Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-5394Highpimcore/pimcore: Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/saveCVE-2026-46644Lowsymfony/polyfill: symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded formCVE-2026-45756Lowsymfony/json-path: Symfony's JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoSCVE-2026-45755Mediumsymfony/mailtrap-mailer: Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event InjectionCVE-2026-45754Mediumsymfony/lox24-notifier: Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event InjectionCVE-2026-45753Lowsymfony/html-sanitizer: Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS)CVE-2026-45704Highpimcore/pimcore: Pimcore has a CustomReports Share BypassCVE-2026-45703Mediumpimcore/pimcore: Pimcore has a WordExport Authorization Bypass for Unauthorized Document ExportCVE-2026-45305Lowsymfony/yaml: Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() RegexCVE-2026-45304Lowsymfony/yaml: Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")CVE-2026-45133Lowsymfony/yaml: Symfony hardened the parser when handling untrusted inputCVE-2026-45332Highautomad/automad: Automad has Broken Access Control: Unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpointCVE-2026-45077Highsymfony/monolog-bridge: Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log ListenerCVE-2026-45075Highsymfony/http-kernel: Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]CVE-2026-45074Mediumsymfony/security-http: Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket ReplayCVE-2026-45073Mediumsymfony/cache: Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefixCVE-2026-45072Lowsymfony/symfony: Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File RenderingCVE-2026-45071Lowsymfony/dom-crawler: Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = trueCVE-2026-45070Mediumsymfony/mime: Symfony has Email Header Injection via Non-Token Characters in Mime Parameter NamesCVE-2026-45069Mediumsymfony/security-http: Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp ClaimsCVE-2026-45068Mediumsymfony/mailer: Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient AddressCVE-2026-45067Highsymfony/mime: Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\AddressCVE-2026-45066Mediumsymfony/html-sanitizer: Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> MisclassificationCVE-2026-45064Mediumsymfony/html-sanitizer: Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href SpoofingCVE-2026-45368Highgetkirby/cms: Kirby CMS vulnerable to cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo