Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-8409Lowconcrete5/concrete5: Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete CVE-2026-8412Lowconcrete5/concrete5: Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache CVE-2026-8337Mediumconcrete5/concrete5: Concrete CMS is vulnerable to IDOR in surveys CVE-2026-8415Lowconcrete5/concrete5: Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder CVE-2026-8245Mediumconcrete5/concrete5: Concrete CMS is Vulnerable to Reflected XSS in Legacy Pagination CVE-2026-8414Lowconcrete5/concrete5: Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate CVE-2026-8411Lowconcrete5/concrete5: Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete CVE-2026-8240Mediumconcrete5/concrete5: Concrete CMS is vulnerable to unauthenticated page metadata disclosure CVE-2026-8239Mediumconcrete5/concrete5: Concrete CMS is vulnerable to IDOR CVE-2026-7890Lowconcrete5/concrete5: Concrete CMS's RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation CVE-2026-8238Mediumconcrete5/concrete5: Concrete CMS is vulnerable to IDOR CVE-2026-7887Lowconcrete5/concrete5: Concrete CMS: OAuth 2.0 Authorization-Code Handler Bypasses Account Status CVE-2026-8139Lowconcrete5/concrete5: Concrete CMS is vulnerable to Stored XSS via external-link page cvName CVE-2026-7881Mediumconcrete5/concrete5: Concrete CMS is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block CVE-2026-8237Mediumconcrete5/concrete5: Concrete CMS is vulnerable to IDOR CVE-2026-7879Mediumconcrete5/concrete5: Concrete CMS has an unauthorized file access issue CVE-2026-8327Mediumconcrete5/concrete5: Concrete CMS has a session-hardening bypass and allows password change without reauthorization CVE-2026-8236Mediumconcrete5/concrete5: Concrete CMS is vulnerable to IDOR combined with a missing authentication gate CVE-2026-7882Lowconcrete5/concrete5: Concrete CMS is vulnerable to unauthorized file deletion CVE-2026-7886Lowconcrete5/concrete5: Concrete CMS is vulnerable to IDOR in AddMessage/UpdateMessage CVE-2026-46640Hightwig/twig: Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation CVE-2026-46639Hightwig/twig: Twig: Sandbox property and method bypass via object-destructuring assignment CVE-2026-8426Highconcrete5/concrete5: Concrete CMS does not validate a CSRF token before processing requests to `/dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>`CVE-2026-8421Highconcrete5/concrete5: Concrete CMS contains a CSRF vulnerability CVE-2026-8428Highconcrete5/concrete5: Concrete CMS is Vulnerable to Cross-Site Request Forgery

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo