Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2020-1691Mediummoodle/moodle: Moodle XSS VulnerabilityCVE-2022-31181Criticalprestashop/prestashop: PrestaShop eval injection possible if shop vulnerable to SQL injectionGHSA-C8RP-CGF4-937WHighmezzio/mezzio-swoole: mezzio-swoole Applications Using Diactoros Vulnerable to HTTP Host Header AttackCVE-2022-34140Mediumfeehi/cms: Feehi CMS Cross-site ScriptingCVE-2022-34971Highfeehi/cms: Feehi CMS arbitrary code execution via crafted PHP fileCVE-2022-31148Mediumshopware/shopware: Shopware vulnerable to persistent cross site scripting (XSS) in customer moduleCVE-2022-31109Mediumlaminas/laminas-diactoros: Diactoros before 2.11.1 vulnerable to HTTP Host Header AttackCVE-2022-35653Mediummoodle/moodle: Moodle LTI module reflected XSS riskCVE-2022-35650Highmoodle/moodle: Moodle Arbitrary file read when importing lesson questionsCVE-2022-35652Mediummoodle/moodle: Moodle Open redirect risk in mobile auto-login featureCVE-2022-35651Mediummoodle/moodle: Moodle Stored XSS and blind SSRF possible via SCORM track detailsCVE-2022-35649Criticalmoodle/moodle: Moodle PostScript Code InjectionCVE-2022-2495Mediummicroweber/microweber: Microweber Stored Cross-site Scripting before v1.2.20CVE-2022-2470Mediummicroweber/microweber: Microweber before 1.2.21 vulnerable to reflected XSSGHSA-M58Q-QQ5H-MGQQCriticalislandora/islandora: Islandora 2.0 before 2.4.1 could allow any user to upload content into a repositoryCVE-2022-2400Mediumdompdf/dompdf: Dompdf before v2.0.0 vulnerable to chroot check bypassCVE-2022-2099Mediumwoocommerce/woocommerce: WooCommerce WordPress plugin before 6.6.0 vulnerable to stored HTML injectionGHSA-Q37H-JHF3-85CJMediumwintercms/winter: Bypass of CMS Safe Mode Security FeatureCVE-2022-31158Highpackbackbooks/lti-1-3-php-library: LTI 1.3 Tool Library's Nonce Claim Value not validated against nonce value sent in Authentication Request before v5.0CVE-2022-31157Highpackbackbooks/lti-1-3-php-library: LTI 1.3 Tool Library's function used to generate random nonces not sufficiently cryptographically complex before v5.0GHSA-6F85-3F8Q-QC94Mediumoro/commerce: OroCommerce vulnerable to XSS when adding class name to Selector Manager on pages that use GrapeJS editorCVE-2022-35628Criticalin2code/lux: SQL Injection in typo3 extension "LUX - TYPO3 Marketing Automation"CVE-2022-24800Highoctober/system: October CMS upload process vulnerable to RCE via Race ConditionCVE-2022-33155Mediumameos/ameos_tarteaucitron: Cross site scripting in ameos_tarteaucitronCVE-2022-33157Mediumsubhh/libconnect: libconnect Extension for Typo3 Vulnerable to XSS

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo