Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-35035Criticalci4-cms-erp/ci4ms: CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via…CVE-2016-20054Mediumkhodakhah/nodcms: Nodcms contains a cross-site request forgery vulnerabilityCVE-2026-35452Mediumwwbn/avideo: AVideo: Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.phpCVE-2026-35450Mediumwwbn/avideo: AVideo: Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.phpCVE-2026-35449Mediumwwbn/avideo: AVideo: Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.phpCVE-2026-35448Lowwwbn/avideo: AVideo: Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.phpCVE-2026-35181Mediumwwbn/avideo: AVideo: CSRF on Player Skin Configuration via admin/playerUpdate.json.phpCVE-2026-35179Mediumwwbn/avideo: AVideo: Unauthenticated Instagram Graph API Proxy via publishInstagram.json.phpCVE-2026-35470Highdevcode-it/openstamanager: OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe ModalsCVE-2026-35539Mediumroundcube/roundcubemail: Roundcube Webmail: Insufficient HTML attachment sanitization in preview modeCVE-2026-35540Mediumroundcube/roundcubemail: Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messagesCVE-2026-35538Lowroundcube/roundcubemail: Roundcube Webmail: Unsanitized IMAP SEARCH command argumentsCVE-2026-35537Lowroundcube/roundcubemail: Roundcube Webmail: Unsafe deserialization in the redis/memcache session handlerCVE-2026-35541Mediumroundcube/roundcubemail: Roundcube Webmail: Incorrect password comparison in the password pluginCVE-2026-35544Mediumroundcube/roundcubemail: Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messagesCVE-2026-35542Mediumroundcube/roundcubemail: Roundcube: Bypass of remote image blocking via crafted BODY background attributeCVE-2026-35545Mediumroundcube/roundcubemail: Roundcube Webmail: Remote image blocking feature can be bypassed via SVG content in an e-mail messageCVE-2026-35543Mediumroundcube/roundcubemail: Roundcube Webmail: Bypass of remote image blocking via SVG content (with animate attributes) in an e-mail messageCVE-2026-34989Criticalci4-cms-erp/ci4ms: CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSCVE-2026-35168Highdevcode-it/openstamanager: OpenSTAManager: SQL Injection via Aggiornamenti ModuleGHSA-GHC5-95C2-VWCVHighauth0/symfony: Auth0 Symfony SDK has Insufficient Entropy in Cookie EncryptionGHSA-VFPX-Q664-H93MHighauth0/wordpress: Auth0 WordPress Plugin has Insufficient Entropy in Cookie EncryptionGHSA-FMG6-246M-9G2VHighauth0/login: Auth0 laravel-auth0 SDK has Insufficient Entropy in Cookie EncryptionCVE-2026-5370Lowkrayin/laravel-crm: Krayin CRM is vulnerable to Cross-site Scripting (XSS)CVE-2026-34974Mediumthorsten/phpmyfaq: phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding Leads to Stored XSS and Privilege Escalation

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo