-25493 (SSRF via HTTP redirect bypass) is NOT present in craftcms/cms 4.18.9. The target version already contains the upstream vendor fix (RequestOptions::ALLOW_REDIRECTS => false) from Craft CMS 4.16.18+. The vulnerability affected versions 4.0.0-RC1 through 4.16.17; target version 4.18.9 is beyond the patched threshold. The fix was implemented by Pixel & Tonic (upstream vendor) in com..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-25494 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is not affected by CVE-2026-25494. The vulnerability (hex-encoded IP bypass in saveAsset GraphQL mutation) was fixed in upstream version 4.16.18 (Jan 2026). TuxCare's snapshot of 4.18.9 (Sep 2026) already includes the fix via the craftcms/url-validator package v1.0.0, which contains hex-to-decimal normalization and cloud metadata blocklists. The vulnerable pattern (relying...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is not affected by CVE-2026-25494. The vulnerability (hex-encoded IP bypass in saveAsset GraphQL mutation) was fixed in upstream version 4.16.18 (Jan 2026). TuxCare's snapshot of 4.18.9 (Sep 2026) already includes the fix via the craftcms/url-validator package v1.0.0, which contains hex-to-decimal normalization and cloud metadata blocklists. The vulnerable pattern (relying..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. The target (craftcms/cms v4.18.9) is NOT AFFECTED by CVE-2026-25495. The SQL injection vulnerability described in the CVE has been fixed by the upstream vendor (Pixel & Tonic) in version 4.17.4. The fix was already present when TuxCare onboarded version 4.18.9. The defense mechanism `ElementHelper::cleanseQueryCriteria()` removes dangerous SQL clause parameters (orderBy, where, select, from, groupBy, join, having, union, withQueries, params) from user-supplied criteria before database query construction, preventing arbitrary SQL injection. This is an upstream vendor fix, not a TuxCare backport, hence verdict is not_affected rather than already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "The target (craftcms/cms v4.18.9) is NOT AFFECTED by CVE-2026-25495. The SQL injection vulnerability described in the CVE has been fixed by the upstream vendor (Pixel & Tonic) in version 4.17.4. The fix was already present when TuxCare onboarded version 4.18.9. The defense mechanism `ElementHelper::cleanseQueryCriteria()` removes dangerous SQL clause parameters (orderBy, where, select, from, groupBy, join, having, union, withQueries, params) from user-supplied criteria before database query construction, preventing arbitrary SQL injection. This is an upstream vendor fix, not a TuxCare backport, hence verdict is not_affected rather than already_fixed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-25496 is NOT present in Craft CMS 4.18.9. The stored XSS vulnerability in Number field prefix/suffix rendering has been fixed by the upstream vendor. The target's Number/input.twig template includes the security fix (encode=true parameter added to the md filter on lines 28 and 43), which HTML-encodes prefix/suffix values before Markdown processing, preventing script injection. This fix...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 CVE-2026-25496 is NOT present in Craft CMS 4.18.9. The stored XSS vulnerability in Number field prefix/suffix rendering has been fixed by the upstream vendor. The target's Number/input.twig template includes the security fix (encode=true parameter added to the md filter on lines 28 and 43), which HTML-encodes prefix/suffix values before Markdown processing, preventing script injection. This fix..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. CVE-2026-25498 (GHSA-7jx7-3846-m7w7) is NOT present in the target. The vulnerability affects Craft CMS versions 4.0.0-RC1 through 4.16.17, where assembleLayoutFromPost() in src/services/Fields.php fails to sanitize user-supplied configuration data, allowing RCE via Yii2 behavior injection. The fix was released in upstream Craft CMS 4.16.18 (2026-01-09), adding ComponentHelper::cleanseConfig() to remove malicious \"on \" and \"as \" prefixed configuration keys. The target version 4.18.9 (released 2026-09-17) already includes this upstream fix. Analysis confirmed the fix is present at Fields.php:1286, and it was imported during the snapshot/onboarding of version 4.18.9, not added by TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "CVE-2026-25498 (GHSA-7jx7-3846-m7w7) is NOT present in the target. The vulnerability affects Craft CMS versions 4.0.0-RC1 through 4.16.17, where assembleLayoutFromPost() in src/services/Fields.php fails to sanitize user-supplied configuration data, allowing RCE via Yii2 behavior injection. The fix was released in upstream Craft CMS 4.16.18 (2026-01-09), adding ComponentHelper::cleanseConfig() to remove malicious \"on \" and \"as \" prefixed configuration keys. The target version 4.18.9 (released 2026-09-17) already includes this upstream fix. Analysis confirmed the fix is present at Fields.php:1286, and it was imported during the snapshot/onboarding of version 4.18.9, not added by TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 contains the complete XSS fix that was released upstream in Craft CMS 4.16.19. The fix includes three defenses: (1) a typeOptions() whitelist excluding 'html' as a valid column type, (2) validateColumns() that rejects unsupported column types and defaults them to 'singleline', and (3) HTML encoding of 'heading' column values in _getInputHtml(). All three fixes are present ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 contains the complete XSS fix that was released upstream in Craft CMS 4.16.19. The fix includes three defenses: (1) a typeOptions() whitelist excluding 'html' as a valid column type, (2) validateColumns() that rejects unsupported column types and defaults them to 'singleline', and (3) HTML encoding of 'heading' column values in _getInputHtml(). All three fixes are present ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-27127 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. Target version 4.18.9 is NOT AFFECTED by CVE-2026-27127 (DNS rebinding TOCTOU SSRF vulnerability). The upstream Craft CMS 4.18.9 release already contains the complete DNS pinning fix that prevents DNS rebinding attacks. The fix implements both CURLOPT_RESOLVE to pin DNS resolution and ON_STATS callback to validate the actual connected IP, eliminating the TOCTOU vulnerability between validation and request.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27127" }, "impact_statement": "Target version 4.18.9 is NOT AFFECTED by CVE-2026-27127 (DNS rebinding TOCTOU SSRF vulnerability). The upstream Craft CMS 4.18.9 release already contains the complete DNS pinning fix that prevents DNS rebinding attacks. The fix implements both CURLOPT_RESOLVE to pin DNS resolution and ON_STATS callback to validate the actual connected IP, eliminating the TOCTOU vulnerability between validation and request." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.9) is NOT AFFECTED by CVE-2026-27128. The TOCTOU race condition vulnerability in token validation has already been fixed by the upstream vendor. The fix (mutex-based synchronization wrapping the read-check-update sequence in getTokenRoute()) was included in upstream release 4.16.19 and is present in the target's version 4.18.9. TuxCare onboarded version 4.18.9 via sna...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.9) is NOT AFFECTED by CVE-2026-27128. The TOCTOU race condition vulnerability in token validation has already been fixed by the upstream vendor. The fix (mutex-based synchronization wrapping the read-check-update sequence in getTokenRoute()) was included in upstream release 4.16.19 and is present in the target's version 4.18.9. TuxCare onboarded version 4.18.9 via sna..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-27129 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-27129 describes an IPv6 bypass vulnerability in Craft CMS versions that use inline SSRF validation with gethostbyname(), which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, gethostbyname() returns the hostname string unchanged, bypassing IP blocklist checks. However, the target (version 4.18.9) uses a fundamentally different architecture: it delegates all ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27129" }, "impact_statement": "not_affected \u2014 CVE-2026-27129 describes an IPv6 bypass vulnerability in Craft CMS versions that use inline SSRF validation with gethostbyname(), which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, gethostbyname() returns the hostname string unchanged, bypassing IP blocklist checks. However, the target (version 4.18.9) uses a fundamentally different architecture: it delegates all ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. CVE-2026-31857 affects Craft CMS versions prior to 4.17.4 and 5.9.9. The target is version 4.18.9, which already contains the upstream fix. The vulnerable code in BaseElementSelectConditionRule::getElementId() that used unsandboxed renderObjectTemplate() has been replaced with renderSandboxedObjectTemplate(). The complete Twig sandbox infrastructure with SecurityPolicy allowlist enforcement is present. The fix was shipped in upstream version 4.17.4 (released 2026-02-11), seven months before the target's base version 4.18.9 (released 2026-09-17).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "CVE-2026-31857 affects Craft CMS versions prior to 4.17.4 and 5.9.9. The target is version 4.18.9, which already contains the upstream fix. The vulnerable code in BaseElementSelectConditionRule::getElementId() that used unsandboxed renderObjectTemplate() has been replaced with renderSandboxedObjectTemplate(). The complete Twig sandbox infrastructure with SecurityPolicy allowlist enforcement is present. The fix was shipped in upstream version 4.17.4 (released 2026-02-11), seven months before the target's base version 4.18.9 (released 2026-09-17)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. CVE-2026-31858 affects ElementSearchController::actionSearch(), which does not exist in Craft CMS 4.18.9. ElementSearchController was introduced in version 5.8.0 (April 2026), while the target is version 4.18.9 from the 4.x release line. The vulnerable component is not present in this version. Additionally, ElementIndexesController (the only controller in 4.18.9 that processes user-supplied criteria parameters from HTTP requests) applies the cleanseQueryCriteria() defense, which removes dangerous SQL-construction attributes (where, orderBy, select, join, having, union, params) before passing criteria to query configuration.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "CVE-2026-31858 affects ElementSearchController::actionSearch(), which does not exist in Craft CMS 4.18.9. ElementSearchController was introduced in version 5.8.0 (April 2026), while the target is version 4.18.9 from the 4.x release line. The vulnerable component is not present in this version. Additionally, ElementIndexesController (the only controller in 4.18.9 that processes user-supplied criteria parameters from HTTP requests) applies the cleanseQueryCriteria() defense, which removes dangerous SQL-construction attributes (where, orderBy, select, join, having, union, params) before passing criteria to query configuration." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-31859 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 4.18.9) is NOT affected by CVE-2026-31859. The vulnerability pattern (accepting dangerous URL schemes like `javascript:` in return URLs) is not present because the upstream vendor fixed it in commit cc9921c148 (Feb 6, 2026) before the 4.18.9 release. TuxCare onboarded version 4.18.9 on Oct 3, 2026, which already contained the fix. The setReturnUrl() method at sr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31859" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 4.18.9) is NOT affected by CVE-2026-31859. The vulnerability pattern (accepting dangerous URL schemes like `javascript:` in return URLs) is not present because the upstream vendor fixed it in commit cc9921c148 (Feb 6, 2026) before the 4.18.9 release. TuxCare onboarded version 4.18.9 on Oct 3, 2026, which already contained the fix. The setReturnUrl() method at sr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS version 4.18.9) is NOT affected by CVE-2026-32262. The vulnerability, a path traversal issue in the AssetsController->replaceFile() method allowing authenticated users to delete arbitrary files via the targetFilename parameter, was fixed in upstream version 4.17.5. The target version 4.18.9 is a later release that already contains the complete upstream fix. The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS version 4.18.9) is NOT affected by CVE-2026-32262. The vulnerability, a path traversal issue in the AssetsController->replaceFile() method allowing authenticated users to delete arbitrary files via the targetFilename parameter, was fixed in upstream version 4.17.5. The target version 4.18.9 is a later release that already contains the complete upstream fix. The ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. Version 4.18.9 is not affected by CVE-2026-32263. The vulnerability exists in EntryTypesController.php::actionApplyOverrideSettings(), which was introduced in Craft CMS version 5.0 (commit 0885de776b \"Globalize entry types\"). This file and method do not exist in version 4.x. In version 4.18.9, entry type functionality is handled in SectionsController.php using manual property assignment rather than bulk configuration via Craft::configure(). All uses of Craft::configure() with HTTP request data in version 4.x controllers are protected by Component::cleanseConfig(), preventing Yii2 behavior/event handler injection. The vulnerable architectural pattern (parse_str \u2192 unsanitized array \u2192 Craft::configure) that enables the attack does not exist in this version.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "Version 4.18.9 is not affected by CVE-2026-32263. The vulnerability exists in EntryTypesController.php::actionApplyOverrideSettings(), which was introduced in Craft CMS version 5.0 (commit 0885de776b \"Globalize entry types\"). This file and method do not exist in version 4.x. In version 4.18.9, entry type functionality is handled in SectionsController.php using manual property assignment rather than bulk configuration via Craft::configure(). All uses of Craft::configure() with HTTP request data in version 4.x controllers are protected by Component::cleanseConfig(), preventing Yii2 behavior/event handler injection. The vulnerable architectural pattern (parse_str \u2192 unsanitized array \u2192 Craft::configure) that enables the attack does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. Target version 4.18.9 is not affected by CVE-2026-32264 (GHSA-4484-8v2f-5748). The RCE vulnerability in ElementIndexesController and FieldsController was fixed by the upstream vendor (Pixel & Tonic) in version 4.17.5 (released February 2026). The target version 4.18.9 (released September 2026) already includes these security fixes as part of the upstream release that TuxCare onboarded. Both vulnerable code paths now properly sanitize configuration arrays with Component::cleanseConfig() before object instantiation, preventing the behavior injection attack.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "Target version 4.18.9 is not affected by CVE-2026-32264 (GHSA-4484-8v2f-5748). The RCE vulnerability in ElementIndexesController and FieldsController was fixed by the upstream vendor (Pixel & Tonic) in version 4.17.5 (released February 2026). The target version 4.18.9 (released September 2026) already includes these security fixes as part of the upstream release that TuxCare onboarded. Both vulnerable code paths now properly sanitize configuration arrays with Component::cleanseConfig() before object instantiation, preventing the behavior injection attack." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. Target version 4.18.9 is not affected by CVE-2026-32267. The vulnerability was fixed in upstream version 4.17.6, and the target version 4.18.9 (released after 4.17.6) already contains the complete security fix. The fix prevents privilege escalation by enforcing route-specific token validation: tokens are now bound to specific routes and cannot be reused to access unintended endpoints like UsersController->actionImpersonateWithToken.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "Target version 4.18.9 is not affected by CVE-2026-32267. The vulnerability was fixed in upstream version 4.17.6, and the target version 4.18.9 (released after 4.17.6) already contains the complete security fix. The fix prevents privilege escalation by enforcing route-specific token validation: tokens are now bound to specific routes and cannot be reused to access unintended endpoints like UsersController->actionImpersonateWithToken." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.9 is NOT affected by CVE-2026-33051. The vulnerability exists in versions 5.9.0-beta.1 through 5.9.10 due to Template::raw() bypassing Twig's auto-escaping when rendering unencoded creator names. Version 4.18.9 uses a fundamentally different architecture (Twig templates with automatic HTML escaping) that was refactored into the vulnerable PHP-generated approach starting in version ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Version 4.18.9 is NOT affected by CVE-2026-33051. The vulnerability exists in versions 5.9.0-beta.1 through 5.9.10 due to Template::raw() bypassing Twig's auto-escaping when rendering unencoded creator names. Version 4.18.9 uses a fundamentally different architecture (Twig templates with automatic HTML escaping) that was refactored into the vulnerable PHP-generated approach starting in version ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. Craft CMS version 4.18.9 is not affected by CVE-2026-33157. The specific vulnerability (unsanitized fieldLayouts parameter in ElementIndexesController::actionFilterHud() passed to FieldLayout::createFromConfig()) does not exist in this version. The actionFilterHud() method in 4.18.9 only processes conditionConfig parameters (which ARE sanitized at line 421), and has no fieldLayouts parameter handling at all. The vulnerable code path introduced in Craft 5.6.0 is architecturally absent from the 4.x branch. All HTTP-accessible entry points that process field layout configurations call Component::cleanseConfig() before passing data to object creation methods.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "Craft CMS version 4.18.9 is not affected by CVE-2026-33157. The specific vulnerability (unsanitized fieldLayouts parameter in ElementIndexesController::actionFilterHud() passed to FieldLayout::createFromConfig()) does not exist in this version. The actionFilterHud() method in 4.18.9 only processes conditionConfig parameters (which ARE sanitized at line 421), and has no fieldLayouts parameter handling at all. The vulnerable code path introduced in Craft 5.6.0 is architecturally absent from the 4.x branch. All HTTP-accessible entry points that process field layout configurations call Component::cleanseConfig() before passing data to object creation methods." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS version 4.18.9) is not affected by CVE-2026-33158. This vulnerability affects Craft CMS versions 4.0.0-RC1 through 4.17.7, allowing low-privileged authenticated users to read private asset content by calling the assets/edit-image endpoint with arbitrary assetIds without proper authorization checks. The vulnerability was fixed in upstream version 4.17.8 by adding...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS version 4.18.9) is not affected by CVE-2026-33158. This vulnerability affects Craft CMS versions 4.0.0-RC1 through 4.17.7, allowing low-privileged authenticated users to read private asset content by calling the assets/edit-image endpoint with arbitrary assetIds without proper authorization checks. The vulnerability was fixed in upstream version 4.17.8 by adding..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-33159 affects Craft CMS 4.0.0-RC1 to before 4.17.8, allowing unauthenticated users to execute privileged Config Sync operations. The target repository is at version 4.18.9, which includes the upstream fix released in 4.17.8. The ConfigSyncController contains the required authentication gates ($allowAnonymous=ALLOW_ANONYMOUS_NEVER and requireAdmin() in beforeAction hook) that block all ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 CVE-2026-33159 affects Craft CMS 4.0.0-RC1 to before 4.17.8, allowing unauthenticated users to execute privileged Config Sync operations. The target repository is at version 4.18.9, which includes the upstream fix released in 4.17.8. The ConfigSyncController contains the required authentication gates ($allowAnonymous=ALLOW_ANONYMOUS_NEVER and requireAdmin() in beforeAction hook) that block all ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-33160 affects Craft CMS versions 4.0.0-RC1 to before 4.17.8. The target version 4.18.9 already contains the upstream vendor's fix (requirePermission('accessCp') check at line 1205 of AssetsController.php) that prevents unauthorized access to asset transform generation. The fix was shipped in upstream release 4.18.9 before TuxCare onboarded this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 CVE-2026-33160 affects Craft CMS versions 4.0.0-RC1 to before 4.17.8. The target version 4.18.9 already contains the upstream vendor's fix (requirePermission('accessCp') check at line 1205 of AssetsController.php) that prevents unauthorized access to asset transform generation. The fix was shipped in upstream release 4.18.9 before TuxCare onboarded this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-33161 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 The target repository (craftcms/cms version 4.18.9, SHA 018c9bb626) is NOT AFFECTED by CVE-2026-33161. The vulnerability\u2014an authorization bypass allowing low-privileged users to access private asset metadata via the assets/image-editor endpoint\u2014was fixed by the upstream vendor (Craft CMS) in commit d30df31122 on February 25, 2026. This fix was included in version 4.17.8 and all subsequent relea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "not_affected \u2014 The target repository (craftcms/cms version 4.18.9, SHA 018c9bb626) is NOT AFFECTED by CVE-2026-33161. The vulnerability\u2014an authorization bypass allowing low-privileged users to access private asset metadata via the assets/image-editor endpoint\u2014was fixed by the upstream vendor (Craft CMS) in commit d30df31122 on February 25, 2026. This fix was included in version 4.17.8 and all subsequent relea..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 4.18.9 is NOT affected by CVE-2026-33162. The vulnerability concerns an authorization bypass in the \"move entry to section\" feature that allows users with only accessCp permission to move entries between sections without saveEntries permission. This feature was introduced in version 5.3.0 (commit e75a51a266) and does not exist in version 4.18.9. Git ancestry verification confi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 Craft CMS version 4.18.9 is NOT affected by CVE-2026-33162. The vulnerability concerns an authorization bypass in the \"move entry to section\" feature that allows users with only accessCp permission to move entries between sections without saveEntries permission. This feature was introduced in version 5.3.0 (commit e75a51a266) and does not exist in version 4.18.9. Git ancestry verification confi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.9 is not affected by CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset mutations). The upstream vendor refactored asset upload URL validation to use the craftcms/url-validator package (commit 26268c0210, June 2026), which validates URL schemes and blocks dangerous protocols (gopher, file, ftp, etc.) before any connection is opened. This fix was already present in the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "not_affected \u2014 Version 4.18.9 is not affected by CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset mutations). The upstream vendor refactored asset upload URL validation to use the craftcms/url-validator package (commit 26268c0210, June 2026), which validates URL schemes and blocks dangerous protocols (gopher, file, ftp, etc.) before any connection is opened. This fix was already present in the..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 The target version 4.18.9 is NOT AFFECTED by CVE-2026-41130 (GHSA-95wr-3f2v-v2wh). The vulnerable `actionResourceJs()` method in `src/controllers/AppController.php` does not exist in this version. Upstream Craft CMS removed this endpoint entirely in version 4.18.0 (released May 13, 2026), which predates TuxCare's onboarding of version 4.18.9. The SSRF attack chain is broken at the INPUT stage b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target version 4.18.9 is NOT AFFECTED by CVE-2026-41130 (GHSA-95wr-3f2v-v2wh). The vulnerable `actionResourceJs()` method in `src/controllers/AppController.php` does not exist in this version. Upstream Craft CMS removed this endpoint entirely in version 4.18.0 (released May 13, 2026), which predates TuxCare's onboarding of version 4.18.9. The SSRF attack chain is broken at the INPUT stage b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-55790 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. CVE-2026-55790 XSS vulnerability in CraftSupport widget is NOT present in target version 4.18.9. The fix was included in upstream release 4.17.16 (2026-05-11) and is present at both vulnerable locations: (1) line 382 uses Craft.escapeHtml() to escape GitHub issue titles before rendering, and (2) lines 555-557 use jQuery's text: option for error messages. The target version 4.18.9 (released 2026-09-17) includes this upstream vendor fix. TuxCare onboarded the already-fixed version via snapshot commit b1a16b0026.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55790" }, "impact_statement": "CVE-2026-55790 XSS vulnerability in CraftSupport widget is NOT present in target version 4.18.9. The fix was included in upstream release 4.17.16 (2026-05-11) and is present at both vulnerable locations: (1) line 382 uses Craft.escapeHtml() to escape GitHub issue titles before rendering, and (2) lines 555-557 use jQuery's text: option for error messages. The target version 4.18.9 (released 2026-09-17) includes this upstream vendor fix. TuxCare onboarded the already-fixed version via snapshot commit b1a16b0026." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-55793 is fixed in version 4.18.9-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55793" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.9 is not affected by CVE-2026-56381. While the code has missing |e filters in some Twig templates (src/templates/settings/users/groups/_index.twig line 29), three layers of ambient framework defenses provide comprehensive protection: (1) Twig's default HTML auto-escaping for server-side rendering, (2) JSON string escaping preventing JavaScript injection, and (3) Vue's mustache inte...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Version 4.18.9 is not affected by CVE-2026-56381. While the code has missing |e filters in some Twig templates (src/templates/settings/users/groups/_index.twig line 29), three layers of ambient framework defenses provide comprehensive protection: (1) Twig's default HTML auto-escaping for server-side rendering, (2) JSON string escaping preventing JavaScript injection, and (3) Vue's mustache inte..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-56382 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. Target version 4.18.9 is NOT affected by CVE-2026-56382. The vulnerable method actionRenderCardPreview() was introduced in version 5.5.0, after this version. The CVE's stated affected range (>= 5.5.0 and <= 5.9.13) correctly excludes version 4.18.9. No alternative vulnerable code path exists in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56382" }, "impact_statement": "Target version 4.18.9 is NOT affected by CVE-2026-56382. The vulnerable method actionRenderCardPreview() was introduced in version 5.5.0, after this version. The CVE's stated affected range (>= 5.5.0 and <= 5.9.13) correctly excludes version 4.18.9. No alternative vulnerable code path exists in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-56383 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 The target Craft CMS 4.18.9 is NOT AFFECTED by CVE-2026-56383 (stored XSS in Table field row headings). The vulnerability was fixed by the upstream vendor (Pixel & Tonic) in version 4.16.19, and this fix is present in version 4.18.9. The fix HTML-encodes heading cell values in _getInputHtml() before rendering, preventing XSS. The vulnerable pattern does not exist in the target because the upstr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56383" }, "impact_statement": "not_affected \u2014 The target Craft CMS 4.18.9 is NOT AFFECTED by CVE-2026-56383 (stored XSS in Table field row headings). The vulnerability was fixed by the upstream vendor (Pixel & Tonic) in version 4.16.19, and this fix is present in version 4.18.9. The fix HTML-encodes heading cell values in _getInputHtml() before rendering, preventing XSS. The vulnerable pattern does not exist in the target because the upstr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-56384 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-56384 affects Craft CMS versions >= 4.0.0-RC1, <= 4.17.7, and was fixed in 4.17.8. The target repository is at version 4.18.9, which already contains the upstream vendor fix. The vulnerability involved missing authorization checks in the assets/preview-thumb and assets/preview-file endpoints. Both methods now include requireVolumePermissionByAsset() and requirePeerVolumePermissionByAss...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56384" }, "impact_statement": "not_affected \u2014 CVE-2026-56384 affects Craft CMS versions >= 4.0.0-RC1, <= 4.17.7, and was fixed in 4.17.8. The target repository is at version 4.18.9, which already contains the upstream vendor fix. The vulnerability involved missing authorization checks in the assets/preview-thumb and assets/preview-file endpoints. Both methods now include requireVolumePermissionByAsset() and requirePeerVolumePermissionByAss..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-56385 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is not affected by CVE-2026-56385. The vulnerability affects Craft CMS versions <= 4.17.7, with the fix released in 4.17.8. Version 4.18.9 already includes the upstream fix (permission checks in actionPreviewFile method at lines 1258-1259) that was shipped in the upstream release before TuxCare onboarded this version. The authorization bypass vulnerability pattern is not p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56385" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is not affected by CVE-2026-56385. The vulnerability affects Craft CMS versions <= 4.17.7, with the fix released in 4.17.8. Version 4.18.9 already includes the upstream fix (permission checks in actionPreviewFile method at lines 1258-1259) that was shipped in the upstream release before TuxCare onboarded this version. The authorization bypass vulnerability pattern is not p..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-56393 affects version 4.18.9-p4+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56393" }, "action_statement": "Vulnerability CVE-2026-56393 affects version 4.18.9-p4+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 4.18.9-p4+tuxcare of craftcms/cms. Target version 4.18.9 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint was fixed in upstream Craft CMS version 4.17.5 (released 2026-02-17), and version 4.18.9 (released 2026-09-17) inherits this fix. All three entry points (iconUrl, iconPath, iconSvg) validate the extension parameter using regex /^\\w+$/ to reject path traversal sequences before constructing file paths.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "Target version 4.18.9 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint was fixed in upstream Craft CMS version 4.17.5 (released 2026-02-17), and version 4.18.9 (released 2026-09-17) inherits this fix. All three entry points (iconUrl, iconPath, iconSvg) validate the extension parameter using regex /^\\w+$/ to reject path traversal sequences before constructing file paths." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p4+tuxcare" } } ], "timestamp": "2026-11-11T17:00:44.654924+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 4.18.9-p4+tuxcare of craftcms/cms. not_affected \u2014 The XSS vulnerability (GHSA-wf98-vxv9-jqfv) in the Feeds widget is NOT present in the target. The fix was already included in upstream Craft CMS 4.18.9 when TuxCare onboarded it. The vulnerability allowed malicious javascript: URLs in feed item permalinks to execute XSS. The upstream fix (originally applied in Craft 3.7.29 by brandon@pixelandtonic.com) adds a regex filter rejecting any permalin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The XSS vulnerability (GHSA-wf98-vxv9-jqfv) in the Feeds widget is NOT present in the target. The fix was already included in upstream Craft CMS 4.18.9 when TuxCare onboarded it. The vulnerability allowed malicious javascript: URLs in feed item permalinks to execute XSS. The upstream fix (originally applied in Craft 3.7.29 by brandon@pixelandtonic.com) adds a regex filter rejecting any permalin..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v3.4.49-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v3.4.49-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-24894 is fixed in version v3.4.49-p1+tuxcare of symfony/http-kernel.", "vulnerability": { "name": "CVE-2022-24894" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v3.4.49-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v3.4.49-p1+tuxcare" } } ], "timestamp": "2026-11-11T15:17:00.051144+00:00", "status_notes": "Vulnerability CVE-2026-123339 affects version v3.4.49-p1+tuxcare of symfony/http-kernel, and is fixed in v3.4.49-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-123339" }, "action_statement": "Vulnerability CVE-2026-123339 affects version v3.4.49-p1+tuxcare of symfony/http-kernel, and is fixed in v3.4.49-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v3.4.49-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v3.4.49-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2026-45075 does not affect version v3.4.49-p1+tuxcare of symfony/http-kernel. The target repository (Symfony http-kernel v3.4.49-p1+tuxcare) does not contain the vulnerable PHP 8 attribute-based security features described in CVE-2026-45075. This version predates PHP 8 attributes by approximately 3 years and targets PHP 5.5.9+/7.0+, while the vulnerability affects PHP 8 attributes (#[IsGranted], #[IsSignatureValid], #[IsCsrfTokenValid]) introduced in Symfony 5.2+ (November 2020). The Attribute/ directory does not exist, no attribute-based security event listeners are present, and exhaustive searches confirm the complete absence of the vulnerable component. The target version is structurally incapable of having this vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45075" }, "impact_statement": "The target repository (Symfony http-kernel v3.4.49-p1+tuxcare) does not contain the vulnerable PHP 8 attribute-based security features described in CVE-2026-45075. This version predates PHP 8 attributes by approximately 3 years and targets PHP 5.5.9+/7.0+, while the vulnerability affects PHP 8 attributes (#[IsGranted], #[IsSignatureValid], #[IsCsrfTokenValid]) introduced in Symfony 5.2+ (November 2020). The Attribute/ directory does not exist, no attribute-based security event listeners are present, and exhaustive searches confirm the complete absence of the vulnerable component. The target version is structurally incapable of having this vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2021-27902 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is not affected by CVE-2021-27902. The vulnerability allowed XSS via uploaded .htm/.html files in versions before 3.6.0. The fix (commit 8ee85a8f03) removed 'htm' and 'html' from the default allowedFileExtensions list. This fix was already present in the upstream Craft CMS 4.18.7 release that TuxCare onboarded, authored by Brandon Kelly (brandon@pixelandto...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-27902" }, "impact_statement": "not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is not affected by CVE-2021-27902. The vulnerability allowed XSS via uploaded .htm/.html files in versions before 3.6.0. The fix (commit 8ee85a8f03) removed 'htm' and 'html' from the default allowedFileExtensions list. This fix was already present in the upstream Craft CMS 4.18.7 release that TuxCare onboarded, authored by Brandon Kelly (brandon@pixelandto..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2021-27903 affects version 4.18.7-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-27903" }, "action_statement": "Vulnerability CVE-2021-27903 affects version 4.18.7-p5+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2021-32470 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 CVE-2021-32470 (XSS in tab name prompt) is NOT present in the target. The upstream vendor fixed this vulnerability in commit f9378aa154 (April 2021) by wrapping the prompt() result with Craft.escapeHtml() in FieldLayoutDesigner.js:150. This fix was already included in the upstream release before TuxCare onboarded version 4.18.7. The vulnerable code pattern (unescaped user input from prompt dire...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-32470" }, "impact_statement": "not_affected \u2014 CVE-2021-32470 (XSS in tab name prompt) is NOT present in the target. The upstream vendor fixed this vulnerability in commit f9378aa154 (April 2021) by wrapping the prompt() result with Craft.escapeHtml() in FieldLayoutDesigner.js:150. This fix was already included in the upstream release before TuxCare onboarded version 4.18.7. The vulnerable code pattern (unescaped user input from prompt dire..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2021-41824 affects version 4.18.7-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2021-41824" }, "action_statement": "Vulnerability CVE-2021-41824 affects version 4.18.7-p5+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2022-28378 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-28378 (XSS in Craft CMS before 3.7.29) is not present in target version 4.18.7. The vulnerability allowed JavaScript execution via malicious feed item permalinks (e.g., javascript: URIs) in the FeedWidget. The fix (commit 7ca2b2d2cc) adds permalink URL scheme validation to reject non-HTTP(S) URIs. This fix was shipped in upstream release 3.7.29 (Jan 2022) and is present in the target c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-28378" }, "impact_statement": "not_affected \u2014 CVE-2022-28378 (XSS in Craft CMS before 3.7.29) is not present in target version 4.18.7. The vulnerability allowed JavaScript execution via malicious feed item permalinks (e.g., javascript: URIs) in the FeedWidget. The fix (commit 7ca2b2d2cc) adds permalink URL scheme validation to reject non-HTTP(S) URIs. This fix was shipped in upstream release 3.7.29 (Jan 2022) and is present in the target c..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2022-29933 affects version 4.18.7-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-29933" }, "action_statement": "Vulnerability CVE-2022-29933 affects version 4.18.7-p5+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS 4.2.0.1 due to missing HTML encoding on user-controllable content (revision notes, tab names, group names, address titles). The vulnerability was fixed by upstream Craft CMS developers (Pixel & Tonic) in version 4.2.1 (released 2022-08-09) via commits that added Html::encode() to all affected output locations. Target version 4.18.7 inherits the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS 4.2.0.1 due to missing HTML encoding on user-controllable content (revision notes, tab names, group names, address titles). The vulnerability was fixed by upstream Craft CMS developers (Pixel & Tonic) in version 4.2.1 (released 2022-08-09) via commits that added Html::encode() to all affected output locations. Target version 4.18.7 inherits the..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2022-37783 affects version 4.18.7-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2022-37783" }, "action_statement": "Vulnerability CVE-2022-37783 affects version 4.18.7-p5+tuxcare of craftcms/cms." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2023-30130 affects version 4.18.7-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-30130" }, "action_statement": "Vulnerability CVE-2023-30130 affects version 4.18.7-p5+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2023-30177 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-30177 (XSS in Volume Name) is not present in target version 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream Craft CMS in version 4.4.0-beta.1 (commit 1381993c81, Dec 22, 2022) by adding Html::encode() to the volume name display in asset metadata. The fix was already present in the upstream release when TuxCare onboarded version 4.18.7. Both identified volume name d...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-30177" }, "impact_statement": "not_affected \u2014 CVE-2023-30177 (XSS in Volume Name) is not present in target version 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream Craft CMS in version 4.4.0-beta.1 (commit 1381993c81, Dec 22, 2022) by adding Html::encode() to the volume name display in asset metadata. The fix was already present in the upstream release when TuxCare onboarded version 4.18.7. Both identified volume name d..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2023-31144 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-31144 is not present in target craftcms/cms 4.18.7. The vulnerability involved XSS through unescaped forward slashes in JSON encoding when feed titles containing malicious sequences like `` were embedded in HTML script tags. The upstream vendor (Pixel & Tonic) fixed this in commit e2f7e7b7d86a0afa54ce855375d13c7760670764 by removing JSON_UNESCAPED_SLASHES from the default enco...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-31144" }, "impact_statement": "not_affected \u2014 CVE-2023-31144 is not present in target craftcms/cms 4.18.7. The vulnerability involved XSS through unescaped forward slashes in JSON encoding when feed titles containing malicious sequences like `` were embedded in HTML script tags. The upstream vendor (Pixel & Tonic) fixed this in commit e2f7e7b7d86a0afa54ce855375d13c7760670764 by removing JSON_UNESCAPED_SLASHES from the default enco..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2023-33194 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in craftcms/cms 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream vendor (Pixel & Tonic) in commit 9d0cd0bd (April 2023) and shipped in version 3.8.10. The target version 4.18.7 includes this upstream fix. The vulnerable pattern ($('
  • ' + error + '
    • ')) does not exist; instead, the safe pattern (...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33194" }, "impact_statement": "not_affected \u2014 CVE-2023-33194 (XSS in Quick Post validation error messages) is NOT present in craftcms/cms 4.18.7-p3+tuxcare. The vulnerable code pattern was fixed by upstream vendor (Pixel & Tonic) in commit 9d0cd0bd (April 2023) and shipped in version 3.8.10. The target version 4.18.7 includes this upstream fix. The vulnerable pattern ($('
  • ' + error + '
    • ')) does not exist; instead, the safe pattern (..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2023-33495 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. craftcms/cms 4.18.7 already contains upstream commit 57334cd435 (released in 4.17.0, 'Escape checkbox labels by default in JS'): Craft.ui.createSelect sets option labels via $option.text() with opt-in labelHtml, so the export-modal exporter-name HTML injection (GHSA-m3v5-gjj9-rg24, affected <= 4.4.9) is not exploitable. The TuxCare 3.9.15 fix (PHPELSCVE-271, b7d336d299) is not needed and would double-escape. Jira: PHPELSCVE-992.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-33495" }, "impact_statement": "craftcms/cms 4.18.7 already contains upstream commit 57334cd435 (released in 4.17.0, 'Escape checkbox labels by default in JS'): Craft.ui.createSelect sets option labels via $option.text() with opt-in labelHtml, so the export-modal exporter-name HTML injection (GHSA-m3v5-gjj9-rg24, affected <= 4.4.9) is not exploitable. The TuxCare 3.9.15 fix (PHPELSCVE-271, b7d336d299) is not needed and would double-escape. Jira: PHPELSCVE-992." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2023-36260 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. CVE-2023-36260 describes a DoS vulnerability triggered via the Feed Me plugin when saving a feed with Asset element type but no volume selected. The vulnerable code pattern exists in craftcms/cms at src/elements/Asset.php:2938 (calling getFolderById($folderId)->getVolume() without null check), which would cause a fatal error if folderId is null. However, analysis of all Craft CMS's own entry points (GraphQL mutations, HTTP upload controllers, validation rules) shows they properly validate and set folderId before saving Assets. The vulnerable code path is not reachable through craftcms/cms's own production code - it requires a third-party plugin like Feed Me that creates Assets without properly setting folderId. Verdict: not_affected (Rule 5 Type A2 - code_not_reachable).", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-36260" }, "impact_statement": "CVE-2023-36260 describes a DoS vulnerability triggered via the Feed Me plugin when saving a feed with Asset element type but no volume selected. The vulnerable code pattern exists in craftcms/cms at src/elements/Asset.php:2938 (calling getFolderById($folderId)->getVolume() without null check), which would cause a fatal error if folderId is null. However, analysis of all Craft CMS's own entry points (GraphQL mutations, HTTP upload controllers, validation rules) shows they properly validate and set folderId before saving Assets. The vulnerable code path is not reachable through craftcms/cms's own production code - it requires a third-party plugin like Feed Me that creates Assets without properly setting folderId. Verdict: not_affected (Rule 5 Type A2 - code_not_reachable)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2023-40035 affects version 4.18.7-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2023-40035" }, "action_statement": "Vulnerability CVE-2023-40035 affects version 4.18.7-p5+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2024-21622 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 CVE-2024-21622 describes privilege escalation vulnerabilities in Craft CMS fixed by two upstream commits: ca0576b3ed (UsersController username parameter restriction) and 42f929e777 (ElementsController TOCTOU authorization fix). Both fixes were authored by Pixel & Tonic developers (brad@pixelandtonic.com) in November 2023 and were already present in the upstream Craft CMS 4.18.7 release that Tux...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-21622" }, "impact_statement": "not_affected \u2014 CVE-2024-21622 describes privilege escalation vulnerabilities in Craft CMS fixed by two upstream commits: ca0576b3ed (UsersController username parameter restriction) and 42f929e777 (ElementsController TOCTOU authorization fix). Both fixes were authored by Pixel & Tonic developers (brad@pixelandtonic.com) in November 2023 and were already present in the upstream Craft CMS 4.18.7 release that Tux..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2024-37843 affects version 4.18.7-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-37843" }, "action_statement": "Vulnerability CVE-2024-37843 affects version 4.18.7-p5+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS version 4.18.7, while CVE-2024-41800 specifically affects Craft CMS 5's TOTP (Time-based One-Time Password) two-factor authentication feature. The TOTP 2FA functionality does not exist in Craft CMS 4.x at all. Exhaustive searches across the entire codebase found no TOTP-related code, no Google2FA library dependency, no auth/methods directory structure, no Auth...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 The target repository is Craft CMS version 4.18.7, while CVE-2024-41800 specifically affects Craft CMS 5's TOTP (Time-based One-Time Password) two-factor authentication feature. The TOTP 2FA functionality does not exist in Craft CMS 4.x at all. Exhaustive searches across the entire codebase found no TOTP-related code, no Google2FA library dependency, no auth/methods directory structure, no Auth..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2024-52291 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. craftcms/cms 4.18.7 is not affected by CVE-2024-52291 (GHSA-jrh5-vhr9-qh7q). The advisory affects 4.x only up to <= 4.12.4.1 (patched 4.12.5). The upstream fix 1bc4eaa40a (Fixed GHSA-jrh5-vhr9-qh7q, first tagged 4.12.5) replaced the single-prefix StringHelper::removeLeft($path, 'file://') in FileHelper::normalizePath() with a regex that strips all consecutive file:// prefixes, closing the file://file://// local filesystem validation bypass. The fixed code is present on tuxcare-current/4.18.7.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52291" }, "impact_statement": "craftcms/cms 4.18.7 is not affected by CVE-2024-52291 (GHSA-jrh5-vhr9-qh7q). The advisory affects 4.x only up to <= 4.12.4.1 (patched 4.12.5). The upstream fix 1bc4eaa40a (Fixed GHSA-jrh5-vhr9-qh7q, first tagged 4.12.5) replaced the single-prefix StringHelper::removeLeft($path, 'file://') in FileHelper::normalizePath() with a regex that strips all consecutive file:// prefixes, closing the file://file://// local filesystem validation bypass. The fixed code is present on tuxcare-current/4.18.7." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2024-52292 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. The target repository (Craft CMS 4.18.7-p1+tuxcare) is NOT AFFECTED by CVE-2024-52292. The upstream vendor (Craft CMS / Pixel & Tonic) already fixed the arbitrary file read vulnerability in commit 3ee85a48c1 (Oct 21, 2024) by adding path containment validation to the Html::dataUrl() function. This fix was already present in the upstream codebase when TuxCare onboarded version 4.18.7 (PHPELS-197). The defense restricts file access to within the project root directory, preventing the attack vector described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52292" }, "impact_statement": "The target repository (Craft CMS 4.18.7-p1+tuxcare) is NOT AFFECTED by CVE-2024-52292. The upstream vendor (Craft CMS / Pixel & Tonic) already fixed the arbitrary file read vulnerability in commit 3ee85a48c1 (Oct 21, 2024) by adding path containment validation to the Html::dataUrl() function. This fix was already present in the upstream codebase when TuxCare onboarded version 4.18.7 (PHPELS-197). The defense restricts file access to within the project root directory, preventing the attack vector described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. CVE-2024-52293 is NOT present in the target. The vulnerability required missing normalizePath() in FileHelper::absolutePath() line 136, allowing path traversal sequences like `../templates/poc` to bypass system directory security checks. The target code contains the upstream vendor's fix: `return static::normalizePath($from . $ds . $to, $ds);` which resolves traversal sequences before the path is used in security validations. This fix was introduced in upstream Craft CMS version 4.12.2 (commit 123e48a696 by brandon@pixelandtonic.com on 2024-09-11). The target version 4.18.7 naturally includes all fixes from 4.12.2. TuxCare onboarded the pre-fixed version 4.18.7; there is no separate TuxCare backport for this CVE on this version line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 is NOT present in the target. The vulnerability required missing normalizePath() in FileHelper::absolutePath() line 136, allowing path traversal sequences like `../templates/poc` to bypass system directory security checks. The target code contains the upstream vendor's fix: `return static::normalizePath($from . $ds . $to, $ds);` which resolves traversal sequences before the path is used in security validations. This fix was introduced in upstream Craft CMS version 4.12.2 (commit 123e48a696 by brandon@pixelandtonic.com on 2024-09-11). The target version 4.18.7 naturally includes all fixes from 4.12.2. TuxCare onboarded the pre-fixed version 4.18.7; there is no separate TuxCare backport for this CVE on this version line." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2024-56145 affects version 4.18.7-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2024-56145" }, "action_statement": "Vulnerability CVE-2024-56145 affects version 4.18.7-p5+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-23209 fix a19d46be78a9 by brandon@pixelandtonic.com (2025-07-07) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-23209 fix a19d46be78a9 by brandon@pixelandtonic.com (2025-07-07) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. CVE-2025-32432 RCE vulnerability is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this type confusion vulnerability in commit e1c85441 (2025-04-10) by adding string type validation for the 'handle' parameter in AssetsController::actionGenerateTransform(). This fix was included in upstream release 4.18.7 (2026-08-18), which TuxCare subsequently onboarded to ELS on 2026-09-07. The target code at HEAD (b16f3f8a9b) contains the complete fix: lines 1208-1210 validate that $handle is a string before use, exactly matching the vendor patch. The CVE affects versions 4.0.0-RC1 to before 4.14.15; target version 4.18.7 is after the fixed version. Attribution: upstream vendor fix (no TuxCare authorship signal).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "CVE-2025-32432 RCE vulnerability is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this type confusion vulnerability in commit e1c85441 (2025-04-10) by adding string type validation for the 'handle' parameter in AssetsController::actionGenerateTransform(). This fix was included in upstream release 4.18.7 (2026-08-18), which TuxCare subsequently onboarded to ELS on 2026-09-07. The target code at HEAD (b16f3f8a9b) contains the complete fix: lines 1208-1210 validate that $handle is a string before use, exactly matching the vendor patch. The CVE affects versions 4.0.0-RC1 to before 4.14.15; target version 4.18.7 is after the fixed version. Attribution: upstream vendor fix (no TuxCare authorship signal)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2025-35939 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 CVE-2025-35939 is not present in the target. The vulnerability involves storing unsanitized return URLs containing arbitrary HTML/PHP code in session files. The upstream vendor (Craft CMS) shipped the fix in version 4.18.7, which strips HTML/PHP tags via strip_tags() and validates URL schemes before storing return URLs in the session. TuxCare onboarded this version with the fix already present....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-35939" }, "impact_statement": "not_affected \u2014 CVE-2025-35939 is not present in the target. The vulnerability involves storing unsanitized return URLs containing arbitrary HTML/PHP code in session files. The upstream vendor (Craft CMS) shipped the fix in version 4.18.7, which strips HTML/PHP tags via strip_tags() and validates URL schemes before storing return URLs in the session. TuxCare onboarded this version with the fix already present...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2025-46731 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. Not affected: CVE-2025-46731 affects Craft CMS 4.x prior to 4.14.13 and is fixed upstream in 4.14.13; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (c3f75107a4b4d00f802a56f23aa57cde134df838).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46731" }, "impact_statement": "Not affected: CVE-2025-46731 affects Craft CMS 4.x prior to 4.14.13 and is fixed upstream in 4.14.13; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (c3f75107a4b4d00f802a56f23aa57cde134df838)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2025-57811 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. Not affected: CVE-2025-57811 affects Craft CMS 4.0.0-RC1 through 4.16.5 and is fixed upstream in 4.16.6; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (e77f8a287dcdda41f1724f525d03542f18566cbc).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-57811" }, "impact_statement": "Not affected: CVE-2025-57811 affects Craft CMS 4.0.0-RC1 through 4.16.5 and is fixed upstream in 4.16.6; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (e77f8a287dcdda41f1724f525d03542f18566cbc)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68436 fix 4bcb0db554e2 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68436 fix 4bcb0db554e2 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2025-68437 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68437 fix 013db636fdb3 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68437" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68437 fix 013db636fdb3 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2025-68454 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. Not affected: CVE-2025-68454 affects Craft CMS 4.0.0-RC1 through 4.16.16 and is fixed upstream in 4.16.17; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (d82680f4a05f9576883bb83c3f6243d33ca73ebe).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68454" }, "impact_statement": "Not affected: CVE-2025-68454 affects Craft CMS 4.0.0-RC1 through 4.16.16 and is fixed upstream in 4.16.17; this project_version is 4.18.7. Patch application confirmed all patch commits already present in the target branch (d82680f4a05f9576883bb83c3f6243d33ca73ebe)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. Version 4.18.7 is not affected by CVE-2025-68455. The vulnerability was fixed by upstream vendor (Craft CMS/Pixel & Tonic) in version 4.16.17 via commit ec43c497ed (released 2025-12-04). Target version 4.18.7 (released 2026-08-18) is newer and includes this fix plus additional hardening. The fix adds Component::cleanseConfig() to remove dangerous config keys (\"on \" event handlers and \"as \" behaviors) before object instantiation, preventing malicious behavior attachment and RCE. TuxCare later adopted version 4.18.7 into their ELS program, inheriting the upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "Version 4.18.7 is not affected by CVE-2025-68455. The vulnerability was fixed by upstream vendor (Craft CMS/Pixel & Tonic) in version 4.16.17 via commit ec43c497ed (released 2025-12-04). Target version 4.18.7 (released 2026-08-18) is newer and includes this fix plus additional hardening. The fix adds Component::cleanseConfig() to remove dangerous config keys (\"on \" event handlers and \"as \" behaviors) before object instantiation, preventing malicious behavior attachment and RCE. TuxCare later adopted version 4.18.7 into their ELS program, inheriting the upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2025-68456 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68456 fix 1718011a5faa by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68456" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68456 fix 1718011a5faa by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-115934 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 4.18.7 builds search SQL by string interpolation (src/services/Search.php), but every user-controlled fragment is sanitized first. Search terms go through SearchHelper::normalizeKeywords, which strips quotes, backslashes, semicolons and other punctuation. Attribute names are limited to \\w+. Field IDs are integers. I found no unauthenticated element search endpoint in the target. No ve...", "vulnerability": { "name": "CVE-2026-115934" }, "impact_statement": "not_affected \u2014 Craft CMS 4.18.7 builds search SQL by string interpolation (src/services/Search.php), but every user-controlled fragment is sanitized first. Search terms go through SearchHelper::normalizeKeywords, which strips quotes, backslashes, semicolons and other punctuation. Attribute names are limited to \\w+. Field IDs are integers. I found no unauthenticated element search endpoint in the target. No ve..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-115935 is fixed in version 4.18.7-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115935" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-115938 is fixed in version 4.18.7-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-115938" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.7 is NOT AFFECTED by CVE-2026-25491. The vulnerability (stored XSS via unescaped entry type names) affects Craft CMS 5.0.0-RC1 through 5.8.21, where the architecture changed from Vue.js client-side rendering to PHP server-side rendering. In version 4.18.7, entry type names are rendered through Vue.js's default {{ }} interpolation (App.vue:115,120), which automatically applies HTML ...", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Version 4.18.7 is NOT AFFECTED by CVE-2026-25491. The vulnerability (stored XSS via unescaped entry type names) affects Craft CMS 5.0.0-RC1 through 5.8.21, where the architecture changed from Vue.js client-side rendering to PHP server-side rendering. In version 4.18.7, entry type names are rendered through Vue.js's default {{ }} interpolation (App.vue:115,120), which automatically applies HTML ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-25493. The upstream vendor fixed this SSRF redirect bypass vulnerability in commit 26268c0210 (June 2026), which was included in the 4.18.7 release (August 2026). The target code disables HTTP redirects at line 318 (`RequestOptions::ALLOW_REDIRECTS => false`) in the downloadUrl method, preventing attackers from bypassing validation ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-25493. The upstream vendor fixed this SSRF redirect bypass vulnerability in commit 26268c0210 (June 2026), which was included in the 4.18.7 release (August 2026). The target code disables HTTP redirects at line 318 (`RequestOptions::ALLOW_REDIRECTS => false`) in the downloadUrl method, preventing attackers from bypassing validation ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-25494 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-25494 describes a hex IP notation bypass of filter_var() validation in the saveAsset GraphQL mutation. The target (4.18.7) is NOT AFFECTED because the vulnerable code pattern has been completely replaced by an upstream vendor refactoring. On June 15, 2026, upstream author brandon@pixelandtonic.com (commit 26268c0210) replaced the inline filter_var() validation with the craftcms/url-val...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "not_affected \u2014 CVE-2026-25494 describes a hex IP notation bypass of filter_var() validation in the saveAsset GraphQL mutation. The target (4.18.7) is NOT AFFECTED because the vulnerable code pattern has been completely replaced by an upstream vendor refactoring. On June 15, 2026, upstream author brandon@pixelandtonic.com (commit 26268c0210) replaced the inline filter_var() validation with the craftcms/url-val..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. Craft CMS 4.18.7 is not affected by CVE-2026-25495. The upstream vendor (Pixel & Tonic) fixed this SQL injection vulnerability in version 4.16.18 (released 2026-01-09) by removing dangerous SQL query construction parameters from user-provided criteria before database query configuration. The fix was refactored into ElementHelper::cleanseQueryCriteria() in version 4.17.4 (released 2026-02-11). The target version 4.18.7 (released 2026-08-18) inherits this upstream fix. The vulnerable pattern is not present in the target because an upstream-authored fix is already applied in the shipped version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "Craft CMS 4.18.7 is not affected by CVE-2026-25495. The upstream vendor (Pixel & Tonic) fixed this SQL injection vulnerability in version 4.16.18 (released 2026-01-09) by removing dangerous SQL query construction parameters from user-provided criteria before database query configuration. The fix was refactored into ElementHelper::cleanseQueryCriteria() in version 4.17.4 (released 2026-02-11). The target version 4.18.7 (released 2026-08-18) inherits this upstream fix. The vulnerable pattern is not present in the target because an upstream-authored fix is already applied in the shipped version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is not affected by CVE-2026-25496. The upstream vendor (Craft CMS / Pixel & Tonic) fixed the stored XSS vulnerability in commit 93837b626f on 2026-01-05 by adding HTML encoding to the Number field's Prefix and Suffix rendering. This fix was included in the upstream 4.18.7 release (finalized 2026-08-18), which TuxCare inherited when onboarding this version. The vulnerable p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is not affected by CVE-2026-25496. The upstream vendor (Craft CMS / Pixel & Tonic) fixed the stored XSS vulnerability in commit 93837b626f on 2026-01-05 by adding HTML encoding to the Number field's Prefix and Suffix rendering. This fix was included in the upstream 4.18.7 release (finalized 2026-08-18), which TuxCare inherited when onboarding this version. The vulnerable p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. Target version 4.18.7 is not vulnerable to CVE-2026-25498. The upstream vendor (Pixel & Tonic) fixed the RCE vulnerability in commit 395c64f0b8 on 2026-01-09 by adding ComponentHelper::cleanseConfig() sanitization before passing user-supplied field layout configuration to object creation. This fix was included in the upstream 4.18.7 release (2026-08-18) which TuxCare subsequently onboarded for Extended Lifecycle Support. The vulnerable pattern (unsanitized config data passed directly to createLayout) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "Target version 4.18.7 is not vulnerable to CVE-2026-25498. The upstream vendor (Pixel & Tonic) fixed the RCE vulnerability in commit 395c64f0b8 on 2026-01-09 by adding ComponentHelper::cleanseConfig() sanitization before passing user-supplied field layout configuration to object creation. This fix was included in the upstream 4.18.7 release (2026-08-18) which TuxCare subsequently onboarded for Extended Lifecycle Support. The vulnerable pattern (unsanitized config data passed directly to createLayout) is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (CVE-2026-27126) affecting versions 4.5.0-RC1 through 4.16.18 was patched in upstream version 4.16.19. The target version 4.18.7 inherited the complete fix from upstream commit f5d488d9bb (authored by brandon@pixelandtonic.com on 2026-01-14). The fix validates table column types against a whitelist and converts unsupported types (includin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (CVE-2026-27126) affecting versions 4.5.0-RC1 through 4.16.18 was patched in upstream version 4.16.19. The target version 4.18.7 inherited the complete fix from upstream commit f5d488d9bb (authored by brandon@pixelandtonic.com on 2026-01-14). The fix validates table column types against a whitelist and converts unsupported types (includin..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-27127 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-27127 (DNS rebinding TOCTOU SSRF). The upstream vendor (Pixel & Tonic) deployed a comprehensive fix in commit 26268c0210 (June 15, 2026) that implements DNS pinning via CURLOPT_RESOLVE and pre-validates IPs through the craftcms/url-validator package. This fix was naturally included in version 4.18.7 (released August 18, 2026). The vulnerable pattern (separate DNS lookups without pinning) has been completely removed from the codebase. This is a vendor-authored fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27127" }, "impact_statement": "The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-27127 (DNS rebinding TOCTOU SSRF). The upstream vendor (Pixel & Tonic) deployed a comprehensive fix in commit 26268c0210 (June 15, 2026) that implements DNS pinning via CURLOPT_RESOLVE and pre-validates IPs through the craftcms/url-validator package. This fix was naturally included in version 4.18.7 (released August 18, 2026). The vulnerable pattern (separate DNS lookups without pinning) has been completely removed from the codebase. This is a vendor-authored fix, not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 The target repository at version 4.18.7 is NOT vulnerable to CVE-2026-27128. The TOCTOU race condition fix was applied by the upstream vendor (Pixel & Tonic) in commit 3e4afe1827 as part of version 4.16.19 (released 2026-01-15). Version 4.18.7, being newer than 4.16.19, naturally includes this fix. The getTokenRoute() method in src/services/Tokens.php correctly uses mutex locking to ensure atom...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target repository at version 4.18.7 is NOT vulnerable to CVE-2026-27128. The TOCTOU race condition fix was applied by the upstream vendor (Pixel & Tonic) in commit 3e4afe1827 as part of version 4.16.19 (released 2026-01-15). Version 4.18.7, being newer than 4.16.19, naturally includes this fix. The getTokenRoute() method in src/services/Tokens.php correctly uses mutex locking to ensure atom..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-27129 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) is NOT AFFECTED by CVE-2026-27129. The vulnerable pattern (using gethostbyname() which only resolves IPv4) is absent because the upstream vendor refactored the code to use the craftcms/url-validator library (commit 26268c0210, Jun 2026). This library uses dns_get_record() with both DNS_A and DNS_AAAA records, and includes comprehensive IPv6 validation via FILTER_FL...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27129" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.7) is NOT AFFECTED by CVE-2026-27129. The vulnerable pattern (using gethostbyname() which only resolves IPv4) is absent because the upstream vendor refactored the code to use the craftcms/url-validator library (commit 26268c0210, Jun 2026). This library uses dns_get_record() with both DNS_A and DNS_AAAA records, and includes comprehensive IPv6 validation via FILTER_FL..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. The target craftcms/cms 4.18.7 contains the upstream vendor fix for CVE-2026-31857. The vulnerable unsandboxed Twig rendering call has been replaced with the sandboxed version in BaseElementSelectConditionRule.php line 88. Fix commit 8d4903647d was authored by brandon@pixelandtonic.com (Craft CMS upstream vendor) as part of the 4.17.4 release, and is included in the 4.18.7 version onboarded by TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "The target craftcms/cms 4.18.7 contains the upstream vendor fix for CVE-2026-31857. The vulnerable unsandboxed Twig rendering call has been replaced with the sandboxed version in BaseElementSelectConditionRule.php line 88. Fix commit 8d4903647d was authored by brandon@pixelandtonic.com (Craft CMS upstream vendor) as part of the 4.17.4 release, and is included in the 4.18.7 version onboarded by TuxCare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. CVE-2026-31858 does not affect Craft CMS version 4.18.7. The vulnerable component ElementSearchController was introduced in Craft CMS 5.x and does not exist in version 4.x. The target repository is running version 4.18.7, which predates the introduction of this controller. The only controller in version 4.18.7 that processes user query criteria (ElementIndexesController) already contains the proper defense mechanism (ElementHelper::cleanseQueryCriteria()) that was added for CVE-2026-25495. No alternative code path exists in version 4.18.7 that exhibits the same SQL injection vulnerability pattern.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "CVE-2026-31858 does not affect Craft CMS version 4.18.7. The vulnerable component ElementSearchController was introduced in Craft CMS 5.x and does not exist in version 4.x. The target repository is running version 4.18.7, which predates the introduction of this controller. The only controller in version 4.18.7 that processes user query criteria (ElementIndexesController) already contains the proper defense mechanism (ElementHelper::cleanseQueryCriteria()) that was added for CVE-2026-25495. No alternative code path exists in version 4.18.7 that exhibits the same SQL injection vulnerability pattern." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-31859 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (XSS via javascript: URLs bypassing strip_tags()) was fixed by upstream vendor commit cc9921c14897ee2b592a431c2356af8a04ce4cfe, which added URL scheme validation before strip_tags() in src/web/User.php::setReturnUrl(). This fix was already present in upstream version 4.18.7 (released 2026-08-18) when TuxCare onboarded it (commit 4a22c9d3d...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31859" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (XSS via javascript: URLs bypassing strip_tags()) was fixed by upstream vendor commit cc9921c14897ee2b592a431c2356af8a04ce4cfe, which added URL scheme validation before strip_tags() in src/web/User.php::setReturnUrl(). This fix was already present in upstream version 4.18.7 (released 2026-08-18) when TuxCare onboarded it (commit 4a22c9d3d..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 The target (craftcms/cms 4.18.7) is not affected by CVE-2026-32262. The vulnerability (path traversal via unsanitized targetFilename parameter in AssetsController->replaceFile() allowing arbitrary file deletion) was fixed by upstream vendor Pixel & Tonic in version 4.17.5 (commit c997efbe4c, Feb 16 2026). The target version 4.18.7 inherits this fix from upstream. The validation code rejecting f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The target (craftcms/cms 4.18.7) is not affected by CVE-2026-32262. The vulnerability (path traversal via unsanitized targetFilename parameter in AssetsController->replaceFile() allowing arbitrary file deletion) was fixed by upstream vendor Pixel & Tonic in version 4.17.5 (commit c997efbe4c, Feb 16 2026). The target version 4.18.7 inherits this fix from upstream. The validation code rejecting f..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. CVE-2026-32263 affects Craft CMS versions 5.6.0 to before 5.9.11, specifically in src/controllers/EntryTypesController.php. The target version 4.18.7 is not affected because: (1) EntryTypesController.php does not exist in version 4.x; (2) Entry type management in 4.x is handled by SectionsController.php which does not use parse_str; (3) All 4 instances of parse_str in version 4.18.7 controllers (FieldsController.php and ElementIndexesController.php) are protected with Component::cleanseConfig() before passing data to Craft::configure(). The vulnerable code pattern described in the CVE does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "CVE-2026-32263 affects Craft CMS versions 5.6.0 to before 5.9.11, specifically in src/controllers/EntryTypesController.php. The target version 4.18.7 is not affected because: (1) EntryTypesController.php does not exist in version 4.x; (2) Entry type management in 4.x is handled by SectionsController.php which does not use parse_str; (3) All 4 instances of parse_str in version 4.18.7 controllers (FieldsController.php and ElementIndexesController.php) are protected with Component::cleanseConfig() before passing data to Craft::configure(). The vulnerable code pattern described in the CVE does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32264 fix dfec46362fcb by brandon@pixelandtonic.com (2026-02-16) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32264 fix dfec46362fcb by brandon@pixelandtonic.com (2026-02-16) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32267 fix 6301e217c5f1 by brandon@pixelandtonic.com (2026-02-18) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32267 fix 6301e217c5f1 by brandon@pixelandtonic.com (2026-02-18) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 4.18.7 is not affected by CVE-2026-33051. The CVE describes an XSS vulnerability specific to versions 5.9.0-beta.1 through 5.9.10 where the creator's fullName is rendered as raw HTML due to Template::raw() combined with Craft::t() in the revision/draft context menu. While the target version 4.18.7 does display creator names in the revision menu (src/templates/_includes/revisionmenu.tw...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Craft CMS 4.18.7 is not affected by CVE-2026-33051. The CVE describes an XSS vulnerability specific to versions 5.9.0-beta.1 through 5.9.10 where the creator's fullName is rendered as raw HTML due to Template::raw() combined with Craft::t() in the revision/draft context menu. While the target version 4.18.7 does display creator names in the revision menu (src/templates/_includes/revisionmenu.tw..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. Version 4.18.7 is NOT affected by CVE-2026-33157. The vulnerability exists in Craft CMS 5.6.0-5.9.12 where a NEW code path (fieldLayouts parameter in ElementIndexesController::actionFilterHud) bypasses existing sanitization. This specific code path does NOT exist in version 4.x. Version 4.18.7 only processes conditionConfig in actionFilterHud(), which is properly sanitized via Component::cleanseConfig() at line 421. The setFieldLayouts() method and fieldLayouts parameter handling were introduced in version 5.x and are completely absent from version 4.18.7's codebase.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "Version 4.18.7 is NOT affected by CVE-2026-33157. The vulnerability exists in Craft CMS 5.6.0-5.9.12 where a NEW code path (fieldLayouts parameter in ElementIndexesController::actionFilterHud) bypasses existing sanitization. This specific code path does NOT exist in version 4.x. Version 4.18.7 only processes conditionConfig in actionFilterHud(), which is properly sanitized via Component::cleanseConfig() at line 421. The setFieldLayouts() method and fieldLayouts parameter handling were introduced in version 5.x and are completely absent from version 4.18.7's codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-33158 is NOT present in Craft CMS 4.18.7. The vulnerability described an authorization bypass in the assets/edit-image endpoint allowing low-privileged users to read private asset content. The upstream vendor (Pixel & Tonic) fixed this in version 4.17.8 (commit e674bbbd30, Feb 25 2026) by adding requireVolumePermissionByAsset() and requirePeerVolumePermissionByAsset() checks. Version 4...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 CVE-2026-33158 is NOT present in Craft CMS 4.18.7. The vulnerability described an authorization bypass in the assets/edit-image endpoint allowing low-privileged users to read private asset content. The upstream vendor (Pixel & Tonic) fixed this in version 4.17.8 (commit e674bbbd30, Feb 25 2026) by adding requireVolumePermissionByAsset() and requirePeerVolumePermissionByAsset() checks. Version 4..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) contains the complete fix for CVE-2026-33159. The upstream vendor (Pixel & Tonic) fixed the vulnerability in commit 7f0ead833f (2026-02-25), included it in their 4.18.7 release (2026-08-18), and TuxCare onboarded that pre-fixed version (2026-09-07). The vulnerable pattern\u2014missing authentication/authorization on ConfigSyncController\u2014is not present at HEAD. Verdict: ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.7) contains the complete fix for CVE-2026-33159. The upstream vendor (Pixel & Tonic) fixed the vulnerability in commit 7f0ead833f (2026-02-25), included it in their 4.18.7 release (2026-08-18), and TuxCare onboarded that pre-fixed version (2026-09-07). The vulnerable pattern\u2014missing authentication/authorization on ConfigSyncController\u2014is not present at HEAD. Verdict: ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-33160 fix 83fd398c12a3 by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-33160 fix 83fd398c12a3 by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-33161 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 4.18.7) contains the upstream vendor's fix for the asset information disclosure vulnerability. The CVE describes an authorization bypass where the assets/image-editor endpoint (actionImageEditor method) returns focalPoint and other editor metadata without validating user permissions. The fix (commit 1f91f9b7aa, GHSA-vgjg-248p-rfm2) added requireVolumePermissionB...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 4.18.7) contains the upstream vendor's fix for the asset information disclosure vulnerability. The CVE describes an authorization bypass where the assets/image-editor endpoint (actionImageEditor method) returns focalPoint and other editor metadata without validating user permissions. The fix (commit 1f91f9b7aa, GHSA-vgjg-248p-rfm2) added requireVolumePermissionB..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS v4.18.7 is not affected by CVE-2026-33162. The vulnerability affects the `/actions/entries/move-to-section` endpoint and Entry::canMove() authorization method, which were introduced in Craft CMS v5.x. Version 4.18.7 does not have the move-entries-between-sections feature at all. The GraphQL resolver explicitly prevents section changes with the error \"Impossible to change the section o...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 Craft CMS v4.18.7 is not affected by CVE-2026-33162. The vulnerability affects the `/actions/entries/move-to-section` endpoint and Entry::canMove() authorization method, which were introduced in Craft CMS v5.x. Version 4.18.7 does not have the move-entries-between-sections feature at all. The GraphQL resolver explicitly prevents section changes with the error \"Impossible to change the section o..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset upload) is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit d20aecfaa0 (March 4, 2026) by adding scheme validation that blocks non-HTTP/HTTPS protocols (gopher, file, ftp, etc.). This fix was later refactored into the craftcms/url-validator library (commit 26268c0210, Jun...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "not_affected \u2014 CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset upload) is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit d20aecfaa0 (March 4, 2026) by adding scheme validation that blocks non-HTTP/HTTPS protocols (gopher, file, ftp, etc.). This fix was later refactored into the craftcms/url-validator library (commit 26268c0210, Jun..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) is not affected by CVE-2026-41130. The SSRF vulnerability in the resource-js endpoint was fixed by upstream vendor (Pixel & Tonic) in commit ebe7e85f1c, which is present in the target. The vulnerable code that made HTTP requests via Guzzle client has been replaced with local filesystem serving using App::resourcePathByUri() with path traversal protection. Additiona...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.7) is not affected by CVE-2026-41130. The SSRF vulnerability in the resource-js endpoint was fixed by upstream vendor (Pixel & Tonic) in commit ebe7e85f1c, which is present in the target. The vulnerable code that made HTTP requests via Guzzle client has been replaced with local filesystem serving using App::resourcePathByUri() with path traversal protection. Additiona..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-55790 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. CVE-2026-55790 (GHSA-24x4-j6x9-rfw5): The XSS vulnerability in the CraftSupport widget is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit 6bbb66038a (May 2026) by adding HTML escaping via Craft.escapeHtml() and using jQuery's text: option for error messages. This fix was included in upstream's 4.18.7 release (August 2026), which TuxCare subsequently adopted for ELS support (September 2026). TuxCare did not backport this specific fix; they inherited an already-fixed upstream release. Both defense mechanisms from the patch are present and correctly implemented at lines 382 and 555-557 of CraftSupportWidget.js.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55790" }, "impact_statement": "CVE-2026-55790 (GHSA-24x4-j6x9-rfw5): The XSS vulnerability in the CraftSupport widget is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit 6bbb66038a (May 2026) by adding HTML escaping via Craft.escapeHtml() and using jQuery's text: option for error messages. This fix was included in upstream's 4.18.7 release (August 2026), which TuxCare subsequently adopted for ELS support (September 2026). TuxCare did not backport this specific fix; they inherited an already-fixed upstream release. Both defense mechanisms from the patch are present and correctly implemented at lines 382 and 555-557 of CraftSupportWidget.js." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-55793 is fixed in version 4.18.7-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55793" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is not affected. The CVE describes a vulnerability in version 5.0.0-RC1+, but analysis of 4.18.7 code shows user group names are protected by Twig's default HTML auto-escaping and Vue's text interpolation escaping. All rendering paths include runtime defenses that transform script content before display, preventing execution in administrators' browsers.", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is not affected. The CVE describes a vulnerability in version 5.0.0-RC1+, but analysis of 4.18.7 code shows user group names are protected by Twig's default HTML auto-escaping and Vue's text interpolation escaping. All rendering paths include runtime defenses that transform script content before display, preventing execution in administrators' browsers." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-56382 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. Target version 4.18.7 is not affected by CVE-2026-56382. The vulnerable method `actionRenderCardPreview()` from the v5.x patch does not exist in v4.18.7's codebase. The CVE affects Craft CMS versions >= 5.5.0 and <= 5.9.13, while this target is v4.18.7. Although TuxCare backported this CVE to v3.9.15 (fixing a different vulnerable method `actionRenderLayoutElementSelector()`), v4.18.7 contains neither the v5.x vulnerable method nor the v3.x vulnerable method. The methods that do exist in v4.18.7 and handle layout configurations (`actionApplyLayoutTabSettings()`, `actionApplyLayoutElementSettings()`) properly sanitize all config parameters via `Component::cleanseConfig()` before passing them to layout creation functions.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56382" }, "impact_statement": "Target version 4.18.7 is not affected by CVE-2026-56382. The vulnerable method `actionRenderCardPreview()` from the v5.x patch does not exist in v4.18.7's codebase. The CVE affects Craft CMS versions >= 5.5.0 and <= 5.9.13, while this target is v4.18.7. Although TuxCare backported this CVE to v3.9.15 (fixing a different vulnerable method `actionRenderLayoutElementSelector()`), v4.18.7 contains neither the v5.x vulnerable method nor the v3.x vulnerable method. The methods that do exist in v4.18.7 and handle layout configurations (`actionApplyLayoutTabSettings()`, `actionApplyLayoutElementSettings()`) properly sanitize all config parameters via `Component::cleanseConfig()` before passing them to layout creation functions." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-56383 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The upstream vendor fix (commit 7b372de262b8) is present in HEAD, applying HTML encoding to heading-type cell values before rendering. The fix was authored by brandon@pixelandtonic.com (Craft CMS upstream) and shipped in version 4.16.19. TuxCare onboarded version 4.18.7 (released 2026-08-18) which already contained this fix. No TuxCare attribution signals ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56383" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The upstream vendor fix (commit 7b372de262b8) is present in HEAD, applying HTML encoding to heading-type cell values before rendering. The fix was authored by brandon@pixelandtonic.com (Craft CMS upstream) and shipped in version 4.16.19. TuxCare onboarded version 4.18.7 (released 2026-08-18) which already contained this fix. No TuxCare attribution signals ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-56384 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-56384 fix ed56049c9d3f by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56384" }, "impact_statement": "not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-56384 fix ed56049c9d3f by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-56385 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 contains the upstream vendor's authorization fix for CVE-2026-56385. The vulnerability (authorization bypass in assets/preview-file endpoint) was fixed by Pixel & Tonic in commit d30df31122 (Feb 2026) which added requireVolumePermissionByAsset and requirePeerVolumePermissionByAsset checks to actionPreviewFile(). This fix was included in upstream Craft CMS 4.17.8 and 4.18.7...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56385" }, "impact_statement": "not_affected \u2014 Target version 4.18.7 contains the upstream vendor's authorization fix for CVE-2026-56385. The vulnerability (authorization bypass in assets/preview-file endpoint) was fixed by Pixel & Tonic in commit d30df31122 (Feb 2026) which added requireVolumePermissionByAsset and requirePeerVolumePermissionByAsset checks to actionPreviewFile(). This fix was included in upstream Craft CMS 4.17.8 and 4.18.7..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-56393 affects version 4.18.7-p5+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-56393" }, "action_statement": "Vulnerability CVE-2026-56393 affects version 4.18.7-p5+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 4.18.7-p5+tuxcare of craftcms/cms. Target Craft CMS 4.18.7 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint has been fixed by upstream vendor commit 30f5f1a8d6 (authored by brandon@pixelandtonic.com), which added regex validation to reject extension parameters containing traversal sequences. The fix validates extensions with /^\\w+$/ before filesystem operations, preventing the attack chain described in the CVE. TuxCare adopted this fix when onboarding version 4.18.7 to ELS support.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "Target Craft CMS 4.18.7 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint has been fixed by upstream vendor commit 30f5f1a8d6 (authored by brandon@pixelandtonic.com), which added regex validation to reject extension parameters containing traversal sequences. The fix validates extensions with /^\\w+$/ before filesystem operations, preventing the attack chain described in the CVE. TuxCare adopted this fix when onboarding version 4.18.7 to ELS support." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.7-p5+tuxcare" } } ], "timestamp": "2026-11-11T17:15:44.786653+00:00", "status_notes": "Vulnerability GHSA-wf98-vxv9-jqfv does not affect version 4.18.7-p5+tuxcare of craftcms/cms. not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was fixed in upstream Craft CMS 3.7.29 (commit 7ca2b2d2c by brandon@pixelandtonic.com, Jan 2022) and was already present in the 4.18.7 release that TuxCare onboarded. The fix adds a filter validating feed item permalinks match /^https?:\\/\\// before creating anchor elements, pre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wf98-vxv9-jqfv" }, "impact_statement": "not_affected \u2014 The target Craft CMS 4.18.7-p3+tuxcare is NOT AFFECTED by GHSA-wf98-vxv9-jqfv (XSS in Feeds widget). The vulnerability was fixed in upstream Craft CMS 3.7.29 (commit 7ca2b2d2c by brandon@pixelandtonic.com, Jan 2022) and was already present in the 4.18.7 release that TuxCare onboarded. The fix adds a filter validating feed item permalinks match /^https?:\\/\\// before creating anchor elements, pre..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:39:03.770563+00:00", "status_notes": "Vulnerability CVE-2022-29248 affects version 7.9.3-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-29248" }, "action_statement": "Vulnerability CVE-2022-29248 affects version 7.9.3-p1+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:39:03.770563+00:00", "status_notes": "Vulnerability CVE-2022-31042 affects version 7.9.3-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31042" }, "action_statement": "Vulnerability CVE-2022-31042 affects version 7.9.3-p1+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:39:03.770563+00:00", "status_notes": "Vulnerability CVE-2022-31043 affects version 7.9.3-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31043" }, "action_statement": "Vulnerability CVE-2022-31043 affects version 7.9.3-p1+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:39:03.770563+00:00", "status_notes": "Vulnerability CVE-2022-31090 affects version 7.9.3-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31090" }, "action_statement": "Vulnerability CVE-2022-31090 affects version 7.9.3-p1+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:39:03.770563+00:00", "status_notes": "Vulnerability CVE-2022-31091 affects version 7.9.3-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2022-31091" }, "action_statement": "Vulnerability CVE-2022-31091 affects version 7.9.3-p1+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:39:03.770563+00:00", "status_notes": "Vulnerability CVE-2026-55568 affects version 7.9.3-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55568" }, "action_statement": "Vulnerability CVE-2026-55568 affects version 7.9.3-p1+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:39:03.770563+00:00", "status_notes": "Vulnerability CVE-2026-55767 affects version 7.9.3-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55767" }, "action_statement": "Vulnerability CVE-2026-55767 affects version 7.9.3-p1+tuxcare of guzzlehttp/guzzle." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:40:04.747620+00:00", "status_notes": "Vulnerability CVE-2026-59883 is fixed in version 7.9.3-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-59883" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:39:03.770563+00:00", "status_notes": "Vulnerability CVE-2026-67339 affects version 7.9.3-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67339" }, "action_statement": "Vulnerability CVE-2026-67339 affects version 7.9.3-p1+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:39:03.770563+00:00", "status_notes": "Vulnerability CVE-2026-67353 affects version 7.9.3-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67353" }, "action_statement": "Vulnerability CVE-2026-67353 affects version 7.9.3-p1+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:39:03.770563+00:00", "status_notes": "Vulnerability CVE-2026-67354 affects version 7.9.3-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67354" }, "action_statement": "Vulnerability CVE-2026-67354 affects version 7.9.3-p1+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:39:03.770563+00:00", "status_notes": "Vulnerability CVE-2026-67355 affects version 7.9.3-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67355" }, "action_statement": "Vulnerability CVE-2026-67355 affects version 7.9.3-p1+tuxcare of guzzlehttp/guzzle." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare" } } ], "timestamp": "2026-11-11T15:11:00.031462+00:00", "status_notes": "Vulnerability CVE-2026-69245 affects version 7.9.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.9.3-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-69245" }, "action_statement": "Vulnerability CVE-2026-69245 affects version 7.9.3-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 7.9.3-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:39:03.770563+00:00", "status_notes": "Vulnerability CVE-2026-69246 affects version 7.9.3-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-69246" }, "action_statement": "Vulnerability CVE-2026-69246 affects version 7.9.3-p1+tuxcare of guzzlehttp/guzzle." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:39:03.770563+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 7.9.3-p1+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:39:03.770563+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 7.9.3-p1+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:39:03.770563+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 7.9.3-p1+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@7.9.3-p1+tuxcare" } } ], "timestamp": "2026-11-10T15:39:03.770563+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 7.9.3-p1+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@3.4.47-p4+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@3.4.47-p4+tuxcare" } } ], "timestamp": "2026-11-11T15:15:16.801434+00:00", "status_notes": "Vulnerability CVE-2018-14773 does not affect version 3.4.47-p4+tuxcare of symfony/http-foundation. not_affected \u2014 The target repository is NOT AFFECTED by CVE-2018-14773. The vulnerable code pattern (X_ORIGINAL_URL and X_REWRITE_URL header processing in prepareRequestUri()) is not present. The fix was applied in upstream Symfony v3.4.14 by Nicolas Grekas, and TuxCare onboarded v3.4.47 which already included this fix. The CHANGELOG confirms the BC BREAK removal of IIS-only X_ORIGINAL_URL and X_REWRITE_URL h...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14773" }, "impact_statement": "not_affected \u2014 The target repository is NOT AFFECTED by CVE-2018-14773. The vulnerable code pattern (X_ORIGINAL_URL and X_REWRITE_URL header processing in prepareRequestUri()) is not present. The fix was applied in upstream Symfony v3.4.14 by Nicolas Grekas, and TuxCare onboarded v3.4.47 which already included this fix. The CHANGELOG confirms the BC BREAK removal of IIS-only X_ORIGINAL_URL and X_REWRITE_URL h..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@3.4.47-p4+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@3.4.47-p4+tuxcare" } } ], "timestamp": "2026-11-11T15:15:16.801434+00:00", "status_notes": "Vulnerability CVE-2019-10913 does not affect version 3.4.47-p4+tuxcare of symfony/http-foundation. The target version (symfony/http-foundation v3.4.47) is NOT AFFECTED by CVE-2019-10913. The vulnerability was fixed in upstream Symfony 3.4.26 (April 2019), and version 3.4.47 already contains the fix. The Request.php getMethod() function includes validation that: (1) checks method override strings against a whitelist of standard HTTP verbs, and (2) validates non-whitelisted methods contain only uppercase letters A-Z, rejecting any string with special characters that could enable SQL injection or XSS. This fix was present in the upstream release before TuxCare onboarded the project.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10913" }, "impact_statement": "The target version (symfony/http-foundation v3.4.47) is NOT AFFECTED by CVE-2019-10913. The vulnerability was fixed in upstream Symfony 3.4.26 (April 2019), and version 3.4.47 already contains the fix. The Request.php getMethod() function includes validation that: (1) checks method override strings against a whitelist of standard HTTP verbs, and (2) validates non-whitelisted methods contain only uppercase letters A-Z, rejecting any string with special characters that could enable SQL injection or XSS. This fix was present in the upstream release before TuxCare onboarded the project." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@3.4.47-p4+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@3.4.47-p4+tuxcare" } } ], "timestamp": "2026-11-11T15:15:16.801434+00:00", "status_notes": "Vulnerability CVE-2019-18888 does not affect version 3.4.47-p4+tuxcare of symfony/http-foundation. The target repository (symfony/http-foundation v3.4.47) is not affected by CVE-2019-18888. The vulnerability pattern (arbitrary command arguments passed to the `file` command via dash-prefixed filenames) is not present in the code. Both defensive transformations from the upstream patch are already in place: (1) the `--` option terminator in the command template (line 34), and (2) the `./` prefix prepended to paths starting with `-` (line 83). The fix was included in upstream Symfony v3.4.47 and imported via TuxCare's onboarding commit f73aa544e1481540d21e5a9829b63a4d0abd98aa.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-18888" }, "impact_statement": "The target repository (symfony/http-foundation v3.4.47) is not affected by CVE-2019-18888. The vulnerability pattern (arbitrary command arguments passed to the `file` command via dash-prefixed filenames) is not present in the code. Both defensive transformations from the upstream patch are already in place: (1) the `--` option terminator in the command template (line 34), and (2) the `./` prefix prepended to paths starting with `-` (line 83). The fix was included in upstream Symfony v3.4.47 and imported via TuxCare's onboarding commit f73aa544e1481540d21e5a9829b63a4d0abd98aa." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@3.4.47-p4+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@3.4.47-p4+tuxcare" } } ], "timestamp": "2026-11-11T15:15:16.801434+00:00", "status_notes": "Vulnerability CVE-2024-50345 is fixed in version 3.4.47-p4+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2024-50345" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@3.4.47-p4+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@3.4.47-p4+tuxcare" } } ], "timestamp": "2026-11-11T15:15:16.801434+00:00", "status_notes": "Vulnerability CVE-2025-64500 is fixed in version 3.4.47-p4+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2025-64500" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@3.4.47-p4+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@3.4.47-p4+tuxcare" } } ], "timestamp": "2026-11-11T15:15:16.801434+00:00", "status_notes": "Vulnerability CVE-2026-108082 does not affect version 3.4.47-p4+tuxcare of symfony/http-foundation. Version 3.4.47 is not affected by CVE-2026-108082. The vulnerable component (HeaderUtils class with its split() method containing nested quantifiers and negative lookbehind causing exponential regex backtracking) does not exist in this version. Version 3.4.47 predates the introduction of HeaderUtils (added in Symfony 4.x+). The alternative implementation HeaderBag::parseCacheControl() uses a simple linear regex pattern with no nested quantifiers, making exponential backtracking structurally impossible. TuxCare backported this CVE to versions 4.4.49, 5.4.50, 6.4.35, and 7.4.8, but not to 3.4.47, confirming vendor assessment that this version is unaffected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-108082" }, "impact_statement": "Version 3.4.47 is not affected by CVE-2026-108082. The vulnerable component (HeaderUtils class with its split() method containing nested quantifiers and negative lookbehind causing exponential regex backtracking) does not exist in this version. Version 3.4.47 predates the introduction of HeaderUtils (added in Symfony 4.x+). The alternative implementation HeaderBag::parseCacheControl() uses a simple linear regex pattern with no nested quantifiers, making exponential backtracking structurally impossible. TuxCare backported this CVE to versions 4.4.49, 5.4.50, 6.4.35, and 7.4.8, but not to 3.4.47, confirming vendor assessment that this version is unaffected." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@3.4.47-p4+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@3.4.47-p4+tuxcare" } } ], "timestamp": "2026-11-11T15:16:00.058053+00:00", "status_notes": "Vulnerability CVE-2026-118514 is fixed in version 3.4.47-p4+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2026-118514" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@3.4.47-p4+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@3.4.47-p4+tuxcare" } } ], "timestamp": "2026-11-11T15:15:16.801434+00:00", "status_notes": "Vulnerability CVE-2026-48736 does not affect version 3.4.47-p4+tuxcare of symfony/http-foundation. not_affected \u2014 Target version 3.4.47 is not affected by CVE-2026-48736. The vulnerability requires PRIVATE_SUBNETS constant and isPrivateIp() method for blocking requests to private networks via IPv6 transition forms, but these components were introduced in Symfony 5.4-6.4+ (years later, in 2023-2024). Version 3.4.47 lacks the architectural features required for this vulnerability pattern to exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48736" }, "impact_statement": "not_affected \u2014 Target version 3.4.47 is not affected by CVE-2026-48736. The vulnerability requires PRIVATE_SUBNETS constant and isPrivateIp() method for blocking requests to private networks via IPv6 transition forms, but these components were introduced in Symfony 5.4-6.4+ (years later, in 2023-2024). Version 3.4.47 lacks the architectural features required for this vulnerability pattern to exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2018-14773 does not affect version 2.8.52-p2+tuxcare of symfony/http-foundation. not_affected \u2014 CVE-2018-14773 affects Symfony HttpFoundation 2.8.0-2.8.43 via untrusted X_ORIGINAL_URL and X_REWRITE_URL headers that override request URIs. The target (v2.8.52) is NOT AFFECTED\u2014the vulnerable code was removed by upstream Symfony in v2.8.44 (commit 5097611b by Nicolas Grekas). TuxCare onboarded v2.8.52 as a snapshot (commit 877d4cd2), and the fix was already present in that upstream release. N...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14773" }, "impact_statement": "not_affected \u2014 CVE-2018-14773 affects Symfony HttpFoundation 2.8.0-2.8.43 via untrusted X_ORIGINAL_URL and X_REWRITE_URL headers that override request URIs. The target (v2.8.52) is NOT AFFECTED\u2014the vulnerable code was removed by upstream Symfony in v2.8.44 (commit 5097611b by Nicolas Grekas). TuxCare onboarded v2.8.52 as a snapshot (commit 877d4cd2), and the fix was already present in that upstream release. N..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:19:23.616509+00:00", "status_notes": "Vulnerability CVE-2019-10913 does not affect version 2.8.52-p2+tuxcare of symfony/http-foundation. CVE-2019-10913 does not affect this version. The target is symfony/http-foundation v2.8.52-p2+tuxcare, which already contains the security fix. The CVE affects \"Symfony 2.8.x before 2.8.50\" - version 2.8.52 is after 2.8.50 and includes the upstream fix. The vulnerable pattern (unvalidated HTTP method override) is not present. The target code validates method overrides against a whitelist and rejects invalid characters, matching the security patch behavior.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10913" }, "impact_statement": "CVE-2019-10913 does not affect this version. The target is symfony/http-foundation v2.8.52-p2+tuxcare, which already contains the security fix. The CVE affects \"Symfony 2.8.x before 2.8.50\" - version 2.8.52 is after 2.8.50 and includes the upstream fix. The vulnerable pattern (unvalidated HTTP method override) is not present. The target code validates method overrides against a whitelist and rejects invalid characters, matching the security patch behavior." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:19:00.032324+00:00", "status_notes": "Vulnerability CVE-2019-18888 does not affect version 2.8.52-p2+tuxcare of symfony/http-foundation. The target repository symfony/http-foundation v2.8.52-p2+tuxcare is NOT AFFECTED by CVE-2019-18888. The vulnerability was fixed by upstream Symfony in version 2.8.52 (commit 3929d9fe by Nicolas Grekas on 2019-04-19), which added both `--` to the file command and `./` prepending for paths starting with `-`. The CVE lists affected versions as \"2.8.0 through 2.8.50\". TuxCare onboarded v2.8.52 which already contained the upstream fix, so the vulnerable code pattern is not present in this target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-18888" }, "impact_statement": "The target repository symfony/http-foundation v2.8.52-p2+tuxcare is NOT AFFECTED by CVE-2019-18888. The vulnerability was fixed by upstream Symfony in version 2.8.52 (commit 3929d9fe by Nicolas Grekas on 2019-04-19), which added both `--` to the file command and `./` prepending for paths starting with `-`. The CVE lists affected versions as \"2.8.0 through 2.8.50\". TuxCare onboarded v2.8.52 which already contained the upstream fix, so the vulnerable code pattern is not present in this target." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-50345 is fixed in version 2.8.52-p2+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2024-50345" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64500 is fixed in version 2.8.52-p2+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2025-64500" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:22:00.099756+00:00", "status_notes": "Vulnerability CVE-2026-108082 does not affect version 2.8.52-p2+tuxcare of symfony/http-foundation. Target version v2.8.52 is NOT AFFECTED by CVE-2026-108082. The vulnerable HeaderUtils::split() method with its exponential-backtracking regex pattern does not exist in this version. HeaderUtils was introduced in Symfony HttpFoundation v4.1.0 (April 2018), while v2.8.52 is from the older 2.x series. Cache-Control header parsing in v2.8.52 uses HeaderBag::parseCacheControl() with a different regex pattern that does not exhibit the ReDoS vulnerability. This is a Type A2 case: HTTP headers are received (Input present), but the vulnerable code path does not exist, and no alternative mechanism causes exponential CPU consumption (Goal not reachable).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-108082" }, "impact_statement": "Target version v2.8.52 is NOT AFFECTED by CVE-2026-108082. The vulnerable HeaderUtils::split() method with its exponential-backtracking regex pattern does not exist in this version. HeaderUtils was introduced in Symfony HttpFoundation v4.1.0 (April 2018), while v2.8.52 is from the older 2.x series. Cache-Control header parsing in v2.8.52 uses HeaderBag::parseCacheControl() with a different regex pattern that does not exhibit the ReDoS vulnerability. This is a Type A2 case: HTTP headers are received (Input present), but the vulnerable code path does not exist, and no alternative mechanism causes exponential CPU consumption (Goal not reachable)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:13:00.039900+00:00", "status_notes": "Vulnerability CVE-2026-118514 affects version 2.8.52-p2+tuxcare of symfony/http-foundation, and is fixed in 2.8.52-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-118514" }, "action_statement": "Vulnerability CVE-2026-118514 affects version 2.8.52-p2+tuxcare of symfony/http-foundation, and is fixed in 2.8.52-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare" } } ], "timestamp": "2026-10-29T01:02:19.900071+00:00", "status_notes": "Vulnerability CVE-2026-48736 does not affect version 2.8.52-p2+tuxcare of symfony/http-foundation. not_affected \u2014 Version 2.8.52 of symfony/http-foundation is NOT AFFECTED by CVE-2026-48736. The vulnerability requires the PRIVATE_SUBNETS constant (introduced in 6.4+) and the isPrivateIp() method, neither of which exist in version 2.8.52. This version only provides generic IP validation utilities (checkIp, checkIp4, checkIp6) without built-in private subnet detection. The vulnerable code pattern - a pre-def...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48736" }, "impact_statement": "not_affected \u2014 Version 2.8.52 of symfony/http-foundation is NOT AFFECTED by CVE-2026-48736. The vulnerability requires the PRIVATE_SUBNETS constant (introduced in 6.4+) and the isPrivateIp() method, neither of which exist in version 2.8.52. This version only provides generic IP validation utilities (checkIp, checkIp4, checkIp6) without built-in private subnet detection. The vulnerable code pattern - a pre-def..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v4.4.51-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v4.4.51-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:18:05.817181+00:00", "status_notes": "Vulnerability CVE-2022-24894 does not affect version v4.4.51-p2+tuxcare of symfony/http-kernel. not_affected \u2014 The target repository (symfony/http-kernel v4.4.51-p1+tuxcare) is NOT AFFECTED by CVE-2022-24894. The vulnerability involves HTTP cache storing Set-Cookie headers and serving them to unintended clients. The upstream fix, which removes private headers (default: Set-Cookie) before storing responses in cache, was already present in the v4.4.51 release that TuxCare onboarded. The defense mechanism ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-24894" }, "impact_statement": "not_affected \u2014 The target repository (symfony/http-kernel v4.4.51-p1+tuxcare) is NOT AFFECTED by CVE-2022-24894. The vulnerability involves HTTP cache storing Set-Cookie headers and serving them to unintended clients. The upstream fix, which removes private headers (default: Set-Cookie) before storing responses in cache, was already present in the v4.4.51 release that TuxCare onboarded. The defense mechanism ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v4.4.51-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v4.4.51-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:18:54.048730+00:00", "status_notes": "Vulnerability CVE-2026-123339 is fixed in version v4.4.51-p2+tuxcare of symfony/http-kernel.", "vulnerability": { "name": "CVE-2026-123339" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v4.4.51-p2+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v4.4.51-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:18:05.817181+00:00", "status_notes": "Vulnerability CVE-2026-45075 does not affect version v4.4.51-p2+tuxcare of symfony/http-kernel. Target version v4.4.51-p1+tuxcare is not affected by CVE-2026-45075. The vulnerability concerns PHP 8 attributes (#[IsGranted], #[IsSignatureValid], #[IsCsrfTokenValid]) with methods filtering that allows HEAD requests to bypass security checks when only GET is specified. These security attributes were introduced in Symfony 7.4+ (September 2025) and require PHP 8.0+. The target version 4.4.51 requires PHP \u22657.1.3 and predates PHP attributes entirely. The vulnerable code pattern does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45075" }, "impact_statement": "Target version v4.4.51-p1+tuxcare is not affected by CVE-2026-45075. The vulnerability concerns PHP 8 attributes (#[IsGranted], #[IsSignatureValid], #[IsCsrfTokenValid]) with methods filtering that allows HEAD requests to bypass security checks when only GET is specified. These security attributes were introduced in Symfony 7.4+ (September 2025) and require PHP 8.0+. The target version 4.4.51 requires PHP \u22657.1.3 and predates PHP attributes entirely. The vulnerable code pattern does not exist in this version." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare" } } ], "timestamp": "2026-11-11T16:51:32.676602+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 5.8.38-p10+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare" } } ], "timestamp": "2026-11-11T16:51:32.676602+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.8.38-p10+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare" } } ], "timestamp": "2026-11-11T16:51:32.676602+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.8.38-p10+tuxcare of laravel/framework. The target (Laravel 5.8.38) is not affected by CVE-2018-15133. The vulnerability was fixed upstream by Taylor Otwell in August 2018 by disabling PHP serialization for cookies and the X-XSRF-TOKEN header. Laravel 5.8.38 shipped with this fix already applied. The fix prevents PHP object injection by passing `false` to encrypt()/decrypt() methods, which disables automatic unserialize() calls on decrypted data. The vulnerable code pattern (automatic unserialization enabling RCE via crafted XSRF tokens) is not present in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "The target (Laravel 5.8.38) is not affected by CVE-2018-15133. The vulnerability was fixed upstream by Taylor Otwell in August 2018 by disabling PHP serialization for cookies and the X-XSRF-TOKEN header. Laravel 5.8.38 shipped with this fix already applied. The fix prevents PHP object injection by passing `false` to encrypt()/decrypt() methods, which disables automatic unserialize() calls on decrypted data. The vulnerable code pattern (automatic unserialization enabling RCE via crafted XSRF tokens) is not present in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare" } } ], "timestamp": "2026-11-11T16:51:32.676602+00:00", "status_notes": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.8.38-p10+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19).", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare" } } ], "timestamp": "2026-11-11T16:51:32.676602+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 5.8.38-p10+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before 5.8.17. The target is version 5.8.38-p8+tuxcare, which already contains the upstream fix. The vulnerability was an OS command injection in the link() function where unescaped $link and $target parameters were interpolated into an exec() call. The fix wraps both parameters with escapeshellarg() before shell execution. This fix was already present in the upstream Laravel 5.8.38 release and was imported via the Initial commit when TuxCare onboarded this version. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before 5.8.17. The target is version 5.8.38-p8+tuxcare, which already contains the upstream fix. The vulnerability was an OS command injection in the link() function where unescaped $link and $target parameters were interpolated into an exec() call. The fix wraps both parameters with escapeshellarg() before shell execution. This fix was already present in the upstream Laravel 5.8.38 release and was imported via the Initial commit when TuxCare onboarded this version. The vulnerable code pattern is not present in the target." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare" } } ], "timestamp": "2026-11-11T16:51:32.676602+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.8.38-p10+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare" } } ], "timestamp": "2026-11-11T16:51:32.676602+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 5.8.38-p10+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 5.8.38-p10+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare" } } ], "timestamp": "2026-11-11T16:51:32.676602+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.8.38-p10+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare" } } ], "timestamp": "2026-11-11T16:51:32.676602+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.8.38-p10+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare" } } ], "timestamp": "2026-11-11T16:51:32.676602+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.8.38-p10+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare" } } ], "timestamp": "2026-11-11T16:51:32.676602+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.8.38-p10+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare" } } ], "timestamp": "2026-11-11T16:51:32.676602+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.8.38-p10+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare" } } ], "timestamp": "2026-11-11T16:51:32.676602+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.8.38-p10+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare" } } ], "timestamp": "2026-11-11T16:51:32.676602+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 5.8.38-p10+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare" } } ], "timestamp": "2026-11-11T16:51:32.676602+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.8.38-p10+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare" } } ], "timestamp": "2026-11-11T16:51:32.676602+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 5.8.38-p10+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare" } } ], "timestamp": "2026-11-11T16:51:32.676602+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.8.38-p10+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare" } } ], "timestamp": "2026-11-11T16:51:32.676602+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.8.38-p10+tuxcare of laravel/framework. not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare" } } ], "timestamp": "2026-11-11T16:51:32.676602+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.8.38-p10+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare" } } ], "timestamp": "2026-11-11T16:51:32.676602+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p10+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p10+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare" } } ], "timestamp": "2026-11-11T16:51:32.676602+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.8.38-p10+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare" } } ], "timestamp": "2026-11-11T16:51:32.676602+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p10+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p10+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.8.38-p10+tuxcare" } } ], "timestamp": "2026-11-11T16:51:32.676602+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.8.38-p10+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:40:09.352558+00:00", "status_notes": "Vulnerability CVE-2022-29248 does not affect version 6.5.8-p1+tuxcare of guzzlehttp/guzzle. Target guzzlehttp/guzzle 6.5.8-p4+tuxcare contains the fix for CVE-2022-29248 (cross-domain cookie leakage), but the fix came from upstream Guzzle 6.5.6 (released 2022-05-25 by Graham Campbell), not from a TuxCare backport. The TuxCare snapshot commit (0d8fa44a by bashebr@cloudlinux.com) onboarded upstream version 6.5.8 which already included the fix. Per A1 rule, an onboarding/snapshot commit is not a fix commit; when it's the only commit carrying the fix, the fix came with the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-29248" }, "impact_statement": "Target guzzlehttp/guzzle 6.5.8-p4+tuxcare contains the fix for CVE-2022-29248 (cross-domain cookie leakage), but the fix came from upstream Guzzle 6.5.6 (released 2022-05-25 by Graham Campbell), not from a TuxCare backport. The TuxCare snapshot commit (0d8fa44a by bashebr@cloudlinux.com) onboarded upstream version 6.5.8 which already included the fix. Per A1 rule, an onboarding/snapshot commit is not a fix commit; when it's the only commit carrying the fix, the fix came with the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:18:21.473206+00:00", "status_notes": "Vulnerability CVE-2022-31042 does not affect version 6.5.8-p1+tuxcare of guzzlehttp/guzzle. The target repository (guzzlehttp/guzzle 6.5.8-p4+tuxcare) is NOT affected by CVE-2022-31042. The vulnerability (Cookie header leakage on cross-origin redirects or HTTPS\u2192HTTP downgrades) was fixed in upstream Guzzle 6.5.7 (released 2022-06-09). The target is based on upstream 6.5.8 (released 2022-06-20), which includes the fix using Psr7\\UriComparator::isCrossOrigin() at src/RedirectMiddleware.php:222-224. This implementation strips Cookie headers when host differs, scheme changes, or port changes\u2014providing equivalent or superior protection to the CVE fix. The vulnerable code pattern is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31042" }, "impact_statement": "The target repository (guzzlehttp/guzzle 6.5.8-p4+tuxcare) is NOT affected by CVE-2022-31042. The vulnerability (Cookie header leakage on cross-origin redirects or HTTPS\u2192HTTP downgrades) was fixed in upstream Guzzle 6.5.7 (released 2022-06-09). The target is based on upstream 6.5.8 (released 2022-06-20), which includes the fix using Psr7\\UriComparator::isCrossOrigin() at src/RedirectMiddleware.php:222-224. This implementation strips Cookie headers when host differs, scheme changes, or port changes\u2014providing equivalent or superior protection to the CVE fix. The vulnerable code pattern is not present." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-11-11T14:26:45.678254+00:00", "status_notes": "Vulnerability CVE-2022-31043 does not affect version 6.5.8-p1+tuxcare of guzzlehttp/guzzle. guzzlehttp/guzzle 6.5.8 is NOT AFFECTED by CVE-2022-31043 (Authorization header not stripped on HTTPS->HTTP redirect). The vendor fixed it in upstream Guzzle 6.5.7 (2022-06-09, CHANGELOG: \"Fix failure to strip Authorization header on HTTP downgrade\"); 6.5.8 inherits the fix. Advisory affected range is < 6.5.7 and 7.0.0 - < 7.4.4. The fix was authored by the upstream Guzzle maintainers, not by TuxCare. Verified: src/RedirectMiddleware.php in our 6.5.8 vendor snapshot (0d8fa44a) is byte-identical to vendor tag 6.5.8 and removes the Authorization and Cookie headers on any cross-origin redirect, scheme downgrade included (lines 221-225); tests/RedirectMiddlewareTest.php::testHeadersTreatmentOnRedirect covers https://example.com -> http://example.com and asserts Authorization is removed. No backport needed (Jira PHPELSCVE-1122).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31043" }, "impact_statement": "guzzlehttp/guzzle 6.5.8 is NOT AFFECTED by CVE-2022-31043 (Authorization header not stripped on HTTPS->HTTP redirect). The vendor fixed it in upstream Guzzle 6.5.7 (2022-06-09, CHANGELOG: \"Fix failure to strip Authorization header on HTTP downgrade\"); 6.5.8 inherits the fix. Advisory affected range is < 6.5.7 and 7.0.0 - < 7.4.4. The fix was authored by the upstream Guzzle maintainers, not by TuxCare. Verified: src/RedirectMiddleware.php in our 6.5.8 vendor snapshot (0d8fa44a) is byte-identical to vendor tag 6.5.8 and removes the Authorization and Cookie headers on any cross-origin redirect, scheme downgrade included (lines 221-225); tests/RedirectMiddlewareTest.php::testHeadersTreatmentOnRedirect covers https://example.com -> http://example.com and asserts Authorization is removed. No backport needed (Jira PHPELSCVE-1122)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2022-31090 does not affect version 6.5.8-p1+tuxcare of guzzlehttp/guzzle. CVE-2022-31090 fix is already present in target version 6.5.8. The vulnerability concerned Authorization header leakage when following HTTP redirects to different origins (host/port/scheme changes). The upstream Guzzle 6.5.8 release (June 20, 2022) included the complete fix using Psr7\\UriComparator::isCrossOrigin() to remove curl auth options and sensitive headers on cross-origin redirects. TuxCare onboarded this version via snapshot commit 0d8fa44a, which already contained the fix. Both defense points are present: line 98 removes CURLOPT_HTTPAUTH/CURLOPT_USERPWD, line 222 removes Authorization/Cookie headers when isCrossOrigin() detects origin changes.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31090" }, "impact_statement": "CVE-2022-31090 fix is already present in target version 6.5.8. The vulnerability concerned Authorization header leakage when following HTTP redirects to different origins (host/port/scheme changes). The upstream Guzzle 6.5.8 release (June 20, 2022) included the complete fix using Psr7\\UriComparator::isCrossOrigin() to remove curl auth options and sensitive headers on cross-origin redirects. TuxCare onboarded this version via snapshot commit 0d8fa44a, which already contained the fix. Both defense points are present: line 98 removes CURLOPT_HTTPAUTH/CURLOPT_USERPWD, line 222 removes Authorization/Cookie headers when isCrossOrigin() detects origin changes." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:18:21.473206+00:00", "status_notes": "Vulnerability CVE-2022-31091 does not affect version 6.5.8-p1+tuxcare of guzzlehttp/guzzle. Target version 6.5.8-p4+tuxcare is not affected by CVE-2022-31091. The vulnerable pattern (shouldStripSensitiveHeaders method that only checked host and scheme-downgrade) is absent. The target uses the fixed implementation (Psr7\\UriComparator::isCrossOrigin) that properly checks host, port, AND scheme changes before removing sensitive headers on redirects. This fix was already present in the upstream 6.5.8 release (by Graham Campbell, 2022-06-20) that TuxCare onboarded via snapshot commit 0d8fa44a.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31091" }, "impact_statement": "Target version 6.5.8-p4+tuxcare is not affected by CVE-2022-31091. The vulnerable pattern (shouldStripSensitiveHeaders method that only checked host and scheme-downgrade) is absent. The target uses the fixed implementation (Psr7\\UriComparator::isCrossOrigin) that properly checks host, port, AND scheme changes before removing sensitive headers on redirects. This fix was already present in the upstream 6.5.8 release (by Graham Campbell, 2022-06-20) that TuxCare onboarded via snapshot commit 0d8fa44a." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55568 is fixed in version 6.5.8-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55568" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55767 is fixed in version 6.5.8-p1+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55767" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59883 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-59883" }, "action_statement": "Vulnerability CVE-2026-59883 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67339 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-67339" }, "action_statement": "Vulnerability CVE-2026-67339 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67353 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-67353" }, "action_statement": "Vulnerability CVE-2026-67353 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67354 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-67354" }, "action_statement": "Vulnerability CVE-2026-67354 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67355 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-67355" }, "action_statement": "Vulnerability CVE-2026-67355 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69245 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-69245" }, "action_statement": "Vulnerability CVE-2026-69245 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69246 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-69246" }, "action_statement": "Vulnerability CVE-2026-69246 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 6.5.8-p1+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 6.5.8-p1+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" }, "action_statement": "Vulnerability GHSA-94pj-82f3-465w affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p3+tuxcare.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" }, "action_statement": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" }, "action_statement": "Vulnerability GHSA-h95v-h523-3mw8 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 6.5.8-p1+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 6.5.8-p1+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" }, "action_statement": "Vulnerability GHSA-wm3w-8rrp-j577 affects version 6.5.8-p1+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p11+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p11+tuxcare" } } ], "timestamp": "2026-11-11T16:59:15.993175+00:00", "status_notes": "Vulnerability CVE-2022-25270 is fixed in version 8.9.20-p11+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25270" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p11+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p11+tuxcare" } } ], "timestamp": "2026-11-11T16:59:15.993175+00:00", "status_notes": "Vulnerability CVE-2022-25271 is fixed in version 8.9.20-p11+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25271" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p11+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p11+tuxcare" } } ], "timestamp": "2026-11-11T16:59:15.993175+00:00", "status_notes": "Vulnerability CVE-2022-25273 is fixed in version 8.9.20-p11+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25273" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p11+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p11+tuxcare" } } ], "timestamp": "2026-11-11T16:59:15.993175+00:00", "status_notes": "Vulnerability CVE-2022-25275 is fixed in version 8.9.20-p11+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25275" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p11+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p11+tuxcare" } } ], "timestamp": "2026-11-11T16:59:15.993175+00:00", "status_notes": "Vulnerability CVE-2022-25276 is fixed in version 8.9.20-p11+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25276" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p11+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p11+tuxcare" } } ], "timestamp": "2026-11-11T16:59:15.993175+00:00", "status_notes": "Vulnerability CVE-2022-25277 is fixed in version 8.9.20-p11+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25277" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p11+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p11+tuxcare" } } ], "timestamp": "2026-11-11T16:59:15.993175+00:00", "status_notes": "Vulnerability CVE-2022-25278 is fixed in version 8.9.20-p11+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2022-25278" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p11+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p11+tuxcare" } } ], "timestamp": "2026-11-11T16:59:15.993175+00:00", "status_notes": "Vulnerability CVE-2023-5256 is fixed in version 8.9.20-p11+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2023-5256" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p11+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p11+tuxcare" } } ], "timestamp": "2026-11-11T16:59:15.993175+00:00", "status_notes": "Vulnerability CVE-2024-12393 is fixed in version 8.9.20-p11+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-12393" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p11+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p11+tuxcare" } } ], "timestamp": "2026-11-11T16:59:15.993175+00:00", "status_notes": "Vulnerability CVE-2024-45440 is fixed in version 8.9.20-p11+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-45440" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p11+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p11+tuxcare" } } ], "timestamp": "2026-11-11T16:59:15.993175+00:00", "status_notes": "Vulnerability CVE-2024-55634 is fixed in version 8.9.20-p11+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55634" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p11+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p11+tuxcare" } } ], "timestamp": "2026-11-11T16:59:15.993175+00:00", "status_notes": "Vulnerability CVE-2024-55636 is fixed in version 8.9.20-p11+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55636" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p11+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p11+tuxcare" } } ], "timestamp": "2026-11-11T16:59:15.993175+00:00", "status_notes": "Vulnerability CVE-2024-55637 is fixed in version 8.9.20-p11+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55637" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p11+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p11+tuxcare" } } ], "timestamp": "2026-11-11T16:59:15.993175+00:00", "status_notes": "Vulnerability CVE-2024-55638 is fixed in version 8.9.20-p11+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2024-55638" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p11+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p11+tuxcare" } } ], "timestamp": "2026-11-11T16:59:15.993175+00:00", "status_notes": "Vulnerability CVE-2025-13080 is fixed in version 8.9.20-p11+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13080" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p11+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p11+tuxcare" } } ], "timestamp": "2026-11-11T16:59:15.993175+00:00", "status_notes": "Vulnerability CVE-2025-13081 is fixed in version 8.9.20-p11+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13081" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p11+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p11+tuxcare" } } ], "timestamp": "2026-11-11T16:59:15.993175+00:00", "status_notes": "Vulnerability CVE-2025-13082 is fixed in version 8.9.20-p11+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p11+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p11+tuxcare" } } ], "timestamp": "2026-11-11T16:59:15.993175+00:00", "status_notes": "Vulnerability CVE-2025-13083 is fixed in version 8.9.20-p11+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-13083" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p11+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p11+tuxcare" } } ], "timestamp": "2026-11-11T16:59:15.993175+00:00", "status_notes": "Vulnerability CVE-2025-3057 is fixed in version 8.9.20-p11+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-3057" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p11+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p11+tuxcare" } } ], "timestamp": "2026-11-11T16:59:15.993175+00:00", "status_notes": "Vulnerability CVE-2025-31673 is fixed in version 8.9.20-p11+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31673" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p11+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p11+tuxcare" } } ], "timestamp": "2026-11-11T16:59:15.993175+00:00", "status_notes": "Vulnerability CVE-2025-31674 is fixed in version 8.9.20-p11+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31674" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p11+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p11+tuxcare" } } ], "timestamp": "2026-11-11T16:59:15.993175+00:00", "status_notes": "Vulnerability CVE-2025-31675 is fixed in version 8.9.20-p11+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2025-31675" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p11+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p11+tuxcare" } } ], "timestamp": "2026-11-11T16:59:15.993175+00:00", "status_notes": "Vulnerability CVE-2026-108097 is fixed in version 8.9.20-p11+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-108097" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p11+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p11+tuxcare" } } ], "timestamp": "2026-11-11T16:59:15.993175+00:00", "status_notes": "Vulnerability CVE-2026-108515 is fixed in version 8.9.20-p11+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-108515" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p11+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p11+tuxcare" } } ], "timestamp": "2026-11-11T16:59:15.993175+00:00", "status_notes": "Vulnerability CVE-2026-6365 is fixed in version 8.9.20-p11+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6365" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p11+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p11+tuxcare" } } ], "timestamp": "2026-11-11T16:59:15.993175+00:00", "status_notes": "Vulnerability CVE-2026-6366 is fixed in version 8.9.20-p11+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-6366" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p11+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p11+tuxcare" } } ], "timestamp": "2026-11-11T16:59:15.993175+00:00", "status_notes": "Vulnerability CVE-2026-9082 is fixed in version 8.9.20-p11+tuxcare of drupal/core.", "vulnerability": { "name": "CVE-2026-9082" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/drupal/core@8.9.20-p11+tuxcare", "identifiers": { "purl": "pkg:composer/drupal/core@8.9.20-p11+tuxcare" } } ], "timestamp": "2026-11-11T16:59:15.993175+00:00", "status_notes": "Vulnerability GHSA-6ccv-8fgf-cjpw is fixed in version 8.9.20-p11+tuxcare of drupal/core.", "vulnerability": { "name": "GHSA-6ccv-8fgf-cjpw" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2018-14773 does not affect version 2.8.52-p1+tuxcare of symfony/http-foundation. not_affected \u2014 CVE-2018-14773 affects Symfony HttpFoundation 2.8.0-2.8.43 via untrusted X_ORIGINAL_URL and X_REWRITE_URL headers that override request URIs. The target (v2.8.52) is NOT AFFECTED\u2014the vulnerable code was removed by upstream Symfony in v2.8.44 (commit 5097611b by Nicolas Grekas). TuxCare onboarded v2.8.52 as a snapshot (commit 877d4cd2), and the fix was already present in that upstream release. N...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14773" }, "impact_statement": "not_affected \u2014 CVE-2018-14773 affects Symfony HttpFoundation 2.8.0-2.8.43 via untrusted X_ORIGINAL_URL and X_REWRITE_URL headers that override request URIs. The target (v2.8.52) is NOT AFFECTED\u2014the vulnerable code was removed by upstream Symfony in v2.8.44 (commit 5097611b by Nicolas Grekas). TuxCare onboarded v2.8.52 as a snapshot (commit 877d4cd2), and the fix was already present in that upstream release. N..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:19:23.616509+00:00", "status_notes": "Vulnerability CVE-2019-10913 does not affect version 2.8.52-p1+tuxcare of symfony/http-foundation. CVE-2019-10913 does not affect this version. The target is symfony/http-foundation v2.8.52-p2+tuxcare, which already contains the security fix. The CVE affects \"Symfony 2.8.x before 2.8.50\" - version 2.8.52 is after 2.8.50 and includes the upstream fix. The vulnerable pattern (unvalidated HTTP method override) is not present. The target code validates method overrides against a whitelist and rejects invalid characters, matching the security patch behavior.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10913" }, "impact_statement": "CVE-2019-10913 does not affect this version. The target is symfony/http-foundation v2.8.52-p2+tuxcare, which already contains the security fix. The CVE affects \"Symfony 2.8.x before 2.8.50\" - version 2.8.52 is after 2.8.50 and includes the upstream fix. The vulnerable pattern (unvalidated HTTP method override) is not present. The target code validates method overrides against a whitelist and rejects invalid characters, matching the security patch behavior." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:19:00.032324+00:00", "status_notes": "Vulnerability CVE-2019-18888 does not affect version 2.8.52-p1+tuxcare of symfony/http-foundation. The target repository symfony/http-foundation v2.8.52-p2+tuxcare is NOT AFFECTED by CVE-2019-18888. The vulnerability was fixed by upstream Symfony in version 2.8.52 (commit 3929d9fe by Nicolas Grekas on 2019-04-19), which added both `--` to the file command and `./` prepending for paths starting with `-`. The CVE lists affected versions as \"2.8.0 through 2.8.50\". TuxCare onboarded v2.8.52 which already contained the upstream fix, so the vulnerable code pattern is not present in this target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-18888" }, "impact_statement": "The target repository symfony/http-foundation v2.8.52-p2+tuxcare is NOT AFFECTED by CVE-2019-18888. The vulnerability was fixed by upstream Symfony in version 2.8.52 (commit 3929d9fe by Nicolas Grekas on 2019-04-19), which added both `--` to the file command and `./` prepending for paths starting with `-`. The CVE lists affected versions as \"2.8.0 through 2.8.50\". TuxCare onboarded v2.8.52 which already contained the upstream fix, so the vulnerable code pattern is not present in this target." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-50345 affects version 2.8.52-p1+tuxcare of symfony/http-foundation, and is fixed in 2.8.52-p2+tuxcare.", "vulnerability": { "name": "CVE-2024-50345" }, "action_statement": "Vulnerability CVE-2024-50345 affects version 2.8.52-p1+tuxcare of symfony/http-foundation, and is fixed in 2.8.52-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64500 is fixed in version 2.8.52-p1+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2025-64500" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare" } } ], "timestamp": "2026-10-31T20:22:00.099756+00:00", "status_notes": "Vulnerability CVE-2026-108082 does not affect version 2.8.52-p1+tuxcare of symfony/http-foundation. Target version v2.8.52 is NOT AFFECTED by CVE-2026-108082. The vulnerable HeaderUtils::split() method with its exponential-backtracking regex pattern does not exist in this version. HeaderUtils was introduced in Symfony HttpFoundation v4.1.0 (April 2018), while v2.8.52 is from the older 2.x series. Cache-Control header parsing in v2.8.52 uses HeaderBag::parseCacheControl() with a different regex pattern that does not exhibit the ReDoS vulnerability. This is a Type A2 case: HTTP headers are received (Input present), but the vulnerable code path does not exist, and no alternative mechanism causes exponential CPU consumption (Goal not reachable).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-108082" }, "impact_statement": "Target version v2.8.52 is NOT AFFECTED by CVE-2026-108082. The vulnerable HeaderUtils::split() method with its exponential-backtracking regex pattern does not exist in this version. HeaderUtils was introduced in Symfony HttpFoundation v4.1.0 (April 2018), while v2.8.52 is from the older 2.x series. Cache-Control header parsing in v2.8.52 uses HeaderBag::parseCacheControl() with a different regex pattern that does not exhibit the ReDoS vulnerability. This is a Type A2 case: HTTP headers are received (Input present), but the vulnerable code path does not exist, and no alternative mechanism causes exponential CPU consumption (Goal not reachable)." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare" } } ], "timestamp": "2026-11-11T15:13:00.039900+00:00", "status_notes": "Vulnerability CVE-2026-118514 affects version 2.8.52-p1+tuxcare of symfony/http-foundation, and is fixed in 2.8.52-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-118514" }, "action_statement": "Vulnerability CVE-2026-118514 affects version 2.8.52-p1+tuxcare of symfony/http-foundation, and is fixed in 2.8.52-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@2.8.52-p1+tuxcare" } } ], "timestamp": "2026-10-29T01:02:19.900071+00:00", "status_notes": "Vulnerability CVE-2026-48736 does not affect version 2.8.52-p1+tuxcare of symfony/http-foundation. not_affected \u2014 Version 2.8.52 of symfony/http-foundation is NOT AFFECTED by CVE-2026-48736. The vulnerability requires the PRIVATE_SUBNETS constant (introduced in 6.4+) and the isPrivateIp() method, neither of which exist in version 2.8.52. This version only provides generic IP validation utilities (checkIp, checkIp4, checkIp6) without built-in private subnet detection. The vulnerable code pattern - a pre-def...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48736" }, "impact_statement": "not_affected \u2014 Version 2.8.52 of symfony/http-foundation is NOT AFFECTED by CVE-2026-48736. The vulnerability requires the PRIVATE_SUBNETS constant (introduced in 6.4+) and the isPrivateIp() method, neither of which exist in version 2.8.52. This version only provides generic IP validation utilities (checkIp, checkIp4, checkIp6) without built-in private subnet detection. The vulnerable code pattern - a pre-def..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:56:11.698997+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.6.40-p6+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time remember_me token comparison in DatabaseUserProvider and EloquentUserProvider. The target Laravel 5.6.40-p4+tuxcare already contains the upstream fix: both providers use hash_equals() for constant-time comparison with proper null checks. The fix was introduced in Laravel 5.5.10 (Sept 2017) and inherited by all subsequent rele...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time remember_me token comparison in DatabaseUserProvider and EloquentUserProvider. The target Laravel 5.6.40-p4+tuxcare already contains the upstream fix: both providers use hash_equals() for constant-time comparison with proper null checks. The fix was introduced in Laravel 5.5.10 (Sept 2017) and inherited by all subsequent rele..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:56:11.698997+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.6.40-p6+tuxcare of laravel/framework. CVE-2018-15133 affects Laravel 5.6.x through 5.6.29 (RCE via unserialized XSRF-TOKEN). Target repository is Laravel 5.6.40, onboarded to TuxCare on 2025-08-23 with the upstream fix already present. The vulnerable pattern (decrypt with serialization=true on untrusted XSRF-TOKEN) never existed in this repository's history. Upstream Laravel fixed the vulnerability in version 5.6.30 (August 2018) by disabling cookie serialization. The onboarding commit brought in the already-fixed version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 affects Laravel 5.6.x through 5.6.29 (RCE via unserialized XSRF-TOKEN). Target repository is Laravel 5.6.40, onboarded to TuxCare on 2025-08-23 with the upstream fix already present. The vulnerable pattern (decrypt with serialization=true on untrusted XSRF-TOKEN) never existed in this repository's history. Upstream Laravel fixed the vulnerability in version 5.6.30 (August 2018) by disabling cookie serialization. The onboarding commit brought in the already-fixed version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:56:11.698997+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 5.6.40-p6+tuxcare of laravel/framework. CVE-2019-9081 affects Laravel Framework 5.7.x, specifically the __destruct method of the PendingCommand class in src/Illuminate/Foundation/Testing/PendingCommand.php. This class enables deserialization attacks where an attacker can execute arbitrary console commands. However, the target version 5.6.40 does not contain the PendingCommand class at all - it was introduced in version 5.7.0. Exhaustive searches confirmed no PendingCommand file or class definition exists at target SHA 3012d3fbc4a1e56a5d5db1d469bb4d4cf306a032. While other Pending* classes with __destruct methods exist in 5.6.40 (PendingBroadcast, PendingDispatch, PendingResourceRegistration), none execute console commands. The vulnerability pattern specific to CVE-2019-9081 cannot exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 affects Laravel Framework 5.7.x, specifically the __destruct method of the PendingCommand class in src/Illuminate/Foundation/Testing/PendingCommand.php. This class enables deserialization attacks where an attacker can execute arbitrary console commands. However, the target version 5.6.40 does not contain the PendingCommand class at all - it was introduced in version 5.7.0. Exhaustive searches confirmed no PendingCommand file or class definition exists at target SHA 3012d3fbc4a1e56a5d5db1d469bb4d4cf306a032. While other Pending* classes with __destruct methods exist in 5.6.40 (PendingBroadcast, PendingDispatch, PendingResourceRegistration), none execute console commands. The vulnerability pattern specific to CVE-2019-9081 cannot exist in this version." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:56:11.698997+00:00", "status_notes": "Vulnerability CVE-2020-19316 is fixed in version 5.6.40-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:56:11.698997+00:00", "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.6.40-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:56:11.698997+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 5.6.40-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:56:11.698997+00:00", "status_notes": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.6.40-p6+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed.", "vulnerability": { "name": "CVE-2021-43503" }, "impact_statement": "CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:56:11.698997+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.6.40-p6+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:56:11.698997+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.6.40-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:56:11.698997+00:00", "status_notes": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.6.40-p6+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"", "vulnerability": { "name": "CVE-2022-31279" }, "impact_statement": "CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:56:11.698997+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.6.40-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:56:11.698997+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.6.40-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:56:11.698997+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.6.40-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer (introduced in Laravel 8+) which uses Tippy.js tooltips with allowHTML: true for displaying user-controlled data. Laravel 5.6.40 uses the Whoops library and Symfony's ExceptionHandler for exception rendering, not Laravel's custom renderer. The vulnerable code path (Tippy.js with al...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer (introduced in Laravel 8+) which uses Tippy.js tooltips with allowHTML: true for displaying user-controlled data. Laravel 5.6.40 uses the Whoops library and Symfony's ExceptionHandler for exception rendering, not Laravel's custom renderer. The vulnerable code path (Tippy.js with al..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:56:11.698997+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.6.40-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 does not contain the JSON:API resources feature that is affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API implementation (specifically in ResolvesJsonApiElements trait) which was introduced in Laravel 10+, approximately 4-5 major versions after 5.6. The target repository contains only basic JSON resources (Json\\JsonResource) but not JSON:API spec-complia...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 does not contain the JSON:API resources feature that is affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API implementation (specifically in ResolvesJsonApiElements trait) which was introduced in Laravel 10+, approximately 4-5 major versions after 5.6. The target repository contains only basic JSON resources (Json\\JsonResource) but not JSON:API spec-complia..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:56:11.698997+00:00", "status_notes": "Vulnerability CVE-2026-114509 is fixed in version 5.6.40-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:56:11.698997+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.6.40-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:56:11.698997+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.6.40-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40-p1+tuxcare uses SwiftMailer 6.3.0, not the Symfony Mailer targeted by GHSA-5vg9-5847-vvmq. SwiftMailer's Egulias EmailValidator provides CRLF validation that prevents the vulnerability pattern from manifesting.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40-p1+tuxcare uses SwiftMailer 6.3.0, not the Symfony Mailer targeted by GHSA-5vg9-5847-vvmq. SwiftMailer's Egulias EmailValidator provides CRLF validation that prevents the vulnerability pattern from manifesting." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:56:11.698997+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.6.40-p6+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization vulnerability in cookies). The fix was included in upstream Laravel 5.6.30 and is present in 5.6.40. The EncryptCookies middleware enforces static::$serialize = false for all cookie encryption/decryption operations, preventing PHP object serialization attacks. Additional hardening in Recaller cla...", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization vulnerability in cookies). The fix was included in upstream Laravel 5.6.30 and is present in 5.6.40. The EncryptCookies middleware enforces static::$serialize = false for all cookie encryption/decryption operations, preventing PHP object serialization attacks. Additional hardening in Recaller cla..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:56:11.698997+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.6.40-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-7852-w36x-6mf6. The fix for the IV length validation vulnerability was shipped in the upstream Laravel 5.6.40 release, which TuxCare imported. The vulnerable code pattern (missing IV length check in the Encrypter's validPayload method) is not present; the fix validating that `strlen(base64_decode($payload['iv'], true)) === openssl_cip...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-7852-w36x-6mf6. The fix for the IV length validation vulnerability was shipped in the upstream Laravel 5.6.40 release, which TuxCare imported. The vulnerable code pattern (missing IV length check in the Encrypter's validPayload method) is not present; the fix validating that `strlen(base64_decode($payload['iv'], true)) === openssl_cip..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:56:11.698997+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.6.40-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 does not have the vulnerable LocalFilesystemAdapter class or signed URL generation for local filesystem. The feature was introduced in Laravel 11+ (September 2024), years after this version. The FilesystemAdapter.temporaryUrl() method explicitly throws RuntimeException for local adapters - the feature is unsupported.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 5.6.40 does not have the vulnerable LocalFilesystemAdapter class or signed URL generation for local filesystem. The feature was introduced in Laravel 11+ (September 2024), years after this version. The FilesystemAdapter.temporaryUrl() method explicitly throws RuntimeException for local adapters - the feature is unsupported." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:56:11.698997+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.6.40-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.6.40-p6+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:56:11.698997+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.6.40-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:56:11.698997+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.6.40-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.6.40-p6+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@5.6.40-p6+tuxcare" } } ], "timestamp": "2026-11-11T16:56:11.698997+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.6.40-p6+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-8379 is fixed in version 2.10.24-p2+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2015-8379" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-15400 is fixed in version 2.10.24-p2+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2020-15400" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:07:00.053303+00:00", "status_notes": "Vulnerability CVE-2026-119415 affects version 2.10.24-p2+tuxcare of cakephp/cakephp, and is fixed in 2.10.24-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-119415" }, "action_statement": "Vulnerability CVE-2026-119415 affects version 2.10.24-p2+tuxcare of cakephp/cakephp, and is fixed in 2.10.24-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare" } } ], "timestamp": "2026-11-03T22:44:31.848980+00:00", "status_notes": "Vulnerability CVE-2026-119416 does not affect version 2.10.24-p2+tuxcare of cakephp/cakephp. not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-119416. The vulnerability describes unanchored suffix matching in the Http Client CookieCollection class, which exists in CakePHP 4.x/5.x but not in version 2.10.24. Version 2.10.24 uses a fundamentally different HTTP client architecture (HttpSocket/HttpSocketResponse) that stores cookies per-originating-host without any domain attribute matching logi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-119416" }, "impact_statement": "not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-119416. The vulnerability describes unanchored suffix matching in the Http Client CookieCollection class, which exists in CakePHP 4.x/5.x but not in version 2.10.24. Version 2.10.24 uses a fundamentally different HTTP client architecture (HttpSocket/HttpSocketResponse) that stores cookies per-originating-host without any domain attribute matching logi..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare" } } ], "timestamp": "2026-11-11T15:07:00.053303+00:00", "status_notes": "Vulnerability CVE-2026-119417 affects version 2.10.24-p2+tuxcare of cakephp/cakephp, and is fixed in 2.10.24-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-119417" }, "action_statement": "Vulnerability CVE-2026-119417 affects version 2.10.24-p2+tuxcare of cakephp/cakephp, and is fixed in 2.10.24-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare" } } ], "timestamp": "2026-11-03T22:46:44.073280+00:00", "status_notes": "Vulnerability CVE-2026-119418 does not affect version 2.10.24-p2+tuxcare of cakephp/cakephp. not_affected \u2014 CakePHP 2.10.24-p3+tuxcare is not affected by CVE-2026-119418. The vulnerability exists in the WindowExpression class (specifically the range() and frame() methods) which was introduced in CakePHP 4.1.0. The target version 2.10.24 predates this feature by two major versions and uses the older DboSource-based query system without any Expression-based query builder architecture. The vulnerable co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-119418" }, "impact_statement": "not_affected \u2014 CakePHP 2.10.24-p3+tuxcare is not affected by CVE-2026-119418. The vulnerability exists in the WindowExpression class (specifically the range() and frame() methods) which was introduced in CakePHP 4.1.0. The target version 2.10.24 predates this feature by two major versions and uses the older DboSource-based query system without any Expression-based query builder architecture. The vulnerable co..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare" } } ], "timestamp": "2026-11-03T22:47:11.708199+00:00", "status_notes": "Vulnerability CVE-2026-119419 does not affect version 2.10.24-p2+tuxcare of cakephp/cakephp. not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-119419. The vulnerability specifically targets StringExpression and IdentifierExpression classes with unvalidated collation parameters that were introduced in CakePHP 4.x (October 2020). These classes do not exist in CakePHP 2.x, which uses a completely different architecture (lib/Cake/Model/Datasource vs src/Database/Expression). While CakePHP 2.x ha...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-119419" }, "impact_statement": "not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-119419. The vulnerability specifically targets StringExpression and IdentifierExpression classes with unvalidated collation parameters that were introduced in CakePHP 4.x (October 2020). These classes do not exist in CakePHP 2.x, which uses a completely different architecture (lib/Cake/Model/Datasource vs src/Database/Expression). While CakePHP 2.x ha..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48820 is fixed in version 2.10.24-p2+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-48820" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-77634 affects version 2.10.24-p2+tuxcare of cakephp/cakephp, and is fixed in 2.10.24-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-77634" }, "action_statement": "Vulnerability CVE-2026-77634 affects version 2.10.24-p2+tuxcare of cakephp/cakephp, and is fixed in 2.10.24-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-79752 does not affect version 2.10.24-p2+tuxcare of cakephp/cakephp. not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-79752. The vulnerable FunctionsBuilder class and its methods (cast, extract, datePart, dateAdd) do not exist in this version. The CVE describes SQL injection in CakePHP's Query Builder system introduced in version 3.x. CakePHP 2.x uses a different architecture (DboSource with active record pattern) that predates the Query Builder. Exhaustive search of...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-79752" }, "impact_statement": "not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-79752. The vulnerable FunctionsBuilder class and its methods (cast, extract, datePart, dateAdd) do not exist in this version. The CVE describes SQL injection in CakePHP's Query Builder system introduced in version 3.x. CakePHP 2.x uses a different architecture (DboSource with active record pattern) that predates the Query Builder. Exhaustive search of..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/validator@v3.4.47-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/validator@v3.4.47-p1+tuxcare" } } ], "timestamp": "2026-11-11T15:10:03.910872+00:00", "status_notes": "Vulnerability CVE-2024-50343 is fixed in version v3.4.47-p1+tuxcare of symfony/validator.", "vulnerability": { "name": "CVE-2024-50343" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/validator@v3.4.47-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/validator@v3.4.47-p1+tuxcare" } } ], "timestamp": "2026-11-11T15:10:03.910872+00:00", "status_notes": "Vulnerability CVE-2026-123125 is fixed in version v3.4.47-p1+tuxcare of symfony/validator.", "vulnerability": { "name": "CVE-2026-123125" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-8379 is fixed in version 2.10.24-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2015-8379" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-15400 is fixed in version 2.10.24-p1+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2020-15400" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare" } } ], "timestamp": "2026-11-11T15:07:00.053303+00:00", "status_notes": "Vulnerability CVE-2026-119415 affects version 2.10.24-p1+tuxcare of cakephp/cakephp, and is fixed in 2.10.24-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-119415" }, "action_statement": "Vulnerability CVE-2026-119415 affects version 2.10.24-p1+tuxcare of cakephp/cakephp, and is fixed in 2.10.24-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare" } } ], "timestamp": "2026-11-03T22:44:31.848980+00:00", "status_notes": "Vulnerability CVE-2026-119416 does not affect version 2.10.24-p1+tuxcare of cakephp/cakephp. not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-119416. The vulnerability describes unanchored suffix matching in the Http Client CookieCollection class, which exists in CakePHP 4.x/5.x but not in version 2.10.24. Version 2.10.24 uses a fundamentally different HTTP client architecture (HttpSocket/HttpSocketResponse) that stores cookies per-originating-host without any domain attribute matching logi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-119416" }, "impact_statement": "not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-119416. The vulnerability describes unanchored suffix matching in the Http Client CookieCollection class, which exists in CakePHP 4.x/5.x but not in version 2.10.24. Version 2.10.24 uses a fundamentally different HTTP client architecture (HttpSocket/HttpSocketResponse) that stores cookies per-originating-host without any domain attribute matching logi..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare" } } ], "timestamp": "2026-11-11T15:07:00.053303+00:00", "status_notes": "Vulnerability CVE-2026-119417 affects version 2.10.24-p1+tuxcare of cakephp/cakephp, and is fixed in 2.10.24-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-119417" }, "action_statement": "Vulnerability CVE-2026-119417 affects version 2.10.24-p1+tuxcare of cakephp/cakephp, and is fixed in 2.10.24-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare" } } ], "timestamp": "2026-11-03T22:46:44.073280+00:00", "status_notes": "Vulnerability CVE-2026-119418 does not affect version 2.10.24-p1+tuxcare of cakephp/cakephp. not_affected \u2014 CakePHP 2.10.24-p3+tuxcare is not affected by CVE-2026-119418. The vulnerability exists in the WindowExpression class (specifically the range() and frame() methods) which was introduced in CakePHP 4.1.0. The target version 2.10.24 predates this feature by two major versions and uses the older DboSource-based query system without any Expression-based query builder architecture. The vulnerable co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-119418" }, "impact_statement": "not_affected \u2014 CakePHP 2.10.24-p3+tuxcare is not affected by CVE-2026-119418. The vulnerability exists in the WindowExpression class (specifically the range() and frame() methods) which was introduced in CakePHP 4.1.0. The target version 2.10.24 predates this feature by two major versions and uses the older DboSource-based query system without any Expression-based query builder architecture. The vulnerable co..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare" } } ], "timestamp": "2026-11-03T22:47:11.708199+00:00", "status_notes": "Vulnerability CVE-2026-119419 does not affect version 2.10.24-p1+tuxcare of cakephp/cakephp. not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-119419. The vulnerability specifically targets StringExpression and IdentifierExpression classes with unvalidated collation parameters that were introduced in CakePHP 4.x (October 2020). These classes do not exist in CakePHP 2.x, which uses a completely different architecture (lib/Cake/Model/Datasource vs src/Database/Expression). While CakePHP 2.x ha...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-119419" }, "impact_statement": "not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-119419. The vulnerability specifically targets StringExpression and IdentifierExpression classes with unvalidated collation parameters that were introduced in CakePHP 4.x (October 2020). These classes do not exist in CakePHP 2.x, which uses a completely different architecture (lib/Cake/Model/Datasource vs src/Database/Expression). While CakePHP 2.x ha..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48820 affects version 2.10.24-p1+tuxcare of cakephp/cakephp, and is fixed in 2.10.24-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-48820" }, "action_statement": "Vulnerability CVE-2026-48820 affects version 2.10.24-p1+tuxcare of cakephp/cakephp, and is fixed in 2.10.24-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-77634 affects version 2.10.24-p1+tuxcare of cakephp/cakephp, and is fixed in 2.10.24-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-77634" }, "action_statement": "Vulnerability CVE-2026-77634 affects version 2.10.24-p1+tuxcare of cakephp/cakephp, and is fixed in 2.10.24-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-79752 does not affect version 2.10.24-p1+tuxcare of cakephp/cakephp. not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-79752. The vulnerable FunctionsBuilder class and its methods (cast, extract, datePart, dateAdd) do not exist in this version. The CVE describes SQL injection in CakePHP's Query Builder system introduced in version 3.x. CakePHP 2.x uses a different architecture (DboSource with active record pattern) that predates the Query Builder. Exhaustive search of...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-79752" }, "impact_statement": "not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-79752. The vulnerable FunctionsBuilder class and its methods (cast, extract, datePart, dateAdd) do not exist in this version. The CVE describes SQL injection in CakePHP's Query Builder system introduced in version 3.x. CakePHP 2.x uses a different architecture (DboSource with active record pattern) that predates the Query Builder. Exhaustive search of..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v4.4.51-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v4.4.51-p1+tuxcare" } } ], "timestamp": "2026-10-28T20:21:01.627334+00:00", "status_notes": "Vulnerability CVE-2022-24894 does not affect version v4.4.51-p1+tuxcare of symfony/http-kernel. not_affected \u2014 The target repository (symfony/http-kernel v4.4.51-p1+tuxcare) is NOT AFFECTED by CVE-2022-24894. The vulnerability involves HTTP cache storing Set-Cookie headers and serving them to unintended clients. The upstream fix, which removes private headers (default: Set-Cookie) before storing responses in cache, was already present in the v4.4.51 release that TuxCare onboarded. The defense mechanism ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-24894" }, "impact_statement": "not_affected \u2014 The target repository (symfony/http-kernel v4.4.51-p1+tuxcare) is NOT AFFECTED by CVE-2022-24894. The vulnerability involves HTTP cache storing Set-Cookie headers and serving them to unintended clients. The upstream fix, which removes private headers (default: Set-Cookie) before storing responses in cache, was already present in the v4.4.51 release that TuxCare onboarded. The defense mechanism ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v4.4.51-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v4.4.51-p1+tuxcare" } } ], "timestamp": "2026-11-11T15:18:54.048730+00:00", "status_notes": "Vulnerability CVE-2026-123339 affects version v4.4.51-p1+tuxcare of symfony/http-kernel, and is fixed in v4.4.51-p2+tuxcare.", "vulnerability": { "name": "CVE-2026-123339" }, "action_statement": "Vulnerability CVE-2026-123339 affects version v4.4.51-p1+tuxcare of symfony/http-kernel, and is fixed in v4.4.51-p2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-kernel@v4.4.51-p1+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-kernel@v4.4.51-p1+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2026-45075 does not affect version v4.4.51-p1+tuxcare of symfony/http-kernel. Target version v4.4.51-p1+tuxcare is not affected by CVE-2026-45075. The vulnerability concerns PHP 8 attributes (#[IsGranted], #[IsSignatureValid], #[IsCsrfTokenValid]) with methods filtering that allows HEAD requests to bypass security checks when only GET is specified. These security attributes were introduced in Symfony 7.4+ (September 2025) and require PHP 8.0+. The target version 4.4.51 requires PHP \u22657.1.3 and predates PHP attributes entirely. The vulnerable code pattern does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45075" }, "impact_statement": "Target version v4.4.51-p1+tuxcare is not affected by CVE-2026-45075. The vulnerability concerns PHP 8 attributes (#[IsGranted], #[IsSignatureValid], #[IsCsrfTokenValid]) with methods filtering that allows HEAD requests to bypass security checks when only GET is specified. These security attributes were introduced in Symfony 7.4+ (September 2025) and require PHP 8.0+. The target version 4.4.51 requires PHP \u22657.1.3 and predates PHP attributes entirely. The vulnerable code pattern does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2018-14773 does not affect version 3.4.47-p3+tuxcare of symfony/http-foundation. not_affected \u2014 The target repository is NOT AFFECTED by CVE-2018-14773. The vulnerable code pattern (X_ORIGINAL_URL and X_REWRITE_URL header processing in prepareRequestUri()) is not present. The fix was applied in upstream Symfony v3.4.14 by Nicolas Grekas, and TuxCare onboarded v3.4.47 which already included this fix. The CHANGELOG confirms the BC BREAK removal of IIS-only X_ORIGINAL_URL and X_REWRITE_URL h...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-14773" }, "impact_statement": "not_affected \u2014 The target repository is NOT AFFECTED by CVE-2018-14773. The vulnerable code pattern (X_ORIGINAL_URL and X_REWRITE_URL header processing in prepareRequestUri()) is not present. The fix was applied in upstream Symfony v3.4.14 by Nicolas Grekas, and TuxCare onboarded v3.4.47 which already included this fix. The CHANGELOG confirms the BC BREAK removal of IIS-only X_ORIGINAL_URL and X_REWRITE_URL h..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare" } } ], "timestamp": "2026-11-03T10:19:23.616509+00:00", "status_notes": "Vulnerability CVE-2019-10913 does not affect version 3.4.47-p3+tuxcare of symfony/http-foundation. The target version (symfony/http-foundation v3.4.47) is NOT AFFECTED by CVE-2019-10913. The vulnerability was fixed in upstream Symfony 3.4.26 (April 2019), and version 3.4.47 already contains the fix. The Request.php getMethod() function includes validation that: (1) checks method override strings against a whitelist of standard HTTP verbs, and (2) validates non-whitelisted methods contain only uppercase letters A-Z, rejecting any string with special characters that could enable SQL injection or XSS. This fix was present in the upstream release before TuxCare onboarded the project.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10913" }, "impact_statement": "The target version (symfony/http-foundation v3.4.47) is NOT AFFECTED by CVE-2019-10913. The vulnerability was fixed in upstream Symfony 3.4.26 (April 2019), and version 3.4.47 already contains the fix. The Request.php getMethod() function includes validation that: (1) checks method override strings against a whitelist of standard HTTP verbs, and (2) validates non-whitelisted methods contain only uppercase letters A-Z, rejecting any string with special characters that could enable SQL injection or XSS. This fix was present in the upstream release before TuxCare onboarded the project." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare" } } ], "timestamp": "2026-11-03T10:19:00.032324+00:00", "status_notes": "Vulnerability CVE-2019-18888 does not affect version 3.4.47-p3+tuxcare of symfony/http-foundation. The target repository (symfony/http-foundation v3.4.47) is not affected by CVE-2019-18888. The vulnerability pattern (arbitrary command arguments passed to the `file` command via dash-prefixed filenames) is not present in the code. Both defensive transformations from the upstream patch are already in place: (1) the `--` option terminator in the command template (line 34), and (2) the `./` prefix prepended to paths starting with `-` (line 83). The fix was included in upstream Symfony v3.4.47 and imported via TuxCare's onboarding commit f73aa544e1481540d21e5a9829b63a4d0abd98aa.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-18888" }, "impact_statement": "The target repository (symfony/http-foundation v3.4.47) is not affected by CVE-2019-18888. The vulnerability pattern (arbitrary command arguments passed to the `file` command via dash-prefixed filenames) is not present in the code. Both defensive transformations from the upstream patch are already in place: (1) the `--` option terminator in the command template (line 34), and (2) the `./` prefix prepended to paths starting with `-` (line 83). The fix was included in upstream Symfony v3.4.47 and imported via TuxCare's onboarding commit f73aa544e1481540d21e5a9829b63a4d0abd98aa." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-50345 is fixed in version 3.4.47-p3+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2024-50345" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64500 is fixed in version 3.4.47-p3+tuxcare of symfony/http-foundation.", "vulnerability": { "name": "CVE-2025-64500" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:22:00.099756+00:00", "status_notes": "Vulnerability CVE-2026-108082 does not affect version 3.4.47-p3+tuxcare of symfony/http-foundation. Version 3.4.47 is not affected by CVE-2026-108082. The vulnerable component (HeaderUtils class with its split() method containing nested quantifiers and negative lookbehind causing exponential regex backtracking) does not exist in this version. Version 3.4.47 predates the introduction of HeaderUtils (added in Symfony 4.x+). The alternative implementation HeaderBag::parseCacheControl() uses a simple linear regex pattern with no nested quantifiers, making exponential backtracking structurally impossible. TuxCare backported this CVE to versions 4.4.49, 5.4.50, 6.4.35, and 7.4.8, but not to 3.4.47, confirming vendor assessment that this version is unaffected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-108082" }, "impact_statement": "Version 3.4.47 is not affected by CVE-2026-108082. The vulnerable component (HeaderUtils class with its split() method containing nested quantifiers and negative lookbehind causing exponential regex backtracking) does not exist in this version. Version 3.4.47 predates the introduction of HeaderUtils (added in Symfony 4.x+). The alternative implementation HeaderBag::parseCacheControl() uses a simple linear regex pattern with no nested quantifiers, making exponential backtracking structurally impossible. TuxCare backported this CVE to versions 4.4.49, 5.4.50, 6.4.35, and 7.4.8, but not to 3.4.47, confirming vendor assessment that this version is unaffected." }, { "status": "affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare" } } ], "timestamp": "2026-11-11T15:16:00.058053+00:00", "status_notes": "Vulnerability CVE-2026-118514 affects version 3.4.47-p3+tuxcare of symfony/http-foundation, and is fixed in 3.4.47-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-118514" }, "action_statement": "Vulnerability CVE-2026-118514 affects version 3.4.47-p3+tuxcare of symfony/http-foundation, and is fixed in 3.4.47-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare", "identifiers": { "purl": "pkg:composer/symfony/http-foundation@3.4.47-p3+tuxcare" } } ], "timestamp": "2026-10-29T01:02:19.900071+00:00", "status_notes": "Vulnerability CVE-2026-48736 does not affect version 3.4.47-p3+tuxcare of symfony/http-foundation. not_affected \u2014 Target version 3.4.47 is not affected by CVE-2026-48736. The vulnerability requires PRIVATE_SUBNETS constant and isPrivateIp() method for blocking requests to private networks via IPv6 transition forms, but these components were introduced in Symfony 5.4-6.4+ (years later, in 2023-2024). Version 3.4.47 lacks the architectural features required for this vulnerability pattern to exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48736" }, "impact_statement": "not_affected \u2014 Target version 3.4.47 is not affected by CVE-2026-48736. The vulnerability requires PRIVATE_SUBNETS constant and isPrivateIp() method for blocking requests to private networks via IPv6 transition forms, but these components were introduced in Symfony 5.4-6.4+ (years later, in 2023-2024). Version 3.4.47 lacks the architectural features required for this vulnerability pattern to exist." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-8379 is fixed in version 2.10.24-p3+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2015-8379" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-15400 is fixed in version 2.10.24-p3+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2020-15400" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare" } } ], "timestamp": "2026-11-11T15:07:00.053303+00:00", "status_notes": "Vulnerability CVE-2026-119415 affects version 2.10.24-p3+tuxcare of cakephp/cakephp, and is fixed in 2.10.24-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-119415" }, "action_statement": "Vulnerability CVE-2026-119415 affects version 2.10.24-p3+tuxcare of cakephp/cakephp, and is fixed in 2.10.24-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare" } } ], "timestamp": "2026-11-03T22:44:31.848980+00:00", "status_notes": "Vulnerability CVE-2026-119416 does not affect version 2.10.24-p3+tuxcare of cakephp/cakephp. not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-119416. The vulnerability describes unanchored suffix matching in the Http Client CookieCollection class, which exists in CakePHP 4.x/5.x but not in version 2.10.24. Version 2.10.24 uses a fundamentally different HTTP client architecture (HttpSocket/HttpSocketResponse) that stores cookies per-originating-host without any domain attribute matching logi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-119416" }, "impact_statement": "not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-119416. The vulnerability describes unanchored suffix matching in the Http Client CookieCollection class, which exists in CakePHP 4.x/5.x but not in version 2.10.24. Version 2.10.24 uses a fundamentally different HTTP client architecture (HttpSocket/HttpSocketResponse) that stores cookies per-originating-host without any domain attribute matching logi..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare" } } ], "timestamp": "2026-11-11T15:07:00.053303+00:00", "status_notes": "Vulnerability CVE-2026-119417 affects version 2.10.24-p3+tuxcare of cakephp/cakephp, and is fixed in 2.10.24-p4+tuxcare.", "vulnerability": { "name": "CVE-2026-119417" }, "action_statement": "Vulnerability CVE-2026-119417 affects version 2.10.24-p3+tuxcare of cakephp/cakephp, and is fixed in 2.10.24-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare" } } ], "timestamp": "2026-11-03T22:46:44.073280+00:00", "status_notes": "Vulnerability CVE-2026-119418 does not affect version 2.10.24-p3+tuxcare of cakephp/cakephp. not_affected \u2014 CakePHP 2.10.24-p3+tuxcare is not affected by CVE-2026-119418. The vulnerability exists in the WindowExpression class (specifically the range() and frame() methods) which was introduced in CakePHP 4.1.0. The target version 2.10.24 predates this feature by two major versions and uses the older DboSource-based query system without any Expression-based query builder architecture. The vulnerable co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-119418" }, "impact_statement": "not_affected \u2014 CakePHP 2.10.24-p3+tuxcare is not affected by CVE-2026-119418. The vulnerability exists in the WindowExpression class (specifically the range() and frame() methods) which was introduced in CakePHP 4.1.0. The target version 2.10.24 predates this feature by two major versions and uses the older DboSource-based query system without any Expression-based query builder architecture. The vulnerable co..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare" } } ], "timestamp": "2026-11-03T22:47:11.708199+00:00", "status_notes": "Vulnerability CVE-2026-119419 does not affect version 2.10.24-p3+tuxcare of cakephp/cakephp. not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-119419. The vulnerability specifically targets StringExpression and IdentifierExpression classes with unvalidated collation parameters that were introduced in CakePHP 4.x (October 2020). These classes do not exist in CakePHP 2.x, which uses a completely different architecture (lib/Cake/Model/Datasource vs src/Database/Expression). While CakePHP 2.x ha...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-119419" }, "impact_statement": "not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-119419. The vulnerability specifically targets StringExpression and IdentifierExpression classes with unvalidated collation parameters that were introduced in CakePHP 4.x (October 2020). These classes do not exist in CakePHP 2.x, which uses a completely different architecture (lib/Cake/Model/Datasource vs src/Database/Expression). While CakePHP 2.x ha..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48820 is fixed in version 2.10.24-p3+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-48820" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-77634 is fixed in version 2.10.24-p3+tuxcare of cakephp/cakephp.", "vulnerability": { "name": "CVE-2026-77634" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare", "identifiers": { "purl": "pkg:composer/cakephp/cakephp@2.10.24-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-79752 does not affect version 2.10.24-p3+tuxcare of cakephp/cakephp. not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-79752. The vulnerable FunctionsBuilder class and its methods (cast, extract, datePart, dateAdd) do not exist in this version. The CVE describes SQL injection in CakePHP's Query Builder system introduced in version 3.x. CakePHP 2.x uses a different architecture (DboSource with active record pattern) that predates the Query Builder. Exhaustive search of...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-79752" }, "impact_statement": "not_affected \u2014 CakePHP 2.10.24 is not affected by CVE-2026-79752. The vulnerable FunctionsBuilder class and its methods (cast, extract, datePart, dateAdd) do not exist in this version. The CVE describes SQL injection in CakePHP's Query Builder system introduced in version 3.x. CakePHP 2.x uses a different architecture (DboSource with active record pattern) that predates the Query Builder. Exhaustive search of..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:40:09.352558+00:00", "status_notes": "Vulnerability CVE-2022-29248 does not affect version 6.5.8-p2+tuxcare of guzzlehttp/guzzle. Target guzzlehttp/guzzle 6.5.8-p4+tuxcare contains the fix for CVE-2022-29248 (cross-domain cookie leakage), but the fix came from upstream Guzzle 6.5.6 (released 2022-05-25 by Graham Campbell), not from a TuxCare backport. The TuxCare snapshot commit (0d8fa44a by bashebr@cloudlinux.com) onboarded upstream version 6.5.8 which already included the fix. Per A1 rule, an onboarding/snapshot commit is not a fix commit; when it's the only commit carrying the fix, the fix came with the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-29248" }, "impact_statement": "Target guzzlehttp/guzzle 6.5.8-p4+tuxcare contains the fix for CVE-2022-29248 (cross-domain cookie leakage), but the fix came from upstream Guzzle 6.5.6 (released 2022-05-25 by Graham Campbell), not from a TuxCare backport. The TuxCare snapshot commit (0d8fa44a by bashebr@cloudlinux.com) onboarded upstream version 6.5.8 which already included the fix. Per A1 rule, an onboarding/snapshot commit is not a fix commit; when it's the only commit carrying the fix, the fix came with the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:18:21.473206+00:00", "status_notes": "Vulnerability CVE-2022-31042 does not affect version 6.5.8-p2+tuxcare of guzzlehttp/guzzle. The target repository (guzzlehttp/guzzle 6.5.8-p4+tuxcare) is NOT affected by CVE-2022-31042. The vulnerability (Cookie header leakage on cross-origin redirects or HTTPS\u2192HTTP downgrades) was fixed in upstream Guzzle 6.5.7 (released 2022-06-09). The target is based on upstream 6.5.8 (released 2022-06-20), which includes the fix using Psr7\\UriComparator::isCrossOrigin() at src/RedirectMiddleware.php:222-224. This implementation strips Cookie headers when host differs, scheme changes, or port changes\u2014providing equivalent or superior protection to the CVE fix. The vulnerable code pattern is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31042" }, "impact_statement": "The target repository (guzzlehttp/guzzle 6.5.8-p4+tuxcare) is NOT affected by CVE-2022-31042. The vulnerability (Cookie header leakage on cross-origin redirects or HTTPS\u2192HTTP downgrades) was fixed in upstream Guzzle 6.5.7 (released 2022-06-09). The target is based on upstream 6.5.8 (released 2022-06-20), which includes the fix using Psr7\\UriComparator::isCrossOrigin() at src/RedirectMiddleware.php:222-224. This implementation strips Cookie headers when host differs, scheme changes, or port changes\u2014providing equivalent or superior protection to the CVE fix. The vulnerable code pattern is not present." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-11-11T14:26:45.678254+00:00", "status_notes": "Vulnerability CVE-2022-31043 does not affect version 6.5.8-p2+tuxcare of guzzlehttp/guzzle. guzzlehttp/guzzle 6.5.8 is NOT AFFECTED by CVE-2022-31043 (Authorization header not stripped on HTTPS->HTTP redirect). The vendor fixed it in upstream Guzzle 6.5.7 (2022-06-09, CHANGELOG: \"Fix failure to strip Authorization header on HTTP downgrade\"); 6.5.8 inherits the fix. Advisory affected range is < 6.5.7 and 7.0.0 - < 7.4.4. The fix was authored by the upstream Guzzle maintainers, not by TuxCare. Verified: src/RedirectMiddleware.php in our 6.5.8 vendor snapshot (0d8fa44a) is byte-identical to vendor tag 6.5.8 and removes the Authorization and Cookie headers on any cross-origin redirect, scheme downgrade included (lines 221-225); tests/RedirectMiddlewareTest.php::testHeadersTreatmentOnRedirect covers https://example.com -> http://example.com and asserts Authorization is removed. No backport needed (Jira PHPELSCVE-1122).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31043" }, "impact_statement": "guzzlehttp/guzzle 6.5.8 is NOT AFFECTED by CVE-2022-31043 (Authorization header not stripped on HTTPS->HTTP redirect). The vendor fixed it in upstream Guzzle 6.5.7 (2022-06-09, CHANGELOG: \"Fix failure to strip Authorization header on HTTP downgrade\"); 6.5.8 inherits the fix. Advisory affected range is < 6.5.7 and 7.0.0 - < 7.4.4. The fix was authored by the upstream Guzzle maintainers, not by TuxCare. Verified: src/RedirectMiddleware.php in our 6.5.8 vendor snapshot (0d8fa44a) is byte-identical to vendor tag 6.5.8 and removes the Authorization and Cookie headers on any cross-origin redirect, scheme downgrade included (lines 221-225); tests/RedirectMiddlewareTest.php::testHeadersTreatmentOnRedirect covers https://example.com -> http://example.com and asserts Authorization is removed. No backport needed (Jira PHPELSCVE-1122)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2022-31090 does not affect version 6.5.8-p2+tuxcare of guzzlehttp/guzzle. CVE-2022-31090 fix is already present in target version 6.5.8. The vulnerability concerned Authorization header leakage when following HTTP redirects to different origins (host/port/scheme changes). The upstream Guzzle 6.5.8 release (June 20, 2022) included the complete fix using Psr7\\UriComparator::isCrossOrigin() to remove curl auth options and sensitive headers on cross-origin redirects. TuxCare onboarded this version via snapshot commit 0d8fa44a, which already contained the fix. Both defense points are present: line 98 removes CURLOPT_HTTPAUTH/CURLOPT_USERPWD, line 222 removes Authorization/Cookie headers when isCrossOrigin() detects origin changes.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31090" }, "impact_statement": "CVE-2022-31090 fix is already present in target version 6.5.8. The vulnerability concerned Authorization header leakage when following HTTP redirects to different origins (host/port/scheme changes). The upstream Guzzle 6.5.8 release (June 20, 2022) included the complete fix using Psr7\\UriComparator::isCrossOrigin() to remove curl auth options and sensitive headers on cross-origin redirects. TuxCare onboarded this version via snapshot commit 0d8fa44a, which already contained the fix. Both defense points are present: line 98 removes CURLOPT_HTTPAUTH/CURLOPT_USERPWD, line 222 removes Authorization/Cookie headers when isCrossOrigin() detects origin changes." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-11-03T10:18:21.473206+00:00", "status_notes": "Vulnerability CVE-2022-31091 does not affect version 6.5.8-p2+tuxcare of guzzlehttp/guzzle. Target version 6.5.8-p4+tuxcare is not affected by CVE-2022-31091. The vulnerable pattern (shouldStripSensitiveHeaders method that only checked host and scheme-downgrade) is absent. The target uses the fixed implementation (Psr7\\UriComparator::isCrossOrigin) that properly checks host, port, AND scheme changes before removing sensitive headers on redirects. This fix was already present in the upstream 6.5.8 release (by Graham Campbell, 2022-06-20) that TuxCare onboarded via snapshot commit 0d8fa44a.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31091" }, "impact_statement": "Target version 6.5.8-p4+tuxcare is not affected by CVE-2022-31091. The vulnerable pattern (shouldStripSensitiveHeaders method that only checked host and scheme-downgrade) is absent. The target uses the fixed implementation (Psr7\\UriComparator::isCrossOrigin) that properly checks host, port, AND scheme changes before removing sensitive headers on redirects. This fix was already present in the upstream 6.5.8 release (by Graham Campbell, 2022-06-20) that TuxCare onboarded via snapshot commit 0d8fa44a." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55568 is fixed in version 6.5.8-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55568" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55767 is fixed in version 6.5.8-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55767" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59883 is fixed in version 6.5.8-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-59883" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67339 is fixed in version 6.5.8-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67339" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67353 is fixed in version 6.5.8-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67353" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67354 is fixed in version 6.5.8-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67354" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67355 is fixed in version 6.5.8-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67355" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69245 affects version 6.5.8-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-69245" }, "action_statement": "Vulnerability CVE-2026-69245 affects version 6.5.8-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69246 affects version 6.5.8-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-69246" }, "action_statement": "Vulnerability CVE-2026-69246 affects version 6.5.8-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 6.5.8-p2+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 6.5.8-p2+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w is fixed in version 6.5.8-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.5.8-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p3+tuxcare.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" }, "action_statement": "Vulnerability GHSA-f283-ghqc-fg79 affects version 6.5.8-p2+tuxcare of guzzlehttp/guzzle, and is fixed in 6.5.8-p3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 is fixed in version 6.5.8-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 6.5.8-p2+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 6.5.8-p2+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 is fixed in version 6.5.8-p2+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:40:09.352558+00:00", "status_notes": "Vulnerability CVE-2022-29248 does not affect version 6.5.8-p3+tuxcare of guzzlehttp/guzzle. Target guzzlehttp/guzzle 6.5.8-p4+tuxcare contains the fix for CVE-2022-29248 (cross-domain cookie leakage), but the fix came from upstream Guzzle 6.5.6 (released 2022-05-25 by Graham Campbell), not from a TuxCare backport. The TuxCare snapshot commit (0d8fa44a by bashebr@cloudlinux.com) onboarded upstream version 6.5.8 which already included the fix. Per A1 rule, an onboarding/snapshot commit is not a fix commit; when it's the only commit carrying the fix, the fix came with the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-29248" }, "impact_statement": "Target guzzlehttp/guzzle 6.5.8-p4+tuxcare contains the fix for CVE-2022-29248 (cross-domain cookie leakage), but the fix came from upstream Guzzle 6.5.6 (released 2022-05-25 by Graham Campbell), not from a TuxCare backport. The TuxCare snapshot commit (0d8fa44a by bashebr@cloudlinux.com) onboarded upstream version 6.5.8 which already included the fix. Per A1 rule, an onboarding/snapshot commit is not a fix commit; when it's the only commit carrying the fix, the fix came with the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-11-03T10:18:21.473206+00:00", "status_notes": "Vulnerability CVE-2022-31042 does not affect version 6.5.8-p3+tuxcare of guzzlehttp/guzzle. The target repository (guzzlehttp/guzzle 6.5.8-p4+tuxcare) is NOT affected by CVE-2022-31042. The vulnerability (Cookie header leakage on cross-origin redirects or HTTPS\u2192HTTP downgrades) was fixed in upstream Guzzle 6.5.7 (released 2022-06-09). The target is based on upstream 6.5.8 (released 2022-06-20), which includes the fix using Psr7\\UriComparator::isCrossOrigin() at src/RedirectMiddleware.php:222-224. This implementation strips Cookie headers when host differs, scheme changes, or port changes\u2014providing equivalent or superior protection to the CVE fix. The vulnerable code pattern is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31042" }, "impact_statement": "The target repository (guzzlehttp/guzzle 6.5.8-p4+tuxcare) is NOT affected by CVE-2022-31042. The vulnerability (Cookie header leakage on cross-origin redirects or HTTPS\u2192HTTP downgrades) was fixed in upstream Guzzle 6.5.7 (released 2022-06-09). The target is based on upstream 6.5.8 (released 2022-06-20), which includes the fix using Psr7\\UriComparator::isCrossOrigin() at src/RedirectMiddleware.php:222-224. This implementation strips Cookie headers when host differs, scheme changes, or port changes\u2014providing equivalent or superior protection to the CVE fix. The vulnerable code pattern is not present." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-11-11T14:26:45.678254+00:00", "status_notes": "Vulnerability CVE-2022-31043 does not affect version 6.5.8-p3+tuxcare of guzzlehttp/guzzle. guzzlehttp/guzzle 6.5.8 is NOT AFFECTED by CVE-2022-31043 (Authorization header not stripped on HTTPS->HTTP redirect). The vendor fixed it in upstream Guzzle 6.5.7 (2022-06-09, CHANGELOG: \"Fix failure to strip Authorization header on HTTP downgrade\"); 6.5.8 inherits the fix. Advisory affected range is < 6.5.7 and 7.0.0 - < 7.4.4. The fix was authored by the upstream Guzzle maintainers, not by TuxCare. Verified: src/RedirectMiddleware.php in our 6.5.8 vendor snapshot (0d8fa44a) is byte-identical to vendor tag 6.5.8 and removes the Authorization and Cookie headers on any cross-origin redirect, scheme downgrade included (lines 221-225); tests/RedirectMiddlewareTest.php::testHeadersTreatmentOnRedirect covers https://example.com -> http://example.com and asserts Authorization is removed. No backport needed (Jira PHPELSCVE-1122).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31043" }, "impact_statement": "guzzlehttp/guzzle 6.5.8 is NOT AFFECTED by CVE-2022-31043 (Authorization header not stripped on HTTPS->HTTP redirect). The vendor fixed it in upstream Guzzle 6.5.7 (2022-06-09, CHANGELOG: \"Fix failure to strip Authorization header on HTTP downgrade\"); 6.5.8 inherits the fix. Advisory affected range is < 6.5.7 and 7.0.0 - < 7.4.4. The fix was authored by the upstream Guzzle maintainers, not by TuxCare. Verified: src/RedirectMiddleware.php in our 6.5.8 vendor snapshot (0d8fa44a) is byte-identical to vendor tag 6.5.8 and removes the Authorization and Cookie headers on any cross-origin redirect, scheme downgrade included (lines 221-225); tests/RedirectMiddlewareTest.php::testHeadersTreatmentOnRedirect covers https://example.com -> http://example.com and asserts Authorization is removed. No backport needed (Jira PHPELSCVE-1122)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2022-31090 does not affect version 6.5.8-p3+tuxcare of guzzlehttp/guzzle. CVE-2022-31090 fix is already present in target version 6.5.8. The vulnerability concerned Authorization header leakage when following HTTP redirects to different origins (host/port/scheme changes). The upstream Guzzle 6.5.8 release (June 20, 2022) included the complete fix using Psr7\\UriComparator::isCrossOrigin() to remove curl auth options and sensitive headers on cross-origin redirects. TuxCare onboarded this version via snapshot commit 0d8fa44a, which already contained the fix. Both defense points are present: line 98 removes CURLOPT_HTTPAUTH/CURLOPT_USERPWD, line 222 removes Authorization/Cookie headers when isCrossOrigin() detects origin changes.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31090" }, "impact_statement": "CVE-2022-31090 fix is already present in target version 6.5.8. The vulnerability concerned Authorization header leakage when following HTTP redirects to different origins (host/port/scheme changes). The upstream Guzzle 6.5.8 release (June 20, 2022) included the complete fix using Psr7\\UriComparator::isCrossOrigin() to remove curl auth options and sensitive headers on cross-origin redirects. TuxCare onboarded this version via snapshot commit 0d8fa44a, which already contained the fix. Both defense points are present: line 98 removes CURLOPT_HTTPAUTH/CURLOPT_USERPWD, line 222 removes Authorization/Cookie headers when isCrossOrigin() detects origin changes." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-11-03T10:18:21.473206+00:00", "status_notes": "Vulnerability CVE-2022-31091 does not affect version 6.5.8-p3+tuxcare of guzzlehttp/guzzle. Target version 6.5.8-p4+tuxcare is not affected by CVE-2022-31091. The vulnerable pattern (shouldStripSensitiveHeaders method that only checked host and scheme-downgrade) is absent. The target uses the fixed implementation (Psr7\\UriComparator::isCrossOrigin) that properly checks host, port, AND scheme changes before removing sensitive headers on redirects. This fix was already present in the upstream 6.5.8 release (by Graham Campbell, 2022-06-20) that TuxCare onboarded via snapshot commit 0d8fa44a.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31091" }, "impact_statement": "Target version 6.5.8-p4+tuxcare is not affected by CVE-2022-31091. The vulnerable pattern (shouldStripSensitiveHeaders method that only checked host and scheme-downgrade) is absent. The target uses the fixed implementation (Psr7\\UriComparator::isCrossOrigin) that properly checks host, port, AND scheme changes before removing sensitive headers on redirects. This fix was already present in the upstream 6.5.8 release (by Graham Campbell, 2022-06-20) that TuxCare onboarded via snapshot commit 0d8fa44a." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55568 is fixed in version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55568" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55767 is fixed in version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55767" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59883 is fixed in version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-59883" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67339 is fixed in version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67339" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67353 is fixed in version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67353" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67354 is fixed in version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67354" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67355 is fixed in version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67355" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69245 is fixed in version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-69245" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69246 is fixed in version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-69246" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 6.5.8-p3+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 6.5.8-p3+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w is fixed in version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 is fixed in version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 is fixed in version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 6.5.8-p3+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 6.5.8-p3+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 is fixed in version 6.5.8-p3+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:40:09.352558+00:00", "status_notes": "Vulnerability CVE-2022-29248 does not affect version 6.5.8-p4+tuxcare of guzzlehttp/guzzle. Target guzzlehttp/guzzle 6.5.8-p4+tuxcare contains the fix for CVE-2022-29248 (cross-domain cookie leakage), but the fix came from upstream Guzzle 6.5.6 (released 2022-05-25 by Graham Campbell), not from a TuxCare backport. The TuxCare snapshot commit (0d8fa44a by bashebr@cloudlinux.com) onboarded upstream version 6.5.8 which already included the fix. Per A1 rule, an onboarding/snapshot commit is not a fix commit; when it's the only commit carrying the fix, the fix came with the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-29248" }, "impact_statement": "Target guzzlehttp/guzzle 6.5.8-p4+tuxcare contains the fix for CVE-2022-29248 (cross-domain cookie leakage), but the fix came from upstream Guzzle 6.5.6 (released 2022-05-25 by Graham Campbell), not from a TuxCare backport. The TuxCare snapshot commit (0d8fa44a by bashebr@cloudlinux.com) onboarded upstream version 6.5.8 which already included the fix. Per A1 rule, an onboarding/snapshot commit is not a fix commit; when it's the only commit carrying the fix, the fix came with the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-11-03T10:18:21.473206+00:00", "status_notes": "Vulnerability CVE-2022-31042 does not affect version 6.5.8-p4+tuxcare of guzzlehttp/guzzle. The target repository (guzzlehttp/guzzle 6.5.8-p4+tuxcare) is NOT affected by CVE-2022-31042. The vulnerability (Cookie header leakage on cross-origin redirects or HTTPS\u2192HTTP downgrades) was fixed in upstream Guzzle 6.5.7 (released 2022-06-09). The target is based on upstream 6.5.8 (released 2022-06-20), which includes the fix using Psr7\\UriComparator::isCrossOrigin() at src/RedirectMiddleware.php:222-224. This implementation strips Cookie headers when host differs, scheme changes, or port changes\u2014providing equivalent or superior protection to the CVE fix. The vulnerable code pattern is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31042" }, "impact_statement": "The target repository (guzzlehttp/guzzle 6.5.8-p4+tuxcare) is NOT affected by CVE-2022-31042. The vulnerability (Cookie header leakage on cross-origin redirects or HTTPS\u2192HTTP downgrades) was fixed in upstream Guzzle 6.5.7 (released 2022-06-09). The target is based on upstream 6.5.8 (released 2022-06-20), which includes the fix using Psr7\\UriComparator::isCrossOrigin() at src/RedirectMiddleware.php:222-224. This implementation strips Cookie headers when host differs, scheme changes, or port changes\u2014providing equivalent or superior protection to the CVE fix. The vulnerable code pattern is not present." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-11-11T14:26:45.678254+00:00", "status_notes": "Vulnerability CVE-2022-31043 does not affect version 6.5.8-p4+tuxcare of guzzlehttp/guzzle. guzzlehttp/guzzle 6.5.8 is NOT AFFECTED by CVE-2022-31043 (Authorization header not stripped on HTTPS->HTTP redirect). The vendor fixed it in upstream Guzzle 6.5.7 (2022-06-09, CHANGELOG: \"Fix failure to strip Authorization header on HTTP downgrade\"); 6.5.8 inherits the fix. Advisory affected range is < 6.5.7 and 7.0.0 - < 7.4.4. The fix was authored by the upstream Guzzle maintainers, not by TuxCare. Verified: src/RedirectMiddleware.php in our 6.5.8 vendor snapshot (0d8fa44a) is byte-identical to vendor tag 6.5.8 and removes the Authorization and Cookie headers on any cross-origin redirect, scheme downgrade included (lines 221-225); tests/RedirectMiddlewareTest.php::testHeadersTreatmentOnRedirect covers https://example.com -> http://example.com and asserts Authorization is removed. No backport needed (Jira PHPELSCVE-1122).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31043" }, "impact_statement": "guzzlehttp/guzzle 6.5.8 is NOT AFFECTED by CVE-2022-31043 (Authorization header not stripped on HTTPS->HTTP redirect). The vendor fixed it in upstream Guzzle 6.5.7 (2022-06-09, CHANGELOG: \"Fix failure to strip Authorization header on HTTP downgrade\"); 6.5.8 inherits the fix. Advisory affected range is < 6.5.7 and 7.0.0 - < 7.4.4. The fix was authored by the upstream Guzzle maintainers, not by TuxCare. Verified: src/RedirectMiddleware.php in our 6.5.8 vendor snapshot (0d8fa44a) is byte-identical to vendor tag 6.5.8 and removes the Authorization and Cookie headers on any cross-origin redirect, scheme downgrade included (lines 221-225); tests/RedirectMiddlewareTest.php::testHeadersTreatmentOnRedirect covers https://example.com -> http://example.com and asserts Authorization is removed. No backport needed (Jira PHPELSCVE-1122)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-11-03T10:18:53.426649+00:00", "status_notes": "Vulnerability CVE-2022-31090 does not affect version 6.5.8-p4+tuxcare of guzzlehttp/guzzle. CVE-2022-31090 fix is already present in target version 6.5.8. The vulnerability concerned Authorization header leakage when following HTTP redirects to different origins (host/port/scheme changes). The upstream Guzzle 6.5.8 release (June 20, 2022) included the complete fix using Psr7\\UriComparator::isCrossOrigin() to remove curl auth options and sensitive headers on cross-origin redirects. TuxCare onboarded this version via snapshot commit 0d8fa44a, which already contained the fix. Both defense points are present: line 98 removes CURLOPT_HTTPAUTH/CURLOPT_USERPWD, line 222 removes Authorization/Cookie headers when isCrossOrigin() detects origin changes.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31090" }, "impact_statement": "CVE-2022-31090 fix is already present in target version 6.5.8. The vulnerability concerned Authorization header leakage when following HTTP redirects to different origins (host/port/scheme changes). The upstream Guzzle 6.5.8 release (June 20, 2022) included the complete fix using Psr7\\UriComparator::isCrossOrigin() to remove curl auth options and sensitive headers on cross-origin redirects. TuxCare onboarded this version via snapshot commit 0d8fa44a, which already contained the fix. Both defense points are present: line 98 removes CURLOPT_HTTPAUTH/CURLOPT_USERPWD, line 222 removes Authorization/Cookie headers when isCrossOrigin() detects origin changes." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-11-03T10:18:21.473206+00:00", "status_notes": "Vulnerability CVE-2022-31091 does not affect version 6.5.8-p4+tuxcare of guzzlehttp/guzzle. Target version 6.5.8-p4+tuxcare is not affected by CVE-2022-31091. The vulnerable pattern (shouldStripSensitiveHeaders method that only checked host and scheme-downgrade) is absent. The target uses the fixed implementation (Psr7\\UriComparator::isCrossOrigin) that properly checks host, port, AND scheme changes before removing sensitive headers on redirects. This fix was already present in the upstream 6.5.8 release (by Graham Campbell, 2022-06-20) that TuxCare onboarded via snapshot commit 0d8fa44a.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31091" }, "impact_statement": "Target version 6.5.8-p4+tuxcare is not affected by CVE-2022-31091. The vulnerable pattern (shouldStripSensitiveHeaders method that only checked host and scheme-downgrade) is absent. The target uses the fixed implementation (Psr7\\UriComparator::isCrossOrigin) that properly checks host, port, AND scheme changes before removing sensitive headers on redirects. This fix was already present in the upstream 6.5.8 release (by Graham Campbell, 2022-06-20) that TuxCare onboarded via snapshot commit 0d8fa44a." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:32:00.211438+00:00", "status_notes": "Vulnerability CVE-2026-55568 is fixed in version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55568" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:32:00.211438+00:00", "status_notes": "Vulnerability CVE-2026-55767 is fixed in version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-55767" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:32:00.211438+00:00", "status_notes": "Vulnerability CVE-2026-59883 is fixed in version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-59883" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:32:00.211438+00:00", "status_notes": "Vulnerability CVE-2026-67339 is fixed in version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67339" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:32:00.211438+00:00", "status_notes": "Vulnerability CVE-2026-67353 is fixed in version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67353" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:32:00.211438+00:00", "status_notes": "Vulnerability CVE-2026-67354 is fixed in version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67354" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:32:00.211438+00:00", "status_notes": "Vulnerability CVE-2026-67355 is fixed in version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-67355" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:32:00.211438+00:00", "status_notes": "Vulnerability CVE-2026-69245 is fixed in version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-69245" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:32:00.211438+00:00", "status_notes": "Vulnerability CVE-2026-69246 is fixed in version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "CVE-2026-69246" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-32rq-jhr7-m3hh is a false positive for guzzlehttp/guzzle 6.5.8-p4+tuxcare.", "vulnerability": { "name": "GHSA-32rq-jhr7-m3hh" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3fvr-2jw6-crq4 is a false positive for guzzlehttp/guzzle 6.5.8-p4+tuxcare.", "vulnerability": { "name": "GHSA-3fvr-2jw6-crq4" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:32:00.211438+00:00", "status_notes": "Vulnerability GHSA-94pj-82f3-465w is fixed in version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-94pj-82f3-465w" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:32:00.211438+00:00", "status_notes": "Vulnerability GHSA-f283-ghqc-fg79 is fixed in version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-f283-ghqc-fg79" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:32:00.211438+00:00", "status_notes": "Vulnerability GHSA-h95v-h523-3mw8 is fixed in version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-h95v-h523-3mw8" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mjrx-74jh-7xgw is a false positive for guzzlehttp/guzzle 6.5.8-p4+tuxcare.", "vulnerability": { "name": "GHSA-mjrx-74jh-7xgw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-mqq9-gxg5-m58g is a false positive for guzzlehttp/guzzle 6.5.8-p4+tuxcare.", "vulnerability": { "name": "GHSA-mqq9-gxg5-m58g" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare", "identifiers": { "purl": "pkg:composer/guzzlehttp/guzzle@6.5.8-p4+tuxcare" } } ], "timestamp": "2026-10-16T13:32:00.211438+00:00", "status_notes": "Vulnerability GHSA-wm3w-8rrp-j577 is fixed in version 6.5.8-p4+tuxcare of guzzlehttp/guzzle.", "vulnerability": { "name": "GHSA-wm3w-8rrp-j577" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@3.61.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@3.61.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21544 is fixed in version 3.61.0-p1+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2024-21544" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@3.61.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@3.61.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21547 is fixed in version 3.61.0-p1+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2024-21547" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@3.61.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@3.61.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21549 is fixed in version 3.61.0-p1+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2024-21549" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@3.61.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@3.61.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-1022 is fixed in version 3.61.0-p1+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2025-1022" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@3.61.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@3.61.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-1026 is fixed in version 3.61.0-p1+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2025-1026" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/spatie/browsershot@3.61.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@3.61.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3192 affects version 3.61.0-p1+tuxcare of spatie/browsershot, and is fixed in 3.61.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2025-3192" }, "action_statement": "Vulnerability CVE-2025-3192 affects version 3.61.0-p1+tuxcare of spatie/browsershot, and is fixed in 3.61.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/spatie/browsershot@3.61.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@3.61.0-p1+tuxcare" } } ], "timestamp": "2026-11-11T18:55:00.247817+00:00", "status_notes": "Vulnerability CVE-2026-126779 affects version 3.61.0-p1+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2026-126779" }, "action_statement": "Vulnerability CVE-2026-126779 affects version 3.61.0-p1+tuxcare of spatie/browsershot." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@4.4.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@4.4.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21544 is fixed in version 4.4.0-p2+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2024-21544" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@4.4.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@4.4.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21547 is fixed in version 4.4.0-p2+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2024-21547" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@4.4.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@4.4.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21549 is fixed in version 4.4.0-p2+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2024-21549" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@4.4.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@4.4.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-1022 is fixed in version 4.4.0-p2+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2025-1022" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@4.4.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@4.4.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-1026 is fixed in version 4.4.0-p2+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2025-1026" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@4.4.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@4.4.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3192 is fixed in version 4.4.0-p2+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2025-3192" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/spatie/browsershot@4.4.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@4.4.0-p2+tuxcare" } } ], "timestamp": "2026-11-11T18:55:00.247817+00:00", "status_notes": "Vulnerability CVE-2026-126779 affects version 4.4.0-p2+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2026-126779" }, "action_statement": "Vulnerability CVE-2026-126779 affects version 4.4.0-p2+tuxcare of spatie/browsershot." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@3.61.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@3.61.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21544 is fixed in version 3.61.0-p2+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2024-21544" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@3.61.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@3.61.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21547 is fixed in version 3.61.0-p2+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2024-21547" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@3.61.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@3.61.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21549 is fixed in version 3.61.0-p2+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2024-21549" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@3.61.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@3.61.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-1022 is fixed in version 3.61.0-p2+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2025-1022" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@3.61.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@3.61.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-1026 is fixed in version 3.61.0-p2+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2025-1026" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@3.61.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@3.61.0-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3192 is fixed in version 3.61.0-p2+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2025-3192" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/spatie/browsershot@3.61.0-p2+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@3.61.0-p2+tuxcare" } } ], "timestamp": "2026-11-11T18:55:00.247817+00:00", "status_notes": "Vulnerability CVE-2026-126779 affects version 3.61.0-p2+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2026-126779" }, "action_statement": "Vulnerability CVE-2026-126779 affects version 3.61.0-p2+tuxcare of spatie/browsershot." }, { "status": "affected", "products": [ { "@id": "pkg:composer/spatie/browsershot@4.4.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@4.4.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21544 affects version 4.4.0-p1+tuxcare of spatie/browsershot, and is fixed in 4.4.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2024-21544" }, "action_statement": "Vulnerability CVE-2024-21544 affects version 4.4.0-p1+tuxcare of spatie/browsershot, and is fixed in 4.4.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/spatie/browsershot@4.4.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@4.4.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21547 affects version 4.4.0-p1+tuxcare of spatie/browsershot, and is fixed in 4.4.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2024-21547" }, "action_statement": "Vulnerability CVE-2024-21547 affects version 4.4.0-p1+tuxcare of spatie/browsershot, and is fixed in 4.4.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/spatie/browsershot@4.4.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@4.4.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21549 affects version 4.4.0-p1+tuxcare of spatie/browsershot, and is fixed in 4.4.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2024-21549" }, "action_statement": "Vulnerability CVE-2024-21549 affects version 4.4.0-p1+tuxcare of spatie/browsershot, and is fixed in 4.4.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/spatie/browsershot@4.4.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@4.4.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-1022 affects version 4.4.0-p1+tuxcare of spatie/browsershot, and is fixed in 4.4.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2025-1022" }, "action_statement": "Vulnerability CVE-2025-1022 affects version 4.4.0-p1+tuxcare of spatie/browsershot, and is fixed in 4.4.0-p2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/spatie/browsershot@4.4.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@4.4.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-1026 affects version 4.4.0-p1+tuxcare of spatie/browsershot, and is fixed in 4.4.0-p2+tuxcare.", "vulnerability": { "name": "CVE-2025-1026" }, "action_statement": "Vulnerability CVE-2025-1026 affects version 4.4.0-p1+tuxcare of spatie/browsershot, and is fixed in 4.4.0-p2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/spatie/browsershot@4.4.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@4.4.0-p1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3192 is fixed in version 4.4.0-p1+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2025-3192" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/spatie/browsershot@4.4.0-p1+tuxcare", "identifiers": { "purl": "pkg:composer/spatie/browsershot@4.4.0-p1+tuxcare" } } ], "timestamp": "2026-11-11T18:55:00.247817+00:00", "status_notes": "Vulnerability CVE-2026-126779 affects version 4.4.0-p1+tuxcare of spatie/browsershot.", "vulnerability": { "name": "CVE-2026-126779" }, "action_statement": "Vulnerability CVE-2026-126779 affects version 4.4.0-p1+tuxcare of spatie/browsershot." } ], "@id": "urn:sha256:d7f1d387ffc636899ca4c59cecc36a9f274ff4945e560ed8ad8ea7533273678e" }