Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-GM98-G2WF-7C68Mediumamphp/artax: amphp/artax Cookie leakage to wrong origins and non-restricted cookie acceptance GHSA-8JP9-MPV9-98RJMediumamphp/http-client: amphp/http-client Header leakage on cross-domain redirects GHSA-87MP-XC4X-X8RHMediumasymmetricrypt/asymmetricrypt: asymmetricrypt/asymmetricrypt Padding Oracle Vulnerability in RSA Encryption GHSA-32RX-XVVR-4XV9Highalterphp/easyadmin-extension-bundle: easyadmin-extension-bundle action case insensitivity GHSA-H63C-XVPF-264JCriticaladodb/adodb-php: ADOdb SQL injection vulnerability GHSA-77MV-MP2J-GXXHHigh3f/pygmentize: pygmentize Remote Code Execution CVE-2020-35125Criticalmautic/core: Mautic is vulnerable to XSS vulnerability CVE-2024-34082Highgetgrav/grav: Grav Vulnerable to Arbitrary File Read to Account Takeover CVE-2024-31556Mediumreportico-web/reportico: Reportico Web fails to invalidate cookies upon logout CVE-2024-34717Mediumprestashop/prestashop: Anonymous PrestaShop customer can download other customers' invoices CVE-2024-34716Criticalprestashop/prestashop: PrestaShop cross-site scripting via customer contact form in FO, through file upload CVE-2024-34358Mediumtypo3/cms-core: TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController CVE-2024-34357Mediumtypo3/cms-core: TYPO3 vulnerable to Cross-Site Scripting in the ShowImageController CVE-2024-34356Mediumtypo3/cms-core: TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module CVE-2024-34355Lowtypo3/cms-core: TYPO3 vulnerable to an HTML Injection in the History Module CVE-2024-34914Mediumphp-censor/php-censor: PHP Censor uses a weak hashing algorithm for the remember me key CVE-2024-4825Criticalcockpit-hq/cockpit: Cockpit CMS contains an arbitrary file upload vulenrability CVE-2024-34081Mediummantisbt/mantisbt: Mantis Bug Tracker (MantisBT) vulnerable to cross-site scripting CVE-2024-34080Mediummantisbt/mantisbt: MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor CVE-2024-34077Highmantisbt/mantisbt: Mantis Bug Tracker (MantisBT) allows user account takeover in the signup/reset password process CVE-2024-29376Mediumsylius/sylius: Sylius has potential Cross Site Scripting vulnerability via the "Province" field in the Checkout and Address Book CVE-2024-34349Mediumsylius/sylius: Sylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) in Admin Panel CVE-2024-34070Criticalfroxlor/froxlor: Blind XSS Leading to Froxlor Application Compromise CVE-2024-4596Lowkimai/kimai: Kimai information disclosure vulnerability CVE-2024-34515Highspatie/image-optimizer: image-optimizer allows PHAR deserialization

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.