Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-2GQ2-M628-33XPHighgregwar/rst: gregwar/rst Local File Inclusion VulnerabilityGHSA-9GXV-X7RP-R2HCCriticalgree/jose: gree/jose - "None" Algorithm treated as valid in tokensGHSA-FGRX-4637-FCF5Mediumfuel/core: fuel/core Crypt encryption compromised.GHSA-26HP-CGJJ-M2J3Highfuel/core: fuel/core ImageMagick driver does not escape all shell arguments.GHSA-8WX3-8M4X-G5H4Mediumfriendsofsymfony/user-bundle: FOSUserBundle User Identity Validation VulnerabilityGHSA-6MJQ-9X4W-M3W9Highfriendsofsymfony/user-bundle: FOSUserBundle Session Hijacking VulnerabilityGHSA-PJX8-984P-7P3XMediumfriendsofsymfony/user-bundle: FOSUserBundle Entropy is lost in the TokenGeneratorGHSA-P9FG-J6WW-953MMediumfriendsofsymfony/rest-bundle: FOSRestBundle issue with broken validation of JSONP callbacksGHSA-XM3X-4PH3-3X9CMediumfriendsofsymfony/oauth2-php: friendsofsymfony/oauth2-php open redirection in oauthGHSA-H533-5V22-8VCPCriticalfirebase/php-jwt: firebase/php-jwt: "None" Algorithm treated as valid on tokensGHSA-3G43-XFRW-PV5MHighezsystems/repository-forms: eZ Platform User data disclosureGHSA-W9P3-26FX-5MP3Mediumezsystems/platform-ui-assets-bundle: eZ Platform Admin UI is vulnerable to Cross-site Scripting (XSS)GHSA-39J2-4P9J-5W4JMediumezsystems/ezpublish-legacy: Ez Platform Object Injection in legacy shop moduleGHSA-9895-26WR-4FGVHighezsystems/ezpublish-legacy: EZsystems Remote code execution in file uploadsGHSA-PQJM-XCP8-WGMMMediumezsystems/ezpublish-legacy: Ez Platform and Legacy are prone to an insecure interpretation of PHP/PHAR uploadsGHSA-P9MP-VQ4V-V5M5Highezsystems/ezpublish-legacy: eZ Publish Legacy Passwordless login for LDAP usersGHSA-2VH3-CJ9J-MCJ5Mediumezsystems/ezpublish-legacy: eZ Publish Legacy Cross-site Scripting (XSS) in 'disabled module' error templateGHSA-64VJ-933F-6PM3Highezsystems/ezpublish-kernel: eZ Platform Object Injection in SiteAccessMatchListenerGHSA-82RV-45PC-V28WHighezsystems/ezpublish-legacy: eZ Publish Legacy Patch EZSA-2018-001 for Several vulnerabilitiesGHSA-CC2J-92JQ-WGJGHighezsystems/ezpublish-legacy: eZ Publish Information disclosure in backend content tree menuGHSA-3VWR-JJ4F-H98XHighezsystems/ezpublish-kernel: eZ Publish Remote code execution in file uploadsGHSA-QHJC-HG94-245VMediumezsystems/ezplatform: eZ Platform Prevent accepting app.php in URL in Platform.shGHSA-9WWX-C723-VM8XMediumezsystems/ezpublish-kernel: eZ Platform REST API returns list of all SiteAccessesGHSA-6XCH-2VXX-5PVRMediumezsystems/ezplatform: eZ Platform Rules to disable executable access are ignored on Platform.sh (eZ Cloud)GHSA-45QM-J4M9-WHV9Highezsystems/ezplatform: eZ Platform CSRF token in login form is disabled by default

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo