Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-40488Highopenmage/magento-lts: OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution CVE-2026-29179Lowoctober/system: October CMS: Editor Sub-Permission Bypass for Asset and Blueprint File Operations CVE-2026-27937Lowoctober/system: October CMS: Reflected XSS via DataTable Form Widget CVE-2026-26274Mediumoctober/october: October CMS has Safe Mode Bypass via Twig Database Write Operations CVE-2026-26067Mediumoctober/system: October CMS has Safe Mode Bypass via CSS Preprocessor Compilers CVE-2026-31019Highdolibarr/dolibarr: Dolibarr user with permission to edit PHP content can bypass filtering to restrict dangerous PHP functions CVE-2026-31018Highdolibarr/dolibarr: Dolibarr Allows Code Injection through its Website Module CVE-2026-40098Mediumopenmage/magento-lts: OpenMage LTS: Cross-user wishlist import leads to private option & file disclosure CVE-2026-25525Mediumopenmage/magento-lts: OpenMage LTS has a Path Traversal Filter Bypass in Dataflow Module CVE-2026-25524Highopenmage/magento-lts: OpenMage LTS: Phar Deserialization leads to Remote Code Execution CVE-2026-6626Lowcockpit-hq/cockpit: Cockpit has NoSQL Injection Through Content Aggregation Pipelines CVE-2026-41143Highyeswiki/yeswiki: YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()CVE-2026-41570Highphpunit/phpunit: PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes CVE-2026-41247Highstudio-42/elfinder: elFinder: Command injection in resize background color parameter when using ImageMagick CLI GHSA-JRC6-FMHW-FPQ2Lowkimai/kimai: Kimai: Username enumeration via timing on X-AUTH-USER CVE-2026-23500Criticaldolibarr/dolibarr: Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration CVE-2026-31317Mediummarkhuot/craftql: Craftql vulnerable to Server-Side Request Forgery CVE-2026-40308Highjoedolson/my-calendar: Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog in My Calendar CVE-2026-41175Highstatamic/cms: Statamic: Unsafe method invocation via query value resolution allows data destruction CVE-2026-41304Highwwbn/avideo: WWBN AVideo: RCE cause by clonesite plugin CVE-2026-24749Mediumsilverstripe/assets: Silverstripe Assets Module has a DBFile::getURL() permission bypass CVE-2026-31843Criticalgoodoneuz/pay-uz: goodoneuz/pay-uz: the /payment/api/editable/update endpoint overwrites existing PHP payment hook files CVE-2026-41228Criticalfroxlor/froxlor: Froxlor has Local File Inclusion via path traversal in API `def_language` parameter leads to Remote Code Execution CVE-2026-40500Mediumprocesswire/processwire: ProcessWire: server-side request forgery vulnerability in the admin panel's 'Add Module From URL' feature CVE-2026-41229Criticalfroxlor/froxlor: Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.