Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2024-29338Mediumanchorcms/anchor-cms: Cross-Site Request Forgery in Anchor CMSCVE-2024-29186Mediumbref/bref: Slow String Operations via MultiPart Requests in Event-Driven FunctionsCVE-2024-28861Mediumfriendsofsymfony1/symfony1: Gadget chain in Symfony 1 due to uncontrolled unserialized input in sfNamespacedParameterHolderCVE-2024-28119Highgetgrav/grav: Server Side Template Injection (SSTI) via Twig escape handlerCVE-2024-28118Highgetgrav/grav: Server Side Template Injection (SSTI)CVE-2024-28117Highgetgrav/grav: Server Side Template Injection (SSTI)CVE-2024-28116Highgetgrav/grav: Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypassCVE-2024-27921Highgetgrav/grav: Grav File Upload Path TraversalCVE-2024-28593Mediummoodle/moodle: Cross-site Scripting in Moodle ChatCVE-2024-29374Mediummoodle/moodle: Cross site scripting in moodleGHSA-9J39-4686-M3C4Mediumibexa/core: Ibexa Kernel's files with blacklisted extensions can be still saved to draftsGHSA-MWVH-P3HX-X4GGMediumezsystems/ezplatform-kernel: Ibexa Kernel's files with blacklisted extensions can be still saved to draftsCVE-2024-21504Mediumlivewire/livewire: Cross-site Scripting in livewire/livewireCVE-2024-28864Lowilicmiljan/secure-props: [TagAwareCipher] - Decryption Failure (Regex Match)CVE-2024-28859Mediumfriendsofsymfony1/symfony1: Gadget chain in Symfony 1 due to vulnerable Swift Mailer dependencyCVE-2024-2497Mediumbillz/raspap-webgui: RaspAP Vulnerable to Code Injection via an Unknown Process in File `includes/provider.php`CVE-2023-36238Mediumbagisto/bagisto: Bagisto vulnerable to Insecure Direct Object Reference (IDOR)CVE-2024-28754Highbillz/raspap-webgui: raspap-webgui vulnerable to denial of serviceGHSA-H6J3-J35F-V2X7Highpocketmine/pocketmine-mp: PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (3rd time)GHSA-XC7J-WJ36-QJFRHighpocketmine/pocketmine-mp: PocketMine-MP BookEditPacket crash when inventory slot in the packet is invalidCVE-2024-27923Highgetgrav/grav: Remote Code Execution by uploading a phar file using frontmatterCVE-2024-27917Highshopware/storefront: Shopware's session is persistent in Cache for 404 pagesCVE-2024-2179Lowconcrete5/concrete5: Concrete CMS Stored Cross-site Scripting vulnerabilityCVE-2024-27915Mediumsulu/sulu: Sulu grants access to pages regardless of role permissionsCVE-2024-27499Mediumbagisto/bagisto: Bagist Cross-site Scripting vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo