Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2022-2885Mediumyetiforce/yetiforce-crm: Cross site scripting in yetiforce/yetiforce-crm CVE-2022-35692Mediummagento/community-edition: Magento Open Source has Improper Access Control vulnerability CVE-2022-35174Mediumgetkirby/starterkit: Cross site scripting in getkirby/starterkit GHSA-8CWQ-4CMF-PX73Highpocketmine/pocketmine-mp: PocketMine-MP invalid skin geometry JSON data leading to server crash CVE-2022-35943Mediumcodeigniter4/shield: CodeIgniter Shield Vulnerable to SameSite Attackers Bypassing the CSRF Protection CVE-2022-2871Mediumnotrinos/notrinos-erp: NotrinosERP Cross-site Scripting vulnerability CVE-2022-34256Highmagento/community-edition: Magento Improper Authorization vulnerability CVE-2022-34255Highmagento/community-edition: Magento Improper Access Control vulnerability CVE-2022-34258Mediummagento/community-edition: Magento stored Cross-Site Scripting (XSS) vulnerability CVE-2022-34254Highmagento/community-edition: Magento Path Traversal vulnerability CVE-2022-34259Mediummagento/community-edition: Magento Improper Access Control vulnerability CVE-2022-34257Mediummagento/community-edition: Magento stored Cross-Site Scripting (XSS) vulnerability CVE-2022-34253Criticalmagento/community-edition: Magento XML Injection vulnerability in the Widgets Module CVE-2020-14321Highmoodle/moodle: Moodle Incorrect Authorization vulnerability CVE-2020-14320Mediummoodle/moodle: Moodle reflected XSS Vulnerability CVE-2022-2818Highcockpit-hq/cockpit: Cockpit Content Platform vulnerable to 2FA bypass CVE-2022-35587Mediumforkcms/forkcms: ForkCMS XSS via `publish_on_date` parameter CVE-2022-35590Mediumforkcms/forkcms: ForkCMS XSS via `end_date` parameter CVE-2022-35589Mediumforkcms/forkcms: ForkCMS XSS via `publish_on_time` parameter CVE-2022-35585Mediumforkcms/forkcms: ForkCMS stored XSS via `start_date` parameter CVE-2022-2777Mediummicroweber/microweber: Microweber's title parameter in the body of POST request vulnerable to stored XSS CVE-2022-2713Criticalaheinze/cockpit: Cockpit before 2.2.0 vulnerable to Insufficient Session Expiration CVE-2022-25277Highdrupal/core: Drupal core arbitrary PHP code execution CVE-2022-25275Highdrupal/core: Drupal core Information Disclosure vulnerability CVE-2022-35921Lowfof/byobu: Byobu user preference to prevent private discussions being started are not respected

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo