Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2023-44401Mediumsilverstripe/graphql: View permissions are bypassed for paginated lists of ORM data CVE-2024-22407Mediumshopware/core: Broken Access Control order API in Shopware CVE-2024-22406Criticalshopware/core: Blind SQL injection in shopware CVE-2023-36236Mediumbagisto/bagisto: Cross-site Scripting in Bagisto CVE-2024-22362Mediumdrupal/core: Drupal Denial of Service vulnerability CVE-2024-23173Mediummediawiki/cargo: MediaWiki Cargo Extension Cross-site Scripting vulnerability CVE-2019-6342Criticaldrupal/core: Drupal Improper Access Control CVE-2023-50172Mediumwwbn/avideo: WWBN AVideo recovery notification bypass vulnerability CVE-2023-49599Criticalwwbn/avideo: WWBN AVideo Insufficient Entropy vulnerbaility CVE-2023-49810Highwwbn/avideo: WWBN AVideo Improper Restriction of Excessive Authentication Attempts vulnerability CVE-2024-21667Mediumpimcore/customer-management-framework-bundle: Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access GDPR extracts CVE-2024-21666Mediumpimcore/customer-management-framework-bundle: Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access customers duplicates list CVE-2024-21665Mediumpimcore/ecommerce-framework-bundle: Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders list CVE-2023-46906Mediumjuzaweb/cms: juzawebCMS Incorrect Access Control vulnerability CVE-2024-21641Mediumflarum/core: Flarum's logout Route allows open redirects CVE-2024-22075Mediumgrumpydictator/firefly-iii: Firefly III allows webhooks HTML Injection.CVE-2023-6551Mediumverot/class.upload.php: class.upload.php allows cross-site scripting attacks via uploaded files CVE-2023-50256Highfroxlor/froxlor: Froxlor username/surname AND company field Bypass CVE-2024-21622Mediumcraftcms/cms: Craft CMS Privilege Escalation CVE-2024-21628Mediumprestashop/prestashop: PrestaShop XSS can be stored in DB from "add a message form" in order detail page (FO)CVE-2024-21627Highprestashop/prestashop: PrestaShop some attribute not escaped in Validate::isCleanHTML method CVE-2023-46308Criticalplotly/plotly.js: plotly.js prototype pollution vulnerability CVE-2020-26625Lowgilacms/gila: Gila CMS SQL Injection vulnerability CVE-2020-26624Lowgilacms/gila: Gila CMS SQL Injection vulnerability CVE-2020-26623Mediumgilacms/gila: Gila CMS SQL Injection

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.