Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-48761Mediumsymfony/html-sanitizer: Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes CVE-2026-11607Hightypo3/cms-core: TYPO3 CMS has Broken Access Control in its Form Framework CVE-2026-47349Mediumtypo3/cms-core: TYPO3 CMS has Broken Access Control in the Recycler Module CVE-2026-47347Mediumtypo3/cms-core: TYPO3 CMS has an Open Redirect Vulnerability via Core Utilities CVE-2026-47343Hightypo3/cms-core: TYPO3 CMS: Destructive Actions on File Mount Folders CVE-2026-47345Mediumtypo3/html-sanitizer: TYPO3 HTML Sanitizer allows Cross-site Scripting CVE-2026-49741Hightypo3/cms-core: TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework CVE-2026-47350Mediumtypo3/cms-core: TYPO3 CMS has Broken Access Control in its DataHandler CVE-2026-47346Hightypo3/cms-core: TYPO3 CMS has Broken Access Control in its Form Framework CVE-2026-49742Hightypo3/cms-core: TYPO3 CMS has Broken Access Control in its Media Module CVE-2026-49740Mediumtypo3/cms-core: TYPO3 CMS has Insecure Deserialization via Core API CVE-2026-49738Lowtypo3/cms-core: TYPO3 CMS has Broken Access Control in its File Abstraction Layer CVE-2026-47352Mediumtypo3/cms-core: TYPO3 CMS has Broken Access Control in Backend API CVE-2026-47351Mediumtypo3/cms-core: TYPO3 CMS: Broken Access Control in Media Module CVE-2026-47348Mediumtypo3/cms-core: TYPO3 CMS has Cross-Site Scripting in Indexed Search CVE-2026-47344Lowtypo3/html-sanitizer: TYPO3 HTML Sanitizer allows Cross-site Scripting GHSA-6JQ6-X4CX-QVCMMediumgrumpydictator/firefly-iii: Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)CVE-2026-48067Mediumfilament/tables: Filament has inconsistent scope enforcement for its AttachAction and AssociateAction Select fields CVE-2026-48062Criticalcodeigniter4/framework: CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule CVE-2026-53723Mediumguzzlehttp/guzzle-services: guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA Terminator CVE-2026-48998Mediumguzzlehttp/psr7: guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation CVE-2026-49214Mediumguzzlehttp/psr7: guzzlehttp/psr7 has CRLF Injection via URI Host Component CVE-2026-48030Criticalpheditor/pheditor: Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter CVE-2026-47767Mediumsymfony/runtime: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch CVE-2026-47693Mediumpoweradmin/poweradmin: Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applications

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.