Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-48167Mediumfilament/infolists: Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSSCVE-2026-48166Mediumfilament/filament: Filament: Timing-based user enumeration on login pageCVE-2026-48157Mediumslim/slim: Slim has Reflected XSS in the HtmlErrorRendererGHSA-7CQP-7CFV-6C3QMediumwwbn/avideo: AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panelCVE-2026-55173Highwwbn/avideo: AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command…CVE-2026-44585Mediumpaymenter/paymenter: Paymenter has broken object level authorization via service reference manipulation on ticket creationCVE-2026-44584Mediumpaymenter/paymenter: Paymenter doesn't reset email verification status after email changeCVE-2026-44583Mediumpaymenter/paymenter: Paymenter has Blind Unauthenticated SSRF on the Paypal gateway moduleCVE-2026-33731Mediumwwbn/avideo: AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment DataCVE-2026-33692Highwwbn/avideo: AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose ConfigurationCVE-2026-33684Mediumwwbn/avideo: AVideo's Privilege Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet PermissionsCVE-2025-58048Criticalpaymenter/paymenter: Paymenter vulnerable to Remote Code Execution via public file uploadsCVE-2026-55878Highsymfony/ux-toolkit: symfony/ux-toolkit: Path Traversal Allows Arbitrary File Write and Read via Crafted Recipe ManifestCVE-2026-55877Mediumsymfony/ux-icons: symfony/ux-icons: XSS via unsanitized SVG content in local files and Iconify on-demand responsesCVE-2026-55692Highstarcitizenwiki/embedvideo: StarCitizenWiki Extension Embed Video: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabledCVE-2026-55795Mediumcraftcms/commerce: Craft Commerce: Coupon Code Brute-Force via Rate Limit BypassGHSA-78VR-Q6CF-C7P6Mediumcraftcms/commerce: Craft Commerce: Partial Payment Amount Without Lower Bound ValidationCVE-2026-55791Criticalcraftcms/cms: Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJsCVE-2026-55691Highstarcitizenwiki/embedvideo: StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to templateCVE-2026-55690Highstarcitizenwiki/embedvideo: StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exception textCVE-2026-49216Mediumsymfony/ux-autocomplete: symfony/ux-autocomplete: XSS via unescaped AJAX response dataCVE-2026-49215Lowsymfony/ux-live-component: symfony/ux-live-component: CSRF Protection Bypass — Accept Header is CORS-SafelistedCVE-2026-49212Lowsymfony/ux-live-component: symfony/ux-live-component: LiveComponentHydrator HMAC checksum lacks component and slot bindingCVE-2026-49211Mediumsymfony/ux-autocomplete: symfony/ux-autocomplete: Information exposure via unescaped LIKE wildcards in EntitySearchUtilCVE-2026-49210Mediumsymfony/ux-live-component: symfony/ux-live-component: XSS via attacker-controlled child component tag

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo