Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2015-5467Criticalyiisoft/yii2: Yii2 allows attackers to execute any local .php file via a relative path in the view parameter CVE-2018-5478Mediumcontao/core: Contao Cross-site Scripting vulnerabililty CVE-2015-8371Highcomposer/composer: Composer allows cache poisoning from other projects built on the same host CVE-2023-38888Criticaldolibarr/dolibarr: Cross Site Scripting vulnerability in Dolibarr ERP CRM CVE-2023-38887Highdolibarr/dolibarr: File Upload vulnerability in Dolibarr ERP CRM CVE-2023-38886Highdolibarr/dolibarr: Dolibarr allows a remote privileged attacker to execute arbitrary code via a crafted command/script CVE-2023-5060Highlibrenms/librenms: Cross site scripting in librenms CVE-2023-37611Mediumneos/media-browser: Neos CMS Cross Site Scripting vulnerability CVE-2022-24093Mediummagento/community-edition: Magento Open Source affected by Improper Input Validation CVE-2023-4982Mediumlibrenms/librenms: LibreNMS Cross-site Scripting vulnerability CVE-2023-4981Mediumlibrenms/librenms: LibreNMS Cross-site Scripting vulnerability CVE-2023-4978Mediumlibrenms/librenms: LibreNMS Cross-site Scripting vulnerability CVE-2023-4980Mediumlibrenms/librenms: LibreNMS Cross-site Scripting vulnerability CVE-2023-4977Mediumlibrenms/librenms: LibreNMS Code Injection vulnerability CVE-2023-4979Mediumlibrenms/librenms: LibreNMS Cross-site Scripting vulnerability CVE-2023-41592Mediumfroala/wysiwyg-editor: Froala Editor Cross-site Scripting vulnerability GHSA-92JH-GWCH-JQ38Highpocketmine/pocketmine-mp: PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (again)GHSA-79RC-JJH6-RC89Highpocketmine/pocketmine-mp: PocketMine-MP server crash due to incorrect EC curve used for LoginPacket identityPublicKey CVE-2023-41892Criticalcraftcms/cms: Craft CMS Remote Code Execution vulnerability CVE-2023-4914Highcecil/cecil: Cecil Path Traversal vulnerability CVE-2023-4913Mediumcecil/cecil: Cecil Cross-site Scripting vulnerability CVE-2023-41879Highopenmage/magento-lts: Magento LTS's guest order "protect code" can be brute-forced too easily CVE-2023-41336Mediumsymfony/ux-autocomplete: Prevent injection of invalid entity ids for "autocomplete" fields CVE-2023-41564Mediumcockpit-hq/cockpit: Cockpit CMS arbitrary file upload vulnerability CVE-2023-41330Criticalknplabs/knp-snappy: Snappy PHAR deserialization vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo