Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-41230Highfroxlor/froxlor: Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()CVE-2026-41231Highfroxlor/froxlor: Froxlor has Incomplete Symlink Validation in DataDump.add() Allows Arbitrary Directory Ownership Takeover via CronCVE-2026-41232Mediumfroxlor/froxlor: Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index Allows Cross-Customer Email SpoofingCVE-2026-41233Mediumfroxlor/froxlor: Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add()CVE-2026-40486Mediumkimai/kimai: Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rateCVE-2026-40479Mediumkimai/kimai: Kimai has Stored XSS via Incomplete HTML Attribute Escaping in Team Member WidgetGHSA-XP4F-G2CM-RHG7Mediumpocketmine/pocketmine-mp: PocketMine-MP has LogDoS by many junk properties in client data JWT in LoginPacketCVE-2026-41130Mediumcraftcms/cms: Craft CMS has a host header injection leading to SSRF via resource-js endpointCVE-2026-41129Mediumcraftcms/cms: Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads MutationsCVE-2026-41128Mediumcraftcms/cms: Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions ActionCVE-2026-41064Highwwbn/avideo: WWBN AVideo has an incomplete fix for CVE-2026-33502: Command InjectionCVE-2026-41063Mediumwwbn/avideo: WWBN AVideo has an incomplete fix for CVE-2026-33500: XSSCVE-2026-41062Mediumwwbn/avideo: WWBN AVideo has an Incomplete fix: Directory traversal bypass via query string in ReceiveImage downloadURL parametersCVE-2026-41061Mediumwwbn/avideo: WWBN AVideo has Stored XSS via Unanchored Duration Regex in Video Encoder ReceiverCVE-2026-41060Highwwbn/avideo: WWBN AVideo has a SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURLCVE-2026-41058Mediumwwbn/avideo: WWBN AVideo has an incomplete fix for CVE-2026-33293: Path TraversalCVE-2026-41057Highwwbn/avideo: WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated API ResponsesCVE-2026-41056Highwwbn/avideo: WWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables Cross-Origin Account TakeoverCVE-2026-41055Mediumwwbn/avideo: WWBN AVideo has an incomplete fix for CVE-2026-33039: SSRFCVE-2026-40935Mediumwwbn/avideo: CAPTCHA Bypass in WWBN/AVideo via Attacker-Controlled Length Parameter and Missing Token Invalidation on FailureCVE-2026-40929Mediumwwbn/avideo: WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content…CVE-2026-40928Mediumwwbn/avideo: WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category…CVE-2026-40926Highwwbn/avideo: WWBN AVideo has Multiple CSRF Vulnerabilities in Admin JSON Endpoints (Category CRUD, Plugin Update Script)CVE-2026-40925Highwwbn/avideo: WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP CredentialsCVE-2026-40911Criticalwwbn/avideo: WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo