Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-47696HighWWBN/AVideo: WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpointCVE-2026-47694MediumWWBN/AVideo: WWBN AVideo: Stored XSS via unescaped Gallery category descriptionCVE-2026-52793Highfroxlor/froxlor: Froxlor's API Authentication bypasses 2FA AuthenticationCVE-2026-7888Highconcrete5/concrete5: Concrete CMS is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set componentsCVE-2026-41234Highfroxlor/froxlor: Froxlor: BIND Zone File Injection via TXT Record ContentCVE-2022-31114Mediumbackpack/crud: backpack/crud is vulnerable to Cross-Site Scripting (XSS)CVE-2026-10215Lowdolibarr/dolibarr: Dolibarr ERP CRM is vulnerable to Improper Authorization through its Leave Request REST APICVE-2026-47266Highverbb/formie: formie's unauthenticated front-end submission editing can overwrite existing submissionsCVE-2026-47233Mediumadmidio/admidio: Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024CVE-2026-47234Mediumadmidio/admidio: Admidio writes session IDs and auto-login cookie values to application logsCVE-2026-47232Mediumadmidio/admidio: Admidio PKCS#12 private key export action lacks CSRF protectionCVE-2026-47231Highadmidio/admidio: Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private foldersCVE-2026-47230Mediumadmidio/admidio: Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploadersCVE-2026-47229Mediumadmidio/admidio: Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validationCVE-2026-47228Mediumadmidio/admidio: Admidio's CSRF in registration `send_login` mode resets arbitrary user passwordsCVE-2026-47227Mediumadmidio/admidio: Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in…CVE-2026-47226Mediumadmidio/admidio: Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privilegesCVE-2026-47212Mediumsymfony/symfony: Symfony: Twilio SMS Notifier allows unauthenticated webhook injection due to missing X-Twilio-Signature verificationCVE-2026-48557Highspatie/laravel-medialibrary: Spatie Laravel Media Library contains a file upload restriction bypassCVE-2026-48555Mediumspatie/laravel-medialibrary: Spatie Laravel Media Library contains a server-side request forgery vulnerabilityCVE-2026-47260Highphanan/koel: Koel Vulnerable to SSRF via Podcast Episode Enclosure URLsCVE-2026-38739Highezsystems/ezpublish-legacy: ezsystems/ezpublish-legacy has a SQL injection in dfscleanupCVE-2026-41237Highfroxlor/froxlor: Froxlor has an incomplete fix for CVE-2026-30932CVE-2026-41236Highfroxlor/froxlor: Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` pathCVE-2026-41235Highfroxlor/froxlor: Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo