Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2022-2066Mediumfacturascripts/facturascripts: Cross site scripting in facturascripts CVE-2022-2067Criticalfrancoisjacquet/rosariosis: SQL Injection in RosarioSIS CVE-2022-2065Mediumfacturascripts/facturascripts: Cross-site Scripting in FacturaScripts CVE-2022-2060Mediumdolibarr/dolibarr: Cross site scripting in dolibarr CVE-2021-41750Mediumnystudio107/craft-seomatic: Cross-site Scripting in SEOmatic plugin CVE-2021-41749Criticalnystudio107/craft-seomatic: Code Injection in SEOmatic CVE-2021-41502Mediumintelliants/subrion: Cross site scripting in intelliants/subrion CVE-2022-2036Mediumfrancoisjacquet/rosariosis: Cross site scripting in francoisjacquet/rosariosis CVE-2022-2016Mediumfacturascripts/facturascripts: Cross-site Scripting in FacturaScripts CVE-2022-31042Highguzzlehttp/guzzle: Failure to strip the Cookie header on change in host or HTTP downgrade CVE-2022-31043Highguzzlehttp/guzzle: Fix failure to strip Authorization header on HTTP downgrade CVE-2022-1997Mediumfrancoisjacquet/rosariosis: Cross-site Scripting in RosarioSIS CVE-2022-30875Mediumdolibarr/dolibarr: Cross-site Scripting in Dolibarr CVE-2020-36534Mediumnoumo/easyii: Cross-Site Request Forgery in easyii CMS GHSA-FQX3-R75H-VC89Highpocketmine/pocketmine-mp: Improperly checked IDs on itemstacks received from the client leading to server crash in PocketMine-MP CVE-2022-29254Lowsilverstripe/silverstripe-omnipay: Failed payment recorded has completed in Silverstripe Omnipay CVE-2022-1988Mediumfacturascripts/facturascripts: Cross-site Scripting in FacturaScripts CVE-2022-29712Highlibrenms/librenms: Command injection in librenms CVE-2022-29711Mediumlibrenms/librenms: Cross site scripting in librenms CVE-2022-30429Mediumneos/neos: Neos CMS vulnerable to XSS in various backend modules GHSA-2X4V-G8CX-JXRQCriticalibexa/core: Login timing attack in ibexa/core GHSA-XFQG-P48G-HH94Criticalezsystems/ezpublish-kernel: Login timing attack in ezsystems/ezpublish-kernel GHSA-342C-VCFF-2FF2Criticalezsystems/ezplatform-kernel: Login timing attack in ezsystems/ezplatform-kernel CVE-2022-30999Highfof/upload: Possible cross-site scripting attack via unsanitized SVG files in FoF Upload CVE-2022-25772Criticalmautic/core: Cross-site Scripting vulnerability in Mautic's tracking pixel functionality

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.