Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-49358Lowpontedilana/php-weasyprint: PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles CVE-2026-49286Highpontedilana/php-weasyprint: PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)CVE-2026-49262Lowaimeos/pagible: Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy CVE-2026-49260Highpontedilana/php-weasyprint: php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of…GHSA-985R-Q3QP-299HHighthorsten/phpmyfaq: phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards GHSA-Q683-8468-R6H6Mediumweb-auth/webauthn-symfony-bundle: WebauthnAuthenticator leaks sensitive HTTP headers through INFO-level logs CVE-2026-48820Mediumcakephp/cakephp: CakePHP: View::element() is missing a path containment check CVE-2026-48979Highphp-standard-library/h2: PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling GHSA-J7F5-GFQM-PCX3Mediumpterodactyl/panel: Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system CVE-2026-48505Highfilament/filament: Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission CVE-2026-47110Highueberdosis/tiptap-php: Tiptap contains an input validation vulnerability resulting in DoS CVE-2026-54329Highsnipe/snipe-it: Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection CVE-2026-55542Lowsnipe/snipe-it: Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL CVE-2026-55519Lowsnipe/snipe-it: Snipe-IT has Improper Authorization in File Deletion (IDOR)CVE-2026-55483Mediumsnipe/snipe-it: Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation CVE-2026-55482Mediumsnipe/snipe-it: Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update CVE-2026-50550Mediumsnipe/snipe-it: Snipe-IT has a 2FA reset privilege bypass CVE-2026-49976Mediumsnipe/snipe-it: Snipe-IT Vulnerable to User Account Escalation via CSV Import CVE-2026-49870Mediumsnipe/snipe-it: Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`CVE-2026-49205Mediumthorsten/phpmyfaq: phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)CVE-2026-48507Highsnipe/snipe-it: Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users CVE-2026-48500Mediumfilament/filament: Filament: Unauthenticated temporary file upload on auth pages CVE-2026-48493Mediumsnipe/snipe-it: Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment CVE-2026-48492Mediumsnipe/snipe-it: Snipe-IT's selectlist visibility is too permissive CVE-2026-48488Lowthorsten/phpmyfaq: phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo