Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-49209Lowsymfony/ux-live-component: symfony/ux-live-component: Denial of service via unbounded batch action requestsCVE-2026-49208Mediumsymfony/ux-live-component: ux-live-component: Format-less date LiveProps parsed with the permissive DateTime constructorCVE-2026-55767Mediumguzzlehttp/guzzle: guzzlehttp/guzzle: Dot-Only Cookie Domains Match All HostsCVE-2026-55766Mediumguzzlehttp/psr7: guzzlehttp/psr7: CRLF Injection in HTTP Start-Line SerializationCVE-2026-55568Mediumguzzlehttp/guzzle: guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to CleartextCVE-2026-55375Mediumjleehr/canto-saas-api: canto-saas-api: OAuth credentials exposed in URL query string and exception messagesCVE-2026-55374Mediumjleehr/canto-saas-api: canto-saas-api: Authenticated API requests can be redirected via unencoded path variablesGHSA-5739-39V2-5754Mediumweb-token/jwt-library: PHP JWT Library: RSA1_5 (RSAES-PKCS1-v1_5) decryption lacks implicit rejection, exposing a Bleichenbacher/Marvin padding oracleGHSA-JC38-X7X8-2XC8Highweb-token/jwt-library: PHP JWT Framework: JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacksGHSA-3PRJ-6HQW-CM82Highweb-token/jwt-library: PHP JWT Library: PBES2-HS*+A*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of serviceGHSA-6VVH-PXR4-25R7Mediumweb-token/jwt-experimental: PHP JWT Framework: Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on…GHSA-2JX3-65F3-XR8RMediumspomky-labs/otphp: spomky-labs/otphp: Mass-assignment in Factory::loadFromProvisioningUri lets a hostile provisioning URI corrupt OTP state or leak an…GHSA-G7M4-839X-CH6VHighspomky-labs/otphp: spomky-labs/otphp: Unbounded digits parameter in a provisioning URI triggers an uncaught DivisionByZeroError in OTP generationCVE-2026-54005Highgetkirby/cms: Kirby: `pages.access` permission is not checked in the `site/find` REST API routeCVE-2026-54004Mediumgetkirby/cms: Kirby: Access to files of top-level drafts is not protected by permissionsCVE-2026-54003Criticalgetkirby/cms: Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` headerCVE-2026-54002Highgetkirby/cms: Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`CVE-2026-50188Mediumgetkirby/cms: Kirby: Request header injection in `Http\Remote`CVE-2026-49276Highgetkirby/cms: Kirby: Self cross-site scripting (self-XSS) in the writer fieldCVE-2026-49274Mediumgetkirby/cms: Kirby: `pages.access` permission is not checked in the pages picker for parent pagesCVE-2026-55890Mediumgetgrav/grav: Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhrCVE-2026-55885Mediumgetgrav/grav: Grav: Admin Backup Zip File Exposes Account Credentials and Configuration SecretsCVE-2026-55746Highcotonti/cotonti: Cotonti: Stored Cross-Site Scripting in the Personal File Storage (PFS) moduleCVE-2026-55745Mediumcotonti/cotonti: Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) moduleCVE-2026-55742Criticalcotonti/cotonti: Cotonti: Cross-Site Request Forgery in the administration rights handler

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo