Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-45580MediumWWBN/AVideo: AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attributeCVE-2026-45578HighWWBN/AVideo: AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URLCVE-2026-23695Mediumcockpit-hq/cockpit: Cockpit CMS: Stored cross-site scripting vulnerability in the Set field type's Display template optionGHSA-QXVM-R42F-5P8JHighWWBN/AVideo: AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`,…CVE-2026-46491Highsimplesamlphp/simplesamlphp-module-casserver: SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletionCVE-2026-44692Highcode16/sharp: Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpointCVE-2026-41147Highnukeviet/nukeviet: NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request classCVE-2025-65954Mediumsimplesamlphp/simplesamlphp-module-casserver: SimpleSAMLphp casserver: Open Redirect in logoutCVE-2026-41249Highcoreshop/core-shop: CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` ConfigurationCVE-2026-44738Highgetgrav/grav: Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()CVE-2026-44657Highmantisbt/mantisbt: MantisBT Vulnerable to Stored XSS in File DownloadCVE-2026-44655Highmantisbt/mantisbt: MantisBT has Stored XSS on Move Attachments Admin PageCVE-2026-42071Highmantisbt/mantisbt: MantisBT has a Private Bugnote Attachment Content Leak via REST APICVE-2026-42070Mediummantisbt/mantisbt: MantisBT: Authorization Bypass in Bugnote Editing via Issue Update APICVE-2026-41897Mediummantisbt/mantisbt: MantisBT is Vulnerable to Reflected XSS in Rendering Dynamic Custom Textarea FieldCVE-2026-40607Highmantisbt/mantisbt: MantisBT is Vulnerable to Stored XSS in Saved-Filter Owner ColumnCVE-2026-40598Mediummantisbt/mantisbt: MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update PageCVE-2026-40597Highmantisbt/mantisbt: MantisBT has a Content Security Policy bypass via attachmentsCVE-2026-40596Highmantisbt/mantisbt: MantisBT is Vulnerable to XSS leading to account takeover via updating a user's font family preferenceCVE-2026-39960Mediummantisbt/mantisbt: MantisBT is Vulnerable to Stored XSS in Custom Field Textarea ValuesCVE-2026-39850Highyiisoft/yii2: Yii 2: Local file inclusion via view parameter name collisionCVE-2026-34970Mediummantisbt/mantisbt: MantisBT: Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is RevokedCVE-2026-34754Mediummantisbt/mantisbt: MantisBT has an Authorization Bypass that Allows Uploading Attachments to Private Issues via REST APICVE-2026-34744Mediummantisbt/mantisbt: MantisBT has an authorization bypass that allows reading attachments after losing access to a private issueCVE-2026-34579Mediummantisbt/mantisbt: MantisBT has an authorization bypass in private issue monitoring

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo