Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

1,052 alerts · page 53 of 53

  1. New public exploit · updated

    CVE-2014-4920 Reflective Cross-site Scripting Vulnerability in twitter-bootstrap-rails

    Unknown PoC

    Exploit status: Proof-of-concept only

    Affects: rubygems twitter-bootstrap-rails

    The twitter-bootstrap-rails Gem for Rails contains a flaw that enables a reflected cross-site scripting (XSS) attack. This flaw exists because the bootstrap_flash helper method does not validate input when handling flash messages before returning it to users. This may allow a con...

  2. New public exploit · updated

    CVE-2014-5245 Symfony allows direct access of ESI URLs behind a trusted proxy

    HighCVSS 7.5 PoC

    Exploit status: Proof-of-concept only

    Affects: symfony/http-kernel, symfony/symfony

    All 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony HttpKernel component are affected by this security issue. Your application is vulnerable only if the ESI feature is enabled and there is a proxy in front of the web application. This issue has been fixed in Symfony 2.3.19...

  3. New public exploit · updated

    CVE-2014-4931 Code injection in the way Symfony implements translation caching in FrameworkBundle

    HighCVSS 7.5 PoC

    Exploit status: Proof-of-concept only

    Affects: symfony/framework-bundle, symfony/symfony

    When investigating issue #11093, Jeremy Derussé found a serious code injection issue in the way Symfony implements translation caching in FrameworkBundle. Your Symfony application is vulnerable if you meet the following conditions: You are using the Symfony translation system fro...

  4. New public exploit · updated

    CVE-2025-30081 Clickstorm SEO Allows Cross-Site Scripting (XSS)

    MediumCVSS 5.9 PoC

    Exploit status: Proof-of-concept only

    Affects: clickstorm/cs-seo

    A cross-site scripting (XSS) vulnerability has been discovered in the Clickstorm SEO extension. This vulnerabily is exploitable by a logged in backend user utilizing the TYPO3 backend user interface. This user can create output in the HTML context by exploiting improperly encoded...

  5. New public exploit · updated

    CVE-2014-5244 Symfony vulnerable to denial of service via a malicious HTTP Host header

    HighCVSS 7.5 PoC

    Exploit status: Proof-of-concept only

    Affects: symfony/http-foundation, symfony/symfony

    All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony HttpFoundation component are affected by this security issue. This issue has been fixed in Symfony 2.3.19, 2.4.9, and 2.5.4. Note that no fixes are provided for Symfony 2.0, 2.1, and 2.2 as they are not main...

  6. New public exploit · updated

    CVE-2014-6072 Symfony Cross-Site Request Forgery vulnerability in the Web Profiler

    HighCVSS 8.1 PoC

    Exploit status: Proof-of-concept only

    Affects: symfony/symfony, symfony/web-profiler-bundle

    All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony WebProfiler bundle are affected by this security issue. This issue has been fixed in Symfony 2.3.19, 2.4.9, and 2.5.4. Note that no fixes are provided for Symfony 2.0, 2.1, and 2.2 as they are not maintained...

  7. New public exploit · updated

    CVE-2025-30083 Additional TCA Allows Cross-Site Scripting (XSS)

    MediumCVSS 5.1 PoC

    Exploit status: Proof-of-concept only

    Affects: codingms/additional-tca

    A cross-site scripting (XSS) vulnerability has been discovered in the Additional TCA extension. This vulnerabily is exploitable by a logged in backend user utilizing the TYPO3 backend user interface. This user can create output in the HTML context by exploiting improperly encoded...

  8. New public exploit · updated

    CVE-2015-2309 Symfony has unsafe methods in the Request class

    MediumCVSS 5.3 PoC

    Exploit status: Proof-of-concept only

    Affects: debian/symfony, symfony/http-foundation, symfony/symfony

    All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, 2.5.X, and 2.6.X versions of the Symfony HttpFoundation component are affected by this security issue. This issue has been fixed in Symfony 2.3.27, 2.5.11, and 2.6.6. Note that no fixes are provided for Symfony 2.0, 2.1, 2.2, and 2.4 as they...

  9. New public exploit · updated

    CVE-2024-30173 OpenID Connect Authentication (oidc) Typo3 extension Authentication Bypass

    MediumCVSS 6.0 PoC

    Exploit status: Proof-of-concept only

    Affects: causal/oidc

    The authentication service of the extension does not verify the OpenID Connect authentication state from the user lookup chain. Instead, the authentication service authenticates every valid frontend user from the user lookup chain, where the frontend user field “tx_oidc” is not e...

  10. New public exploit · updated

    CVE-2014-6061 Symfony has a security issue when parsing the Authorization header

    MediumCVSS 5.3 PoC

    Exploit status: Proof-of-concept only

    Affects: symfony/http-foundation, symfony/symfony

    All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony HttpFoundation component are affected by this security issue. This issue has been fixed in Symfony 2.3.19, 2.4.9, and 2.5.4. Note that no fixes are provided for Symfony 2.0, 2.1, and 2.2 as they are not main...

  11. New public exploit · updated

    CVE-2016-1000253 onelogin/php-saml signature wrapping attacks

    Unknown PoC

    Exploit status: Proof-of-concept only

    Affects: onelogin/php-saml

    Vulnerability in onelogin/php-saml versions prior to 2.10.0 allows signature Wrapping attacks which may result in a malicious user gaining unauthorized access to a system.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).