Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-GJ94-V4P9-W672Mediumpocketmine/pocketmine-mp: Denial-of-service vulnerability processing large chat messages containing many newlinesCVE-2022-29221Highsmarty/smarty: PHP Code Injection by malicious block or filename in SmartyGHSA-JFXF-4FRR-9J3QMediumneos/neos: XSS in various backend modules due to (un)escaping in JS notification moduleCVE-2022-29248Highguzzlehttp/guzzle: Cross-domain cookie leakage in GuzzleCVE-2022-29305Highhelloxz/imgurl: SQL injection in helloxz/imgurlCVE-2022-1850Mediumfilegator/filegator: Path Traversal in FileGatorCVE-2022-1849Mediumfilegator/filegator: Improper user session handling in filegatorCVE-2021-36027Mediummagento/project-community-edition: Magento stored cross-site scripting vulnerabilityCVE-2019-18210Mediummoodle/moodle: Moodle Persistent Cross-site Scripting (XSS)CVE-2021-36026Mediummagento/project-community-edition: Magento stored cross-site scripting vulnerability in the customer address upload featureCVE-2020-35129Criticalmautic/core: Mautic stored Cross-site Scripting (XSS)CVE-2019-8149Criticalmagento/community-edition: Magento Broken authentication and session managememtCVE-2019-8154Highmagento/community-edition: Magento remote code execution vulnerabilityCVE-2019-10215Mediumbootstrap-3-typeahead: Cross-site Scripting in Bootstrap-3-TypeaheadCVE-2019-16904Mediumnilsteampassnet/teampass: TeamPass Cross-site Scripting (XSS) vulnerabilityCVE-2019-7139Criticalmagento/community-edition: Magento 2 Community Edition SQLi VulnerabilityCVE-2019-12922Mediumphpmyadmin/phpmyadmin: phpMyAdmin Cross-Site Request Forgery (CSRF)CVE-2019-15489Mediumjsdecena/laracom: laracom Cross-site ScriptingCVE-2019-15484Mediumbolt/bolt: Bolt Cross-site Scripting (XSS) via an image's alt or title fieldCVE-2019-12747Hightypo3/cms-core: TYPO3 Vulnerable to Insecure DeserializationCVE-2019-12748Mediumtypo3/cms-core: Typo3 Cross-Site Scripting in Link HandlingCVE-2019-12935Mediumshopware/shopware: Shopware Cross-site Scripting VulnerabilityCVE-2019-11832Hightypo3/cms-core: TYPO3 Image Processing susceptible to Code ExecutionCVE-2021-20842Mediumec-cube/ec-cube: EC-CUBE Cross-site request forgery (CSRF) vulnerabilityCVE-2021-43559Highmoodle/moodle: Moodle contains CSRF vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo