Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2022-3002Mediumyetiforce/yetiforce-crm: YetiForce CRM vulnerable to stored Cross-site ScriptingCVE-2022-40316Mediummoodle/moodle: Moodle No groups filtering in H5P activity attempts reportCVE-2022-40313Highmoodle/moodle: Moodle Stored Cross-site Scripting and page denial of serviceCVE-2022-40315Criticalmoodle/moodle: Moodle Minor SQL injection risk in admin user browsingCVE-2022-40314Criticalmoodle/moodle: Moodle remote code executionCVE-2022-39261Hightwig/twig: Twig may load a template outside a configured directory when using the filesystem loaderCVE-2022-40408Mediumfeehi/feehicms: FeehiCMS vulnerable to Cross-Site scripting via crafted payloadCVE-2021-40693Mediummoodle/moodle: Moodle type juggling vulnerabilityCVE-2021-40692Mediummoodle/moodle: Moodle Incorrect AuthorizationCVE-2021-40691Mediummoodle/moodle: Moodle Improper AuthenticationCVE-2021-40694Mediummoodle/moodle: Moodle Improper Encoding or Escaping of OutputCVE-2021-40695Mediummoodle/moodle: Moodle Exposure of Sensitive Information to an Unauthorized ActorCVE-2022-38975Mediumec-cube/ec-cube: EC-CUBE DOM-based cross-site scripting vulnerabilityCVE-2022-40199Lowec-cube/ec-cube: EC-CUBE Directory traversal vulnerabilityCVE-2022-40043Highcentreon/centreon: Centreon SQL Injection vulnerability via esc_name parameterCVE-2022-40044Mediumcentreon/centreon: Centreon contains cross-site scripting vulnerability via esc_name parameterCVE-2022-41343Highdompdf/dompdf: Dompdf allows remote file inclusion because URI validation failure does not halt font registrationCVE-2022-34026Highicecoder/icecoder: ICEcoder vulnerable to Path TraversalCVE-2022-3255Mediumpimcore/pimcore: Pimcore vulnerable to cross site scriptingCVE-2022-37246Mediumcraftcms/cms: Craft CMS Cross-site Scripting vulnerabilityCVE-2022-38073Mediumawesome-support/awesome-support: Awesome Support vulnerable to persistent cross-site scriptingCVE-2022-3000Mediumyetiforce/yetiforce-crm: YetiForce CRM vulnerable to stored Cross-site Scripting via LayoutEditor moduleCVE-2022-3242Mediummicroweber/microweber: Microweber Cross-site Scripting can result in redirection to a malicious siteCVE-2022-3005Mediumyetiforce/yetiforce-crm: YetiForce CRM vulnerable to stored Cross-site Scripting via SlaPolicy moduleCVE-2022-2924Mediumyetiforce/yetiforce-crm: YetiForce CRM vulnerable to stored Cross-site Scripting via WidgetsManagement module

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo