Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-34973Mediumthorsten/phpmyfaq: phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content DisclosureGHSA-GMPC-FXG2-VCMQMediumwwbn/avideo: AVideo has Stored XSS via Unescaped Menu Item Fields in TopMenu PluginCVE-2026-34729Mediumphpmyfaq/phpmyfaq: phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()CVE-2026-34728Highphpmyfaq/phpmyfaq: phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserControllerCVE-2026-34572Highci4-cms-erp/ci4ms: CI4MS: Account Deactivation Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)CVE-2026-34571Criticalci4-cms-erp/ci4ms: CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account…CVE-2026-34570Highci4-cms-erp/ci4ms: CI4MS: Account Deletion Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)CVE-2026-34569Criticalci4-cms-erp/ci4ms: CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSCVE-2026-34568Criticalci4-cms-erp/ci4ms: CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSCVE-2026-34567Criticalci4-cms-erp/ci4ms: CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSCVE-2026-34566Criticalci4-cms-erp/ci4ms: CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSCVE-2026-34565Criticalci4-cms-erp/ci4ms: CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSCVE-2026-34564Criticalci4-cms-erp/ci4ms: CI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSCVE-2026-34563Criticalci4-cms-erp/ci4ms: CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSSCVE-2026-34562Mediumci4-cms-erp/ci4ms: CI4MS: System Settings (Company Information) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via…CVE-2026-34561Criticalci4-cms-erp/ci4ms: CI4MS: System Settings (Social Media Management) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via…CVE-2026-34560Criticalci4-cms-erp/ci4ms: CI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSCVE-2026-34559Criticalci4-cms-erp/ci4ms: CI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSCVE-2026-34740Mediumwwbn/avideo: AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() ValidationCVE-2026-34739Mediumwwbn/avideo: AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.phpCVE-2026-34738Mediumwwbn/avideo: AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request ParameterCVE-2026-34737Mediumwwbn/avideo: AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() BugCVE-2026-34733Mediumwwbn/avideo: AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI GuardCVE-2026-34732Mediumwwbn/avideo: AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 EndpointsCVE-2026-34731Highwwbn/avideo: AVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo