Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-55072Highpimcore/pimcore: Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table nameCVE-2026-47132Mediumthorsten/phpmyfaq: phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User EnumerationCVE-2026-45694Mediumlibrenms/librenms: LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignmentCVE-2026-35445Highwinter/wn-backend-module: Winter: Authenticated backend users can bypass Users controller permission checksCVE-2026-32639Mediumwinter/wn-cms-module: Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploadsCVE-2026-32593Mediumwinter/wn-backend-module: Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjaxCVE-2026-32258Highwinter/wn-backend-module: Winter: Stored XSS through Editor Settings custom stylesCVE-2026-32257Highwinter/wn-backend-module: Winter: Stored XSS through Brand Settings custom stylesCVE-2026-63223Criticalcodeigniter4/framework: CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rulesCVE-2026-63222Highcodeigniter4/framework: CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenamesCVE-2026-63221Criticalcodeigniter4/framework: CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditionsCVE-2026-63220Mediumcodeigniter4/framework: CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()CVE-2026-54164Mediumapi-platform/core: API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion)CVE-2026-62996Mediumsmarty/smarty: Smarty Security stream restriction bypass through stream: resourceCVE-2026-62992Mediumsmarty/smarty: Smarty: Symlink path traversal out of trusted directoriesGHSA-WG23-69C2-GJC8Criticalcraftcms/cms: Craft CMS: Passkey login accepts replayed WebAuthn assertionsCVE-2026-72779Mediumcraftcms/cms: Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contextsCVE-2026-72782Mediumcraftcms/cms: Craft CMS: Authenticated leak of secret environment variablesCVE-2026-72785Mediumcraftcms/cms: Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-elementCVE-2026-14794Mediumcraftcms/cms: Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metricsCVE-2026-72783Lowcraftcms/cms: Craft CMS: Incorrect path validation could potentially lead to path traversalGHSA-2RP4-X2J7-QMCCMediumcraftcms/cms: Craft CMS: Stored XSS in the control panel via unescaped draft nameCVE-2026-67434Highsquizlabs/php_codesniffer: PHP_CodeSniffer gitblame report command injection via crafted filenameGHSA-P8X7-9VFW-P7VCHighcraftcms/cms: Craft CMS: Arbitrary user password reset leading to administrator account takeoverCVE-2026-72781Highcraftcms/cms: Craft CMS: Authenticated RCE through Twig sandbox escape

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo