Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-7VW7-QX38-37VRCriticalpropel/propel: Propel2 SQL injection possible with limit() on MySQLGHSA-WW6P-Q26W-FR6MMediumphpxmlrpc/extras: phpxmlrpc/extra XSS in class documenting_xmlrpc_serverGHSA-QM5V-PJ64-852JMediumpassbolt/passbolt_api: Passbolt Api Tabnabbing when opening URI with menu "Open URI in a new tab"GHSA-2F46-4XJM-73X5Highpassbolt/passbolt_api: Passbolt API Stored XSS on first/last name during setupGHSA-CV5C-2QV5-W2M2Highpassbolt/passbolt_api: Passbolt Api Remote code executionGHSA-F5PP-PMQ8-GP46Lowpassbolt/passbolt_api: Passbolt Api Retrieval of HTTP-only cookiesGHSA-V86M-J5F7-CCWHMediumpassbolt/passbolt_api: Passbolt Api E-mail HTML injectionGHSA-3VHM-Q4W3-RW8QMediumoro/platform: OroPlatform Forced Redirect to External WebsiteGHSA-V8HP-239V-9367Mediumoro/crm: OroCRM Forced Redirect to External WebsiteGHSA-3FMQ-X9Q6-WM39Lowparagonie/random_compat: random_compat Uses insecure CSPRNGCVE-2016-1000253Mediumonelogin/php-saml: onelogin/php-saml signature wrapping attacksGHSA-9WRW-P9RM-R782Lowonelogin/php-saml: onelogin/php-saml Improper signature validation on LogoutRequest/LogoutResponse.GHSA-R2R8-36PQ-27CMHighnzo/url-encryptor-bundle: nzo/url-encryptor-bundle Insecure default secret key and IV allowing anyone to decrypt valuesGHSA-RQ6Q-HJVH-5MWHCriticalneos/swiftmailer: Flow Swift Mailer package Remote code executionGHSA-6CJ3-RC4P-F38FHighneos/neos: Cross-site Scripting vulnerabilities in NeosGHSA-43CF-7F3H-38RGMediumneos/neos: Privilege Escalation in TYPO3 NeosGHSA-6PQ8-67PW-J6HWMediumneos/flow: Time-Based Information Disclosure Vulnerability in FlowGHSA-3C5G-73F7-GRVMHighneos/neos: Neos Information Disclosure Security NoteGHSA-9CW3-J7WG-JWJ8Mediumneos/flow: Neos Flow Information disclosure in entity securityGHSA-5VV7-J593-MGJCMediumneos/flow: Neos Flow Arbitrary file upload and XML External Entity processingGHSA-7H74-7VCW-4MWPLowneos/flow: Insecure deserialize Vulnerability in FLOW3GHSA-4RR6-GF59-GGW5Criticalnamshi/jose: namshi/jose - Verification bypassGHSA-HXHC-WMG8-XRQFHighnamshi/jose: namshi/jose insecure JSON Web Signatures (JWS)GHSA-F57V-Q966-7FH6Lowmonolog/monolog: Monolog Header injection in NativeMailerHandlerGHSA-8J7C-682X-R9F2Criticalmagento/community-edition: Magento RCE,XSS and other vulnerabilities

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo