Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2022-31140Highcuyz/valinor: Valinor error messages leading to potential data exfiltration before v0.12.0CVE-2022-2368Mediummicroweber/microweber: Microweber before 1.2.21 allows attacker to bypass IP detection to brute-force passwordCVE-2022-2353Mediummicroweber/microweber: Microweber before v1.2.20 vulnerable to cross-site scriptingCVE-2022-32115Mediumidno/known: Known vulnerable to code execution via SVG file in v1.3.1CVE-2022-33011Highidno/known: Known vulnerable to account takeover via host header injection attack in v1.3.1CVE-2022-31290Mediumidno/known: Known v1.3.1 Cross-site ScriptingCVE-2022-30852Mediumidno/known: Known v1.3.1 contains Insecure Direct Object ReferenceCVE-2022-32061Mediumsnipe/snipe-it: Snipe-IT 6.0.2 vulnerable to Cross-site ScriptingCVE-2022-32060Mediumsnipe/snipe-it: Snipe-IT 6.0.2 vulnerable to Cross-site Scripting via arbitrary file upload in Update Branding SettingsCVE-2022-2300Mediummicroweber/microweber: Cross-site Scripting in microweberCVE-2022-2280Mediummicroweber/microweber: Cross-site Scripting in microweberCVE-2022-33107Criticaltopthink/framework: Deserialization of Untrusted Data in topthink/frameworkCVE-2022-2252Mediummicroweber/microweber: Open Redirect in microweberCVE-2022-2073Highgetgrav/grav: Code injection in gravCVE-2022-29858Mediumsilverstripe/assets: Unpublished, protected files can be published via shortcodeCVE-2021-41559Mediumsilverstripe/framework: Quadratic blowup in Convert::xml2array()CVE-2022-25238Mediumsilverstripe/framework: Stored XSS via HTML fields in SilverStripe FrameworkCVE-2022-28803Mediumsilverstripe/framework: Stored XSS in link tags added via XHR in SilverStripe FrameworkCVE-2022-24444Mediumsilverstripe/hybridsessions: Hybridsessions does not expire session id on logoutCVE-2022-23896Mediumadmidio/admidio: Cross-site Scripting in admidioCVE-2022-0085Mediumdompdf/dompdf: Server-Side Request Forgery in dompdf/dompdfCVE-2022-31101Highprestashop/blockwishlist: BlockWishList SQL Injection vulnerabilityCVE-2022-30120Lowconcrete5/core: Cross site scripting in Concrete CMSCVE-2022-30117Criticalconcrete5/core: Path traversal in Concrete CMSCVE-2022-21829Highconcrete5/core: Code injection in concrete CMS

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo