Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-56382Highcraftcms/cms: Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview CVE-2026-56394Lowcraftcms/cms: Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read CVE-2026-53634Mediumcode16/sharp: Sharp Missing Authorization Check in Quick Creation Command Endpoints GHSA-GQ4G-FPC9-VJFQLowweb-auth/webauthn-lib: Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration…CVE-2026-45016Mediumegroupware/egroupware: EGroupware Vulnerable to Local File Inclusion via file:// URI in Mail Compose CVE-2026-40187Highegroupware/egroupware: EGroupware has Authenticated RCE via Malicious eTemplate Upload CVE-2026-27823Criticalegroupware/egroupware: EGroupware has a Remote Code Execution Vulnerability CVE-2026-55794Highcraftcms/cms: Craft CMS: Potential authenticated Remote Code Execution via referrer redirect CVE-2026-55793Mediumcraftcms/cms: Craft CMS: Stored XSS via Structure entry title in table view CVE-2026-55792Mediumcraftcms/cms: Craft CMS: Sensitive File Disclosure / Server-Side File Read CVE-2026-55790Highcraftcms/cms: Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget CVE-2026-56384Mediumcraftcms/cms: Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission CVE-2026-52889Criticalverbb/formie: Formie Hidden field defaults vulnerable to Server-Side Template Injection CVE-2026-49284Highsimplesamlphp/simplesamlphp: SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion…GHSA-J5MC-P8QG-39J7Lowkimai/kimai: Kimai Favorite Timesheet Add and Remove Endpoints Allows Cross-User Bookmark Manipulation CVE-2026-49289Highsimplesamlphp/saml2: SimpleSAMLphp has Possible DoS via XPath Transform CVE-2026-49283Highsimplesamlphp/saml2: SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass CVE-2026-50282Highcraftcms/cms: Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves CVE-2026-50281Highcraftcms/cms: Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements CVE-2026-9811Mediummautic/core: Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector CVE-2026-9809Highmautic/core: Mautic has Stored Cross-Site Scripting (XSS) in Projects Component CVE-2026-9808Highmautic/core: Mautic has an Authorization Bypass in API v2 Endpoints CVE-2026-9559Criticalmautic/core: Mautic vulnerable to Path Traversal via Campaign Import CVE-2026-9558Criticalmautic/core: Mautic has Server-Side Template Injection (SSTI) in Theme Templates CVE-2026-9557Mediummautic/core: Mautic Focus component Vulnerable to SSRF

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo