Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2023-38490Mediumgetkirby/cms: XML External Entity (XXE) vulnerability in the XML data handlerCVE-2023-38491Mediumgetkirby/cms: Cross-site scripting (XSS) from MIME type auto-detection of uploaded filesCVE-2023-38492Mediumgetkirby/cms: Denial of service from unlimited password lengthsCVE-2023-37692Mediumoctober/october: Stored Cross-Site Scripting October CMSGHSA-M8FW-P3CR-6JQCMediumtypo3/cms-rte-ckeditor: Cross-Site Scripting in CKEditor4 WordCount PluginCVE-2023-38500Mediumtypo3/html-sanitizer: By-passing Cross-Site Scripting Protection in HTML SanitizerCVE-2023-38499Lowtypo3/cms-core: Information Disclosure due to Out-of-scope Site ResolutionCVE-2023-36806Mediumcontao/core-bundle: Cross site scripting via input unit widgetCVE-2023-3819Highpimcore/pimcore: Pimcore vulnerable to Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-3820Highpimcore/pimcore: Pimcore vulnerable to SQL Injection in Dataobjects sortingCVE-2023-3822Mediumpimcore/pimcore: Pimcore Cross-site Scripting vulnerabilityCVE-2023-3821Mediumpimcore/pimcore: Pimcore Cross-site Scripting vulnerabilityCVE-2023-37649Highcockpit-hq/cockpit: Cockpit CMS vulnerable to incorrect access controlCVE-2023-37650Highcockpit-hq/cockpit: Cockpit CMS Cross-Site Request Forgery vulnerabilityCVE-2023-37897Highgetgrav/grav: grav Server-side Template Injection (SSTI) mitigation bypassCVE-2023-3700Mediumalextselegidis/easyappointments: Easy!Appointments Improper Access Control vulnerabilityCVE-2023-3692Mediumadmidio/admidio: Admidio vulnerable to Unrestricted Upload of File with Dangerous TypeCVE-2023-37473Highzenstruck/collection: zenstruck/collection passing callable string to EntityRepository::find() and query()GHSA-7WRV-6H42-W54FHighpocketmine/pocketmine-mp: PocketMine-MP vulnerable to server crash using badly formatted sign NBT in BlockActorDataPacketCVE-2023-3673Highpimcore/pimcore: Pimcore SQL Injection vulnerabilityCVE-2023-3668Criticalfroxlor/froxlor: Froxlor vulnerable to Improper Encoding or Escaping of OutputCVE-2023-37785Mediumimpresscms/impresscms: ImpressCMS Cross-site Scripting vulnerabilityCVE-2023-37280Mediumpimcore/admin-ui-classic-bundle: Pimcore admin UI vulnerable to Cross-site Scripting in 2 factor authentication setup pageCVE-2023-36825Criticalorchid/platform: Orchid Deserialization of Untrusted Data vulnerability leads to Remote Code ExecutionCVE-2023-3574Mediumpimcore/customer-management-framework-bundle: Pimcore Customer Management Framework vulnerable to Improper Authorization in Rules Controller

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo