Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-61816Highzbateson/mail-mime-parser: zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIMECVE-2026-56738Highphpmyfaq/phpmyfaq: phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word InsertionCVE-2026-56737Highthorsten/phpmyfaq: phpMyFAQ's two-factor authentication login bypasses the password factorCVE-2026-56736Highthorsten/phpmyfaq: phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ SubmissionCVE-2026-63498Highsnipe/snipe-it: Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files APICVE-2026-62368Highsnipe/snipe-it: Snipe-IT: Stored XSS via Custom Field name in asset-list column headersCVE-2026-63493Highsnipe/snipe-it: Snipe-IT: 2FA bypass via the API token flowCVE-2026-62998Mediumredaxo/source: REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column EnumerationCVE-2026-76089Highverbb/formie: Formie: Missing authorization on sent notification resend modal exposes submission PIICVE-2026-76087Highverbb/formie: Formie: Unauthenticated users can overwrite incomplete submissions via submit actionCVE-2026-76086Highverbb/formie: Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentialsCVE-2026-92692Mediumsulu/sulu: Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)CVE-2026-73858Mediumsolspace/craft-freeform: Solspace Freeform: Limited Twig template injection via submitted field valuesCVE-2026-88974Mediumwp-graphql/wp-graphql: WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePostCVE-2026-63000Mediumredaxo/source: REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon UpdatesCVE-2026-63002Mediumredaxo/source: REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem FilenamesCVE-2026-63001Mediumredaxo/source: REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`CVE-2026-71537Mediumpaymenter/paymenter: Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade)GHSA-JR78-W6W5-M8F8Highmediawiki/semantic-media-wiki: Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasksGHSA-9RCC-PMJ8-FFHRMediummediawiki/semantic-media-wiki: Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354)CVE-2026-77616Mediummediawiki/semantic-media-wiki: Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination tokenCVE-2026-77610Mediummediawiki/semantic-media-wiki: Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)CVE-2026-77609Mediummediawiki/semantic-media-wiki: Semantic MediaWiki has an open redirect in Special:URIResolverCVE-2026-77607Mediummediawiki/semantic-media-wiki: Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSSCVE-2026-77608Mediummediawiki/semantic-media-wiki: Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo