Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-47346Hightypo3/cms-core: TYPO3 CMS has Broken Access Control in its Form FrameworkCVE-2026-49742Hightypo3/cms-core: TYPO3 CMS has Broken Access Control in its Media ModuleCVE-2026-49740Mediumtypo3/cms-core: TYPO3 CMS has Insecure Deserialization via Core APICVE-2026-49738Lowtypo3/cms-core: TYPO3 CMS has Broken Access Control in its File Abstraction LayerCVE-2026-47352Mediumtypo3/cms-core: TYPO3 CMS has Broken Access Control in Backend APICVE-2026-47351Mediumtypo3/cms-core: TYPO3 CMS: Broken Access Control in Media ModuleCVE-2026-47348Mediumtypo3/cms-core: TYPO3 CMS has Cross-Site Scripting in Indexed SearchCVE-2026-47344Lowtypo3/html-sanitizer: TYPO3 HTML Sanitizer allows Cross-site ScriptingGHSA-6JQ6-X4CX-QVCMMediumgrumpydictator/firefly-iii: Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)CVE-2026-48067Mediumfilament/tables: Filament has inconsistent scope enforcement for its AttachAction and AssociateAction Select fieldsCVE-2026-48062Criticalcodeigniter4/framework: CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` ruleCVE-2026-53723Mediumguzzlehttp/guzzle-services: guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA TerminatorCVE-2026-48998Mediumguzzlehttp/psr7: guzzlehttp/psr7 has Host Confusion via Authority ReinterpretationCVE-2026-49214Mediumguzzlehttp/psr7: guzzlehttp/psr7 has CRLF Injection via URI Host ComponentCVE-2026-10721Highconcrete5/concrete5: Concrete CMS: PHP Object Injection via unserialize() callsCVE-2026-53675Mediumbuddypress/buddypress: BuddyPress: Any authenticated attacker can enumerate another user's complete friend list via IDORCVE-2026-53673Highbuddypress/buddypress: BuddyPress: Authenticated attackers can access arbitrary private message threads via user_id request parameterCVE-2026-48030Criticalpheditor/pheditor: Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameterCVE-2026-47767Mediumsymfony/runtime: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv MismatchCVE-2026-50636Highlimesurvey/limesurvey: LimeSurvey has a SQL Injection issueCVE-2026-50635Highlimesurvey/limesurvey: LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it.CVE-2026-47693Mediumpoweradmin/poweradmin: Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applicationsCVE-2026-45034Criticalphpoffice/phpspreadsheet: PHPSpreadsheet has a patch bypass for CVE-2026-34084 CVE-2026-47732Hightwig/twig: Twig: Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion pointsCVE-2026-47730Lowtwig/twig: Twig: XSS in profiler HtmlDumper via unescaped template and profile names

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo