Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-42069Highgetkirby/cms: Kirby CMS's read access to site, user and role information is not gated by permissionsCVE-2026-29199Highphpbb/phpbb: phpBB has Password Reset Link Poisoning via Host Header injectionCVE-2026-7733Mediumfunadmin/funadmin: Funadmin has an Improper Access Control IssueCVE-2026-7689Lowdolibarr/dolibarr: Dolibarr has Insufficient Verification of Data Authenticity CVE-2026-7688Lowdolibarr/dolibarr: Dolibarr has an Injection issueCVE-2026-42475Mediummix/mix: MixPHP Framework has an SQL injection vulnerabilityCVE-2026-42474Mediummix/mix: MixPHP Framework has an SQL injection vulnerability via crafted `data` arrayCVE-2026-42137Highgetkirby/cms: Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST APIGHSA-MQQ7-WXX5-MP8HLowprestashop/ps_checkout: ps_checkout allows unauthorized method invocation through unvalidated parameterCVE-2026-36340Highkrayin/laravel-crm: Krayin CRM allows a remote attacker to execute arbitrary code via compose email functionCVE-2026-41671Mediumadmidio/admidio: Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without ValidationCVE-2026-41670Highadmidio/admidio: Admidio Sends SAML Response to Unvalidated Assertion Consumer Service URL from AuthnRequestCVE-2026-41669Highadmidio/admidio: Admidio Ignores SAML Signature Validation Result, Processes Forged AuthnRequests and LogoutRequestsCVE-2026-41663Lowadmidio/admidio: Admidio has CSRF on Admin Preferences that Triggers Unauthorized Backup, .htaccess Write, and Email SendCVE-2026-41662Mediumadmidio/admidio: Admidio Missing Minimum Administrator Check in Role Membership RemovalCVE-2026-41661Mediumadmidio/admidio: Admidio vulnerable to reflected XSS in msg_window.php via Square Bracket to HTML Tag ConversionCVE-2026-41660Highadmidio/admidio: Admidio has Inverted 2FA Reset Authorization Check that Lets Group Leaders Strip Admin TOTPCVE-2026-41659Lowadmidio/admidio: Admidio Leaks Hidden Profile Field Values via Blind Search Oracle in Member AssignmentCVE-2026-41658Mediumadmidio/admidio: Admidio's Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete ItemsCVE-2026-41657Mediumadmidio/admidio: Admidio Exposes Cross-Organization Member Data via Permission Check Mismatch in contacts_data.phpCVE-2026-41656Mediumadmidio/admidio: Admidio has Path Traversal via Unvalidated `name` Parameter in Document Add Mode that Enables Arbitrary Server File ReadCVE-2026-41655Mediumadmidio/admidio: Admidio has Path Traversal in ECard Preview that Allows Reading Arbitrary Server Files Including Database CredentialsCVE-2026-42224Highipl/web: ipl/web is vulnerable to reflected XSS by malformed search requestsCVE-2026-42206Mediumroadiz/openid: OpenID Connect nonce generated but never validated — ID token replay attackCVE-2026-41587Highci4-cms-erp/ci4ms: CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code Execution

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo