Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2023-0323Mediumpimcore/pimcore: pimcore is vulnerable to cross-site scripting via "title field " in data objectsCVE-2023-22731Criticalshopware/platform: Shopware vulnerable to Improper Control of Generation of Code in Twig rendered viewsCVE-2023-22730Mediumshopware/platform: Shopware vulnerable to Improper Input Validation of Clearance sale in cartCVE-2010-10008Mediumsimplesamlphp/simplesamlphp-module-openidprovider: simplesamlphp-module-openidprovider Cross Site Scripting vulnerabilityCVE-2016-15020Criticalliftkit/database: SQL Injection in liftkit/databaseCVE-2023-0316Mediumfroxlor/froxlor: Froxlor is vulnerable to path traversalCVE-2023-0315Highfroxlor/froxlor: Froxlor vulnerable to Command InjectionCVE-2023-0307Mediumthorsten/phpmyfaq: phpMyFAQ has Weak Password RequirementsCVE-2023-0306Mediumthorsten/phpmyfaq: phpMyFAQ Stored Cross-site Scripting vulnerabilityCVE-2023-0308Mediumthorsten/phpmyfaq: phpMyFAQ Stored Cross-site Scripting vulnerabilityCVE-2023-0309Mediumthorsten/phpmyfaq: phpMyFAQ Stored Cross-site Scripting vulnerabilityCVE-2023-0310Mediumthorsten/phpmyfaq: phpMyFAQ Stored Cross-site Scripting vulnerabilityCVE-2023-0313Mediumthorsten/phpmyfaq: phpMyFAQ Stored Cross-site Scripting vulnerabilityCVE-2023-0312Mediumthorsten/phpmyfaq: thorsten/phpmyfaq is vulnerable to cross-site scripting (XSS)CVE-2023-0311Criticalthorsten/phpmyfaq: phpMyFAQ Improper Authentication vulnerabilityCVE-2023-0314Mediumthorsten/phpmyfaq: phpMyFAQ Reflected Cross-site Scripting vulnerabilityCVE-2023-0298Mediumgrumpydictator/firefly-iii: Improper Authorization in grumpydictator/firefly-iiiGHSA-M95X-M25C-W9MPMediumphpxmlrpc/phpxmlrpc: XML-RPC for PHP allows access to local files via malicious argument to the Client::send methodGHSA-7VCX-V65Q-9WPGMediumphpxmlrpc/phpxmlrpc: XML-RPC for PHP's `Wrapper::buildClientWrapperCode` method allows code injection via malicious `$client` argumentGHSA-PXQJ-XRV5-QVJFMediumphpxmlrpc/phpxmlrpc: XML-RPC for PHP's debugger vulnerable to possible XSS attackCVE-2023-22489Lowflarum/core: Any Flarum user including unactivated can reply in public discussions whose first post was permanently deletedCVE-2023-22488Mediumflarum/core: Flarum notifications can leak restricted contentCVE-2023-22487Highflarum/mentions: Flarum post mentions can be used to read any post on the forum without access controlGHSA-7M9R-RQ9J-WMMHMediumpocketmine/pocketmine-mp: PocketMine-MP vulnerable to denial-of-service by sending large modal form responsesGHSA-WQQV-JCFR-9F5GHighpocketmine/pocketmine-mp: PocketMine-MP has improperly handled dye colour IDs in banner NBT, leading to server crash

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo