Cross-site scripting in the frontend search results (see GHSA-h57j-5f5m-789v)

PKSA-snk8-7c3n-1x4z

Affected version: >=4.9.0,<5.3.50|>=5.4.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

Unrestricted activation email resending (see GHSA-mfxh-vp55-7gc6)

PKSA-wrr4-414y-fqmj

Affected version: >=4.1.0,<5.3.50|>=5.4.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

Non-admin users can self-grant permissions that implicitly make them administrators (see GHSA-r9qp-pqx5-8369)

PKSA-335s-36s8-mdj4

Affected version: >=5.0.0,<5.3.50|>=5.4.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

Cross-site request forgery in custom backend actions (see GHSA-9ff2-p842-45wq)

PKSA-4788-1fwx-c4gc

Affected version: >=4.0.0,<5.3.50|>=5.4.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

Exposure of sensitive information through a stale search index (see GHSA-x2rp-9qf7-2fmq)

PKSA-cvfh-n5dv-w5t9

Affected version: >=4.0.0,<5.3.50|>=5.4.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

Path traversal in the images controller (see GHSA-mrvp-7wmx-5m4h)

PKSA-zm5t-426r-gfpx

Affected version: >=5.0.0,<5.3.50|>=5.4.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

Improper access control in the CSV import wizard (see GHSA-23w9-4pg3-xwm3)

PKSA-t5k3-41dk-f7y5

Affected version: >=5.0.0,<5.3.50|>=5.4.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

Improper access control in the preview links module (see GHSA-q6wp-fr43-gm9v)

PKSA-yksm-8fg2-dsvs

Affected version: >=5.7.1,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

Improper access control in the table access voter (see GHSA-5974-gfqc-wrcm)

PKSA-xtw6-fy62-6vn3

Affected version: >=5.7.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

Server-side request forgery (SSRF) via unvalidated RSS feed URLs

PKSA-yx24-z15d-x2k7 CVE-2026-57232

Affected version: >=5.3.35,<5.3.48|>=5.4.0,<5.7.9

Reported by:
FriendsOfPHP/security-advisories