Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2023-0780Mediumcockpit-hq/cockpit: Improper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpitCVE-2023-24230Mediumgetformwork/formwork: Formwork Cross-site Scripting (XSS) from Page title fieldCVE-2015-10077Criticalwebbuilders-group/silverstripe-kapost-bridge: SQL injection in webbuilders-group silverstripe-kapost-bridgeCVE-2023-0759Highcockpit-hq/cockpit: privilege chaining in cockpit-hq/cockpitCVE-2023-24814Hightypo3/cms-core: TYPO3 is vulnerable to Cross-Site Scripting via frontend renderingCVE-2022-45982Criticaltopthink/think: Deserialization of Untrusted Data in thinkphpCVE-2023-0735Mediumwallabag/wallabag: Cross-Site Request Forgery (CSRF) in wallabag/wallabagCVE-2023-0736Mediumwallabag/wallabag: Cross-site Scripting (XSS) in wallabag/wallabag CVE-2023-24813Criticaldompdf/dompdf: URI validation failure on SVG parsing. Bypass of CVE-2023-23924CVE-2015-10073Criticaltinymighty/wiki-seo: tinymighty WikiSEO is vulnerable to cross-site scripting via modifyHTML functionCVE-2017-20175Mediummediawiki/matomo: Cross-site Scripting in DaSchTour matomo-mediawiki-extensionCVE-2018-25080Mediummobiledetect/mobiledetectlib: Cross-site Scripting in MobileDetectCVE-2023-0671Highfroxlor/froxlor: froxlor is vulnerable to privilege escalation from customer to root via directory-optionsCVE-2023-23941Highswag/paypal: Payment information sent to PayPal not necessarily identical to created orderCVE-2021-37502Mediumautomad/automad: Cross site scripting in automad/automadCVE-2023-0610Mediumwallabag/wallabag: wallabag subject to Improper Authorization via annotationsCVE-2023-0609Mediumwallabag/wallabag: wallabag contains Improper Authorization via export featureCVE-2023-23937Mediumpimcore/pimcore: Pimcore contains Unrestricted Upload of File with Dangerous TypeCVE-2023-25014Highin2code/femanager: Broken Access Control in 3rd party TYPO3 extension "femanager"CVE-2023-25013Highin2code/femanager: Broken Access Control in 3rd party TYPO3 extension "femanager"CVE-2023-25313Criticalwwbn/avideo: AVideo contains Command injection when embedding a video linkCVE-2022-24894Mediumsymfony/http-kernel: Symfony storing cookie headers in HttpCacheCVE-2022-24895Mediumsymfony/security-bundle: Symfony vulnerable to Session Fixation of CSRF tokensCVE-2023-0608Mediummicroweber/microweber: Microweber contains Cross-site ScriptingCVE-2023-23924Criticaldompdf/dompdf: Dompdf vulnerable to URI validation failure on SVG parsing

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo