Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-44167Highphpseclib/phpseclib: phpseclib has a CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()CVE-2026-42267Mediumkimai/kimai: Kimai vulnerable to formula Injection via tag names in XLSX exportCVE-2026-42207Mediumopenmage/magento-lts: Magento LTS Vulnerable to Open Redirect via Unvalidated `uenc` Parameter in `stockAction()`CVE-2026-42194Mediumadmidio/admidio: Admidio has an incomplete fix for CVE-2026-32812 (SSRF)CVE-2026-42155Criticalopenmage/magento-lts: Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived InputsCVE-2026-43878Mediumwwbn/avideo: Video: Reflected XSS in plugin/Meet/iframe.php via Unescaped user and pass Parameters in JavaScript String LiteralCVE-2026-43877Mediumwwbn/avideo: AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Authenticated Users' Profile Photos with Arbitrary ContentCVE-2026-43876Mediumwwbn/avideo: AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to Channel SubscribersCVE-2026-43875Mediumwwbn/avideo: AVideo: Password Hash Leak in MobileManager OAuth Redirect URL Enables Account TakeoverCVE-2026-43874Highwwbn/avideo: AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']`…CVE-2026-43873Highwwbn/avideo: AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the…GHSA-R7CG-QJJM-XHQQHighwebonyx/graphql-php: webonyx/graphql-php has unbounded recursion in parser that causes stack overflow on crafted nested inputGHSA-FC86-6RV6-2JPMHighwebonyx/graphql-php: webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragmentsGHSA-GXXH-8VCJ-W2MHHighmckenziearts/livewire-markdown-editor: livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handlerCVE-2026-38751Highdevcode-it/openstamanager: OpenSTAManager contains an arbitrary file upload vulnerability in its module update functionality CVE-2026-42569Criticalnabeel/phpvms: phpVMS has an /importer authorization bypass causing full database wipeGHSA-Q4PH-8X8G-95F8Highazuracast/azuracast: AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password FieldGHSA-QFF7-Q5FM-8P76Mediumazuracast/azuracast: AzuraCast has Missing Permissions Check on Media File Download, Allowing Cross-Station Data ExfiltrationGHSA-4FM3-GGG2-C6QXMediumazuracast/azuracast: AzuraCast's Missing RequireInternalConnection on Liquidsoap API Allows Low-Privilege Metadata Injection and Broadcast DisruptionCVE-2026-42606Highazuracast/azuracast: AzuraCast has Password Reset Poisoning via Untrusted X-Forwarded-Host Header that Leads to Account Takeover and 2FA BypassCVE-2026-42605Highazuracast/azuracast: AzuraCast has Path Traversal in `currentDirectory` Parameter that Enables Remote Code Execution via Media UploadCVE-2026-41891Mediumci4-cms-erp/ci4ms: CI4MS has a Deactivated User Session Bypass (active=0)CVE-2026-41890Mediumci4-cms-erp/ci4ms: CI4MS Vulnerable to Arbitrary Database Table Drop via Theme deleteProcessCVE-2026-42051Mediumgetkirby/cms: Kirby CMS's system API endpoint leaks installed version and license data to authenticated usersCVE-2026-42174Mediumgetkirby/cms: Kirby CMS doesn't gate user avatar creation, replacement and deletion with user update permissions

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo