Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-7888Highconcrete5/concrete5: Concrete CMS is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components CVE-2026-41234Highfroxlor/froxlor: Froxlor: BIND Zone File Injection via TXT Record Content CVE-2022-31114Mediumbackpack/crud: backpack/crud is vulnerable to Cross-Site Scripting (XSS)CVE-2026-10215Lowdolibarr/dolibarr: Dolibarr ERP CRM is vulnerable to Improper Authorization through its Leave Request REST API CVE-2026-47266Highverbb/formie: formie's unauthenticated front-end submission editing can overwrite existing submissions CVE-2026-47233Mediumadmidio/admidio: Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024 CVE-2026-47234Mediumadmidio/admidio: Admidio writes session IDs and auto-login cookie values to application logs CVE-2026-47232Mediumadmidio/admidio: Admidio PKCS#12 private key export action lacks CSRF protection CVE-2026-47231Highadmidio/admidio: Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders CVE-2026-47230Mediumadmidio/admidio: Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders CVE-2026-47229Mediumadmidio/admidio: Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation CVE-2026-47228Mediumadmidio/admidio: Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords CVE-2026-47227Mediumadmidio/admidio: Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in…CVE-2026-47226Mediumadmidio/admidio: Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges CVE-2026-47212Mediumsymfony/symfony: Symfony: Twilio SMS Notifier allows unauthenticated webhook injection due to missing X-Twilio-Signature verification CVE-2026-48557Highspatie/laravel-medialibrary: Spatie Laravel Media Library contains a file upload restriction bypass CVE-2026-48555Mediumspatie/laravel-medialibrary: Spatie Laravel Media Library contains a server-side request forgery vulnerability CVE-2026-47260Highphanan/koel: Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs CVE-2026-38739Highezsystems/ezpublish-legacy: ezsystems/ezpublish-legacy has a SQL injection in dfscleanup CVE-2026-41237Highfroxlor/froxlor: Froxlor has an incomplete fix for CVE-2026-30932 CVE-2026-41236Highfroxlor/froxlor: Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` path CVE-2026-41235Highfroxlor/froxlor: Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement CVE-2026-5394Highpimcore/pimcore: Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save CVE-2026-46644Lowsymfony/polyfill: symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form CVE-2026-45756Lowsymfony/json-path: Symfony's JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo