Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2022-3004Mediumyetiforce/yetiforce-crm: YetiForce CRM vulnerable to stored Cross-site Scripting via WorkFlow moduleCVE-2022-3245Mediummicroweber/microweber: Microweber vulnerable to HTML Injection in create tag functionalityCVE-2022-38916Criticalpagekit/pagekit: Pagekit vulnerable to Unrestricted Upload of File with Dangerous TypeCVE-2022-3173Mediumsnipe/snipe-it: Snipe-IT vulnerable to Improper AuthenticationCVE-2022-3231Mediumlibrenms/librenms: LibreNMS stored Cross-site Scripting via Schedule Maintenance `Title` parameterCVE-2022-37250Mediumcraftcms/cms: Craft CMS Stored Cross-site Scripting in User Addresses TitleCVE-2022-37248Mediumcraftcms/cms: Craft CMS Cross site Scripting vulnerabilityCVE-2022-37251Mediumcraftcms/cms: Craft CMS vulnerable to Cross-site Scripting via entry revisions and draftsCVE-2022-37247Mediumcraftcms/cms: Craft CMS vulnerable to stored Cross-site Scripting via /admin/settings/fields pageCVE-2022-36101Mediumshopware/shopware: Shopware contains sensitive data in backend customer moduleCVE-2022-36102Mediumshopware/shopware: Shopware access control list bypassed via crafted specific URLsCVE-2022-36020Mediumtypo3/html-sanitizer: TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting ProtectionCVE-2022-36032Mediumreact/http: ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sentCVE-2022-36104Mediumtypo3/cms-core: TYPO3 CMS vulnerable to Denial of Service in Page Error HandlingCVE-2022-36105Mediumtypo3/cms-core: TYPO3 CMS vulnerable to User Enumeration via Response TimingCVE-2022-36106Mediumtypo3/cms-core: TYPO3 CMS missing check for expiration time of password reset token for backend usersCVE-2022-36107Mediumtypo3/cms-core: TYPO3 CMS Stored Cross-Site Scripting via FileDumpControllerCVE-2022-36108Mediumtypo3/cms-core: TYPO3 CMS vulnerable to Cross-Site Scripting in <f:asset.css> view helperCVE-2018-25047Mediumsmarty/smarty: Smarty Cross-site Scripting vulnerability in pages that use smarty_function_mailtoCVE-2022-38352Criticaltopthink/framework: ThinkPHP deserialization vulnerabilityCVE-2022-3211Mediumpimcore/pimcore: Pimcore vulnerable to stored stored Cross-site Scripting via`properties` when creating new usersGHSA-GQQF-G5R7-84VFMediumtypo3/cms-core: TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting ProtectionCVE-2022-38796Mediumfeehi/cms: Feehi CMS host header injection vulnerabilityCVE-2022-40734Mediumunisharp/laravel-filemanager: UniSharp Laravel Filemanager directory traversal vulnerabilityCVE-2021-36568Mediummoodle/moodle: Moodle Cross-site Scripting vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo