Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-119193Mediumphpunit/phpunit: PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handlingCVE-2026-96634Mediumadminneo-org/adminneo: AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCECVE-2026-96633Highadminneo-org/adminneo: AdminNeo SQLite Database-List Drop Arbitrary File DeletionCVE-2026-96631Highadminneo-org/adminneo: AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie HeadersCVE-2026-96632Highadminneo-org/adminneo: AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)CVE-2026-96630Highadminneo-org/adminneo: AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)CVE-2026-96629Mediumadminneo-org/adminneo: AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request ForgeryCVE-2026-59978Highadminneo-org/adminneo: AdminNeo: version-cache array injection causes persistent denial of serviceGHSA-PG53-P7QP-65CVLowpocketmine/pocketmine-mp: PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packetsCVE-2026-55186Mediumsilverstripe/mfa: MultiFactor Authentication for SilverStripe can bypass MFA during password reset flowCVE-2026-116675Hightinymce: TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serializationCVE-2026-109413Highsymfony/symfony: Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the ProcessCVE-2026-108082Highsymfony/http-foundation: Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request HeaderCVE-2026-108360Mediumphpoffice/phpspreadsheet: PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loadingCVE-2026-108359Highphpoffice/phpspreadsheet: PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)CVE-2026-108358Highphpoffice/phpspreadsheet: PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of ServiceCVE-2026-108357Highphpoffice/phpspreadsheet: PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of ServiceCVE-2026-33944Highdolibarr/dolibarr: Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameterCVE-2026-114509Criticallaravel/framework: Laravel TokenGuard authentication bypass through non-string API credentialsCVE-2026-114508Mediumlaravel/framework: Laravel relationship inclusion can trigger unauthorized data destructionGHSA-MHF7-XP6R-6QRCMediumlivewire/livewire: Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution orderCVE-2026-113712Mediumcachethq/cachet: Cachet has Stored XSS in Incident ComponentCVE-2026-85990Highleantime/leantime: Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC MethodsCVE-2026-62858Mediumyourls/yourls: YOURLS: Unauthenticated File InclusionCVE-2026-104827Highreact/http: react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo