Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-4776Highmautic/core: Mautic has SQL Injection in API Contact FilteringGHSA-Q4RM-M6XH-5PV7Mediumfroxlor/froxlor: Froxlor customer can create MySQL databases on disallowed servers via Mysqls.add APIGHSA-MR9H-45P9-FG8HMediumfroxlor/froxlor: Froxlor: Authenticated customers can read other customers' allowed sender aliasesCVE-2026-50284Highcraftcms/cms: Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assetsCVE-2026-50283Mediumcraftcms/cms: Craft CMS: Unauthorized Deletion of Source Assets During File ReplacementCVE-2026-50280Mediumcraftcms/cms: Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save checkCVE-2026-50279Highcraftcms/cms: Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gapCVE-2026-52854Highmediawiki/maps: mediawiki/maps has stored XSS through the overlays parameter in the display_map parser functionGHSA-M492-GV72-XVXJLowkimai/kimai: Kimai Password Reset Link Remains Valid After Password ChangeCVE-2026-49981Hightwig/twig: Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`GHSA-HWMC-R6MF-JH83Lowspatie/schema-org: Schema.org has cross-site scripting (XSS) via script break-out in toScript() outputGHSA-2WWR-9X6F-88GPMediumeasycorp/easyadmin-bundle: EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig componentsCVE-2026-55219Mediumpaymenter/paymenter: Paymenter has race condition in payWithCredit() that enables credit double-spendCVE-2026-48808Mediumtwig/twig: Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`CVE-2026-48807Mediumtwig/twig: Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filtersCVE-2026-48806Mediumtwig/twig: Twig: Sandbox `__toString()` policy bypass via dynamic mapping keysCVE-2026-48805Lowtwig/twig: Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`CVE-2026-47198Highpaymenter/paymenter: Paymenter has URL parameter injection that bypasses paid plan limits at checkoutCVE-2026-54244Lowstatamic/cms: Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editorsCVE-2026-54243Mediumstatamic/cms: Statamic Vulnerable to CSV formula injection in form submission exportsCVE-2026-54242Mediumstatamic/cms: Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding)GHSA-7VFX-4246-JCFHHighsolidinvoice/solidinvoice: SolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API tokens and notification transport settingsCVE-2026-49287Highstatamic/cms: Statamic CMS's unsafe method invocation via collection sorting allows data destructionCVE-2026-49288Mediumstatamic/cms: Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resourcesCVE-2026-49359Mediumpontedilana/php-weasyprint: PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo