Do Son Kimai vulnerability CVE-2026-52824 (CVSS 9.1) lets attackers forge cookies for account takeover via a default Docker APP_SECRET. Update to 2.58.0 now.
Symfony
Symfony patched a High-severity flaw (CVE-2025-64500) in its Request component. Improper PATH_INFO parsing allows attackers to bypass access control rules in vulnerable applications.
A critical Auth0 PHP SDK deserialization flaw (CVE-2025-48951, CVSS 9.3) allows unauthenticated RCE in web apps. Patch to v8.14.0+ immediately!