Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2022-3765Mediumthorsten/phpmyfaq: phpMyFAQ vulnerable to stored Cross-site ScriptingCVE-2022-3766Mediumthorsten/phpmyfaq: phpMyFAQ vulnerable to reflected Cross-site ScriptingCVE-2022-3754Criticalthorsten/phpmyfaq: phpMyFAQ contains Weak Password RequirementsCVE-2022-39365Criticalpimcore/pimcore: RCE vulnerability in Pimcore/Mail & Dynamic Text LayoutCVE-2022-39357Highwintercms/winter: Prototype pollution in Snowboard frameworkCVE-2022-41711Criticalbadaso/core: Badaso vulnerable to Remote Code Execution via malicious file uploadCVE-2022-25849Mediumjoyqi/hyper-down: HyperDown vulnerable to Cross-site ScriptingCVE-2022-42344Highmagento/community-edition: Magento Improper input validation vulnerabilityCVE-2022-3608Highthorsten/phpmyfaq: phpMyFAQ vulnerable to Cross-site ScriptingCVE-2022-42188Highlavalite/cms: Lavalite vulnerable to Arbitrary File Read via Directory TraversalCVE-2022-39315Mediumgetkirby/cms: Kirby CMS vulnerable to user enumeration in the brute force protectionCVE-2022-39314Mediumgetkirby/cms: Kirby CMS vulnerable to user enumeration in the code-based login and password reset formsCVE-2022-31037Mediumoro/commerce: OroCommerce Cross site scripting vulnerability during shipping rule editing for UPS integrationCVE-2022-35689Mediummagento/community-edition: Magento Open Source allows Improper Access ControlCVE-2022-35698Highmagento/community-edition: Magento Open Source allows Stored Cross-Site Scripting (Stored XSS)CVE-2022-35944Highoctober/system: October CMS Safe Mode bypass leads to authenticated Remote Code ExecutionCVE-2022-40871Criticaldolibarr/dolibarr: Dolibarr vulnerable to Eval InjectionCVE-2022-39296Highmelisplatform/melis-asset-manager: melisplatform/melis-asset-manager vulnerable to Path TraversalCVE-2022-39297Highmelisplatform/melis-cms: melisplatform/melis-cms vulnerable to deserialization of untrusted dataCVE-2022-39298Highmelisplatform/melis-front: melisplatform/melis-front vulnerable to deserialization of untrusted dataCVE-2022-42092Highbackdrop/backdrop: Backdrop CMS Unrestricted File Upload vulnerabilityCVE-2012-0796Highphpmailer/phpmailer: PHPMailer vulnerable to email header injectionCVE-2022-39284Lowcodeigniter4/framework: Codeigniter4's Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issuedCVE-2018-17057Criticaltecnickcom/tcpdf: TCPDF vulnerable to attackers triggering deserialization of arbitrary dataCVE-2022-2986Highmoodle/moodle: Moodle Cross-Site Request Forgery (CSRF)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo