Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-34754Mediummantisbt/mantisbt: MantisBT has an Authorization Bypass that Allows Uploading Attachments to Private Issues via REST APICVE-2026-34744Mediummantisbt/mantisbt: MantisBT has an authorization bypass that allows reading attachments after losing access to a private issueCVE-2026-34579Mediummantisbt/mantisbt: MantisBT has an authorization bypass in private issue monitoringCVE-2026-34463Highmantisbt/mantisbt: MantisBT is Vulnerable to Stored HTML Injection/XSS in Clone Issue FormCVE-2026-34390Mediummantisbt/mantisbt: MantisBT Vulnerable to Privilege Escalation from Manager to AdministratorCVE-2026-33052Mediummantisbt/mantisbt: MantisBT Has Authorization Bypass in Global Profile CreationGHSA-H29G-C9CX-C73QCriticaltorrentpier/torrentpier: torrentpier has PHP Serialize InjectionsCVE-2026-44521Highstudio-42/elfinder: elFinder MySQL has a SQL Injection in its Volume Driver (elFinderVolumeMySQL)CVE-2026-44833Mediumsnipe/snipe-it: Snipe-IT has an open redirect vulnerabilityCVE-2023-49316Highphpseclib/phpseclib: Phpseclib needs guardrails on large binaryfield integersCVE-2026-37709Criticalsnipe/snipe-it: Snipe-IT has insecure permissions in file uploadsCVE-2026-44832Highsnipe/snipe-it: Snipe-IT has Privilege Escalation via API Permissions AssignmentCVE-2026-44831Mediumsnipe/snipe-it: Snipe-IT has Stored XSS via Component Checkout Notes (v8.4.0)CVE-2026-44298Mediumkimai/kimai: Kimai has an arbitrary file read in its invoice PDF renderer (admin)CVE-2026-44737Mediumgetgrav/grav: Grav: Stored XSS via page title (data[header][title]) in admin panelCVE-2024-27355Highphpseclib/phpseclib: phpseclib guardrails needed on OID lengthCVE-2026-44212Criticalprestashop/prestashop: PrestaShop has a stored XSS executable in customer service viewGHSA-H4FW-6R7F-W494Lowweb-auth/webauthn-framework: Webauthn has a User Verification Downgrade via Default-Open ClientOverridePolicyCVE-2026-42879Mediumfacturascripts/facturascripts: FacturaScripts Vulnerable to Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product ImagesCVE-2026-42878Mediumfacturascripts/facturascripts: FacturaScripts Vulnerable to Unauthenticated phpinfo() Disclosure via Installer EndpointCVE-2026-42877Mediumfacturascripts/facturascripts: FacturaScripts vulnerable to stored XSS via product reference in sales/purchasesCVE-2026-27964Lowfacturascripts/facturascripts: FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie ManipulationCVE-2026-27892Mediumfacturascripts/facturascripts: FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/DownloadCVE-2026-27891Highfacturascripts/facturascripts: FacturaScripts Vulnerable to Remote Code Execution (RCE) via Zip Slip in Plugin Upload MechanismCVE-2026-36341Mediumkrayin/laravel-crm: Webkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpoint

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo