Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-7MX2-7Q8P-PGMWMediumsymfony/symfony: Symfony may allow a user to switch to using another user's identityGHSA-J68W-PG49-F6VXCriticalsymfony/serializer: Symfony XML decoding attack vector through external entitiesGHSA-RJPM-QMQ7-Q85WHighsymfony/routing: Symfony XXE security vulnerabilityCVE-2014-5245Highsymfony/http-kernel: Symfony allows direct access of ESI URLs behind a trusted proxyCVE-2015-2309Mediumsymfony/http-foundation: Symfony has unsafe methods in the Request classCVE-2014-6061Mediumsymfony/http-foundation: Symfony has a security issue when parsing the Authorization headerCVE-2014-5244Highsymfony/http-foundation: Symfony vulnerable to denial of service via a malicious HTTP Host headerGHSA-VFM6-R2GC-PWWWMediumsymfony/http-foundation: Symfony2 security issue when the trust proxy mode is enabledCVE-2014-4931Highsymfony/framework-bundle: Code injection in the way Symfony implements translation caching in FrameworkBundleGHSA-C636-CG5R-2498Highsymfony/dependency-injection: Symfony XML Entity Expansion security vulnerabilityGHSA-G5VJ-WJ9X-4JG9Mediumsymbiote/silverstripe-multivaluefield: symbiote/silverstripe-multivaluefield Possible PHP Object Injection via Multi-Value Field ExtensionGHSA-945H-6VCV-PC8HMediumsylius/admin-bundle: Sylius Admin Bundle Cross-Site Request Forgery vulnerabilityGHSA-65V7-WG35-2QPMMediumsylius/resource-bundle: Sylius Resource Bundle Cross-Site Request Forgery vulnerabilityCVE-2024-35226Highsmarty/smarty: Smarty vulnerable to PHP Code Injection by malicious attribute in extends-tagCVE-2024-37294Mediumaimeos/aimeos-core: Aimeos denial of service vulnerability in SaaS and marketplace setupsGHSA-4QPJ-GXXG-JQG4Criticalswiftmailer/swiftmailer: Swiftmailer Sendmail transport arbitrary shell executionGHSA-Q8FC-V85F-78PWMediumstormpath/sdk: stormpath/sdk uses Insecure Random Number GeneratorGHSA-G6F5-4W43-2X63Mediumsocalnick/scn-social-auth: ScnSocialAuth Cross-site Scripting vulnerability in login redirect paramGHSA-PPM4-R2VC-PG74Mediumsimplesamlphp/simplesamlphp: SimpleSAMLphp Information Disclosure vulnerabilityGHSA-VPR3-CW3H-PRW8Mediumsimplesamlphp/simplesamlphp: SimpleSAMLphp Reflected Cross-site Scripting vulnerabilityGHSA-7WH8-JRQ7-P27FMediumsimplesamlphp/simplesamlphp: SimpleSAMLphp exposes credentials in session storageGHSA-V858-922F-FJ9VMediumsimplesamlphp/simplesamlphp: SimpleSAMLphp Link Injection vulnerabilityGHSA-XC69-P8FC-M6M5Highsilverstripe/subsites: silverstripe/subsites Unsafe SQL Query Construction (Safe Data Source)GHSA-P2V5-XCQM-4FV6Highsilverstripe/taxonomy: silverstripe/taxonomy SQL Injection vulnerabilityGHSA-55PP-293F-3365Mediumsilverstripe/userforms: silverstripe/userforms file upload exposure on UserForms module

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo