Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2023-27237Mediumlavalite/cms: LavaLite CMS vulnerable to host header injection attackCVE-2023-2630Mediumpimcore/pimcore: Pimcore Cross-site Scripting (XSS) vulnerability in Admin TranslationsCVE-2023-2629Highpimcore/customer-management-framework-bundle: Embedding untrusted input inside CSV files leads to Formula Injection/CSV InjectionCVE-2023-2616Mediumpimcore/pimcore: Pimcore Cross-site Scripting (XSS) in Static Routes name fieldCVE-2023-32075Mediumpimcore/customer-management-framework-bundle: Pimcore vulnerable to Business Logic Errors via Customer automation rulesCVE-2023-2614Mediumpimcore/pimcore: Pimcore Cross-site Scripting (XSS) in name field of Custom ReportsCVE-2023-2615Mediumpimcore/pimcore: Pimcore Cross-site Scripting (XSS) in Predefined Properties deleteGHSA-R3FG-3R88-6X3FMediumibexa/user: Ibexa User Settings are accessible on the front-end for anonymous userCVE-2023-2591Highnilsteampassnet/teampass: teampass vulnerable to code injectionCVE-2023-31144Mediumcraftcms/cms: craftcms/cms vulnerable to cross site scripting in RSS feed widgetCVE-2023-2516Mediumnilsteampassnet/teampass: Cross Site Scripting in nilsteampassnet/teampassCVE-2023-2550Highthorsten/phpmyfaq: Cross Site Scripting in thorsten/phpmyfaqCVE-2023-2427Mediumthorsten/phpmyfaq: Cross Site Scripting in thorsten/phpmyfaqCVE-2023-2531Criticalazuracast/azuracast: AzuraCast missing brute force preventionCVE-2023-30943Mediummoodle/moodle: Moodle External Control of File Name or Path vulnerabilityCVE-2023-30944Highmoodle/moodle: Moodle SQL Injection vulnerabilityCVE-2023-29918Mediumfrancoisjacquet/rosariosis: RosarioSIS vulnerable to CSV InjectionCVE-2023-30855Mediumpimcore/pimcore: Pimcore Path Traversal Vulnerability in AdminBundle/Controller/Reports/CustomReportController.phpCVE-2023-30860Highwwbn/avideo: WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's accountCVE-2023-2361Mediumpimcore/pimcore: Cross-site Scripting (XSS) in pimcoreCVE-2023-2429Mediumthorsten/phpmyfaq: phpMyFAQ Improper Access Control vulnerabilityCVE-2023-2428Mediumthorsten/phpmyfaq: phpMyFAQ vulnerable to Stored Cross-site ScriptingCVE-2023-28821Mediumconcrete5/concrete5: Missing rate limit for password resetsCVE-2023-28820Lowconcrete5/concrete5: Stored cross site scripting in RSS displayerCVE-2023-28477Mediumconcrete5/concrete5: Stored cross site scripting on API integration

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo