Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2021-36023Criticalmagento/project-community-edition: Magento XML Injection vulnerability in the Widgets Update Layout CVE-2021-36036Criticalmagento/project-community-edition: Magento improper access control vulnerability within Magento's Media Gallery Upload workflow CVE-2021-36021Criticalmagento/project-community-edition: Magento affected by remote code execution vulnerability in the CMS page scheduled update feature CVE-2023-38970Mediumuasoft-indonesia/badaso: Badaso vulnerable to cross-site scripting CVE-2021-32050Mediummongodb/mongodb: MongoDB Driver may publish events containing authentication-related data CVE-2023-41005Highpagekit/pagekit: Command injection in pagekit CVE-2023-39062Mediumspipu/html2pdf: Spipu HTML2PDF vulnerable to cross-site scripting GHSA-JXCX-3H54-QQXXMediumsilverstripe/admin: SilverStripe CMS Cross-site Scripting vulnerabilities inherited from TinyMCE CVE-2023-41100Mediumwaldhacker/hcaptcha: hCaptcha for EXT:form Broken Access Control vulnerability CVE-2023-4453Mediumpimcore/pimcore: Pimcore Cross-site Scripting (XSS) vulnerability in DataObject datetime fields CVE-2023-4454Mediumwallabag/wallabag: Wallabag user can reset data unintentionally CVE-2023-4455Mediumwallabag/wallabag: Wallabag user can delete own API client unintentionally CVE-2023-40035Highcraftcms/cms: Craft CMS vulnerable to Remote Code Execution via validatePath bypass CVE-2023-4451Mediumcockpit-hq/cockpit: Cockpit Cross-site Scripting vulnerability CVE-2023-4433Highcockpit-hq/cockpit: Cockpit Cross-site Scripting vulnerability CVE-2023-4432Highcockpit-hq/cockpit: Cockpit Cross-site Scripting vulnerability CVE-2023-4422Mediumcockpit-hq/cockpit: Cockpit Cross-site Scripting vulnerability CVE-2023-4395Highcockpit-hq/cockpit: Cockpit Cross-site Scripting vulnerability CVE-2023-40033Highflarum/core: Flarum vulnerable to LFI and Blind SSRF via Avatar upload CVE-2023-4347Highlibrenms/librenms: LibreNMS Cross-site Scripting vulnerability CVE-2023-4321Highcockpit-hq/cockpit: Cockpit Cross-site Scripting vulnerability CVE-2020-25915Mediumthinkcmf/thinkcmf: ThinkCMF Cross-site Scripting Vulnerability CVE-2020-20523Mediumgilacms/gila: Gila CMS Cross-site Scripting Vulnerability CVE-2023-4304Lowfroxlor/froxlor: Froxlor vulnerable to business logic errors CVE-2023-39530Mediumprestashop/prestashop: PrestaShop file deletion via CustomerMessage

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo