Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-107842Mediumcontao/core-bundle: Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabledCVE-2026-107843Mediumcontao/core-bundle: Contao: The registration module re-sends activation mailsCVE-2026-107848Lowcontao/core-bundle: Contao: Cross-site request forgery in custom backend actionsCVE-2026-107844Mediumcontao/core-bundle: Contao: Path traversal in the images controllerCVE-2026-107845Criticalcontao/comments-bundle: Contao: Cross-site scripting in the comments bundleCVE-2026-107850Mediumcontao/core-bundle: Contao: Improper access control in the preview links moduleCVE-2026-107851Mediumcontao/core-bundle: Contao: Improper access control in the table access voterCVE-2026-107380Mediumenshrined/svg-sanitize: enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference CollisionCVE-2026-107381Mediumenshrined/svg-sanitize: svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferencesCVE-2026-107379Mediumenshrined/svg-sanitize: enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration CrashCVE-2026-104890Highkunstmaan/media-bundle: Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote…CVE-2026-104181Mediumfilament/filament: Filament: Multi-factor authentication (app) management actions do not require password reauthenticationCVE-2026-88023Mediummongodb/mongodb: MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDsCVE-2026-59944Mediumcomposer/composer: Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin pathGHSA-97JJ-33GV-5XF9Mediumleague/commonmark: league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literalGHSA-3Q6V-R5MR-HXV8Highleague/commonmark: league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scanCVE-2026-102279Lowlaravel/framework: Laravel: XSS in Debug Page InformationCVE-2026-102601Lowleague/flysystem: Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting…CVE-2026-65954Highphpcsstandards/phpcsutils: PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()CVE-2026-92161Criticalfof/oauth: FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth providerCVE-2026-57440Highstarcitizenwiki/embedvideo: Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabledCVE-2026-61823Highcode16/sharp: code16 Sharp vulnerable to stored XSS via iframe srcdoc AttributeCVE-2026-61825Highcode16/sharp: code16/sharp has a stored XSS via data-html-content Sanitizer BypassCVE-2026-57232Lowcontao/contao: Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader ModuleCVE-2026-61815Highzbateson/mail-mime-parser: zbateson/mail-mime-parser has CRLF header injection via attachment filename

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo