Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2024-1245Lowconcrete5/concrete5: Concrete CMS vulnerable to stored XSS in file tags and description attributes CVE-2024-1247Lowconcrete5/concrete5: Concrete CMS vulnerable to stored XSS via the Role Name field CVE-2023-31506Mediumgetgrav/grav: Cross-site scripting (XSS) vulnerability in Grav CVE-2023-25365Highoctober/october: October CMS Cross-site Scripting vulnerability CVE-2024-24821Highcomposer/composer: Composer code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php CVE-2024-24822Mediumpimcore/admin-ui-classic-bundle: Pimcore Admin Classic Bundle permissions are not getting checked when working with tags CVE-2024-24815Mediumckeditor4: CKEditor4 Cross-site Scripting vulnerability caused by incorrect CDATA detection CVE-2024-24807Lowsulu/sulu: Sulu HTML Injection via Autocomplete Suggestion CVE-2024-24574Mediumphpmyfaq/phpmyfaq: phpMyFAQ vulnerable to stored XSS on attachments filename CVE-2024-22208Mediumphpmyfaq/phpmyfaq: phpMyFAQ sharing FAQ functionality can easily be abused for phishing purposes CVE-2024-22202Mediumphpmyfaq/phpmyfaq: phpMyFAQ User Removal Page Allows Spoofing Of User Details CVE-2006-5734Mediumphpmailer/phpmailer: PHPMailer Local file inclusion CVE-2007-3215Highphpmailer/phpmailer: PHPMailer Shell command injection CVE-2024-24754Lowbref/bref: Bref vulnerable to Body Parsing Inconsistency in Event-Driven Functions CVE-2024-24753Mediumbref/bref: Bref Doesn't Support Multiple Value Headers in ApiGatewayFormatV2 CVE-2024-24752Mediumbref/bref: Bref's Uploaded Files Not Deleted in Event-Driven Functions CVE-2024-24570Highstatamic/cms: Statmic CMS vulnerable to account takeover via XSS and password reset link GHSA-29W6-C52G-M8JCMediumgrumpydictator/firefly-iii: C5 Firefly III CSV Injection.CVE-2023-36259Mediumsuperbig/craft-audit: Craft CMS Audit Plugin Cross Site Scripting vulnerability CVE-2023-36260Highcraftcms/cms: Craft CMS Feed-Me CVE-2023-24676Highprocesswire/processwire: Arbitrary Code Execution in Processwire CVE-2024-23648Highpimcore/admin-ui-classic-bundle: Host header injection in the password reset CVE-2024-23646Highpimcore/admin-ui-classic-bundle: SQL Injection in Admin download files as zip CVE-2023-49783Mediumsilverstripe/admin: No permission checks for editing/deleting records with CSV import form CVE-2023-48714Mediumsilverstripe/framework: Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.