| | | | minor | | 0007727 | 2024-10-30 | | confirmed | 4.04. Security | Increase bcrypt cost |
| | | | feature | | 0007324 | 2024-10-08 | 1 | resolved | 4.02. Session handling | Existing sessions should be destroyed on password change |
| | | | crash | | 0007415 | 2024-08-08 | 1 | resolved | 1.05. Users | It's possible to partly hijack an account, in case the user provides an URL containing the parameter force_sid |
| | | | major | | 0007479 | 2023-08-01 | 1 | resolved | 4.04. Security | EE: package guzzlehttp/psr-7 2.4.3 has security flaws |
| | | | crash | | 0007059 | 2022-08-22 | 3 | resolved | 1.05. Users | CreateUser does not check CSRF/session token |
| | | | crash | | 0006678 | 2017-11-02 | | resolved | 4.04. Security | Forced browsing attack possible |
