Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-34716Mediumwwbn/avideo: AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call NotificationCVE-2026-34613Mediumwwbn/avideo: AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security PluginsCVE-2026-34611Mediumwwbn/avideo: AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All UsersCVE-2026-34236Highauth0/auth0-php: Auth0 PHP SDK has Insufficient Entropy in Cookie EncryptionCVE-2026-29782Highdevcode-it/openstamanager: OpenSTAManager Affected by Remote Code Execution via Insecure Deserialization in OAuth2CVE-2026-28805Highdevcode-it/openstamanager: OpenSTAManager has a Time-Based Blind SQL Injection via `options[stato]` ParameterGHSA-5724-X3RH-5QQQMediumyeswiki/yeswiki: YesWiki has Multiple Reflected Cross-site Scripting VulnerabilitiesCVE-2026-34598Highyeswiki/yeswiki: YesWiki has Persistent Blind XSS at "/?BazaR&vue=consulter"CVE-2026-34557Criticalci4-cms-erp/ci4ms: CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSCVE-2026-34558Criticalci4-cms-erp/ci4ms: CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSCVE-2026-34396Mediumwwbn/avideo: AVideo has Stored XSS via Unescaped Plugin Configuration Values in Admin PanelCVE-2026-34395Mediumwwbn/avideo: AVideo vulnerable to Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.phpCVE-2026-34394Highwwbn/avideo: AVideo's CSRF on Admin Plugin Configuration Enables Payment Credential HijackingGHSA-3H6J-9X8M-RG3GLowj0k3r/graby: Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization ConfigCVE-2026-34383Mediumadmidio/admidio: Admidio has CSRF and Form Validation Bypass in Inventory Item Save via `imported` ParameterCVE-2026-34384Mediumadmidio/admidio: Admidio has Missing CSRF Protection on Registration Approval ActionsCVE-2026-34382Mediumadmidio/admidio: Admidio has Missing CSRF Protections on Custom List Deletion in mylist_function.phpCVE-2026-34381Highadmidio/admidio: Admidio allows Unauthenticated Access to Role-Restricted documents via neutralized .htaccessCVE-2026-32734Highbaserproject/basercms: baserCMS is Vulnerable to Cross-site ScriptingCVE-2026-32629Mediumthorsten/phpmyfaq: phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ EditorCVE-2026-30940Highbaserproject/basercms: baserCMS Path Traversal Leads to Arbitrary File Write and RCE via Theme File APICVE-2026-30880Criticalbaserproject/basercms: baserCMS has OS command injection vulnerability in installerCVE-2026-30879Mediumbaserproject/basercms: baserCMS has a cross-site scripting vulnerability in blog postsCVE-2026-30878Mediumbaserproject/basercms: baserCMS has Mail Form Acceptance Bypass via Public APICVE-2026-30877Criticalbaserproject/basercms: baserCMS Update Functionality Vulnerable to OS Command Injection

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo