Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-27697Mediumbaserproject/basercms: baserCMS has an SQL injection vulnerability in its blog post functionalityCVE-2026-21861Criticalbaserproject/basercms: baserCMS has OS Command Injection Leading to Remote Code Execution (RCE)CVE-2025-32957Highbaserproject/basercms: baserCMS has Unsafe File Upload Leading to Remote Code Execution (RCE)CVE-2026-34375Highwwbn/avideo: AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment PageCVE-2026-34372Mediumsulu/sulu: Sulu checks fix permissions for subentities endpointsCVE-2026-34369Mediumwwbn/avideo: AVideo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password VerificationCVE-2026-34368Mediumwwbn/avideo: AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalanceCVE-2026-34364Mediumwwbn/avideo: AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.phpCVE-2026-34362Mediumwwbn/avideo: AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()CVE-2026-27599Criticalci4-cms-erp/ci4ms: ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation…CVE-2026-34247Mediumwwbn/avideo: AVideo: IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket…CVE-2026-34245Mediumwwbn/avideo: AVideo: Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast HijackingGHSA-WPRJ-9CVC-5W37Highwwbn/avideo: AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial RecordsGHSA-27QH-8CXX-2CR5Highaws/aws-sdk-php: AWS SDK for PHP has CloudFront Policy Document Injection via Special CharactersCVE-2026-33942Highsaloonphp/saloon: Saloon has insecure deserialization in AccessTokenAuthenticatorCVE-2026-34036Mediumdolibarr/dolibarr: Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php CVE-2026-33541Mediummiraheze/ts-portal: TSPortal's Uncontrolled User Creation via Validation Side Effects Leads to Potential Denial of ServiceCVE-2026-29788Highmiraheze/ts-portal: TSPortal: Any user can forge self-deletion requests for any accountCVE-2026-33887Mediumstatamic/cms: Statamic allows unauthorized content access through missing authorization in its revision controllers CVE-2026-33886Mediumstatamic/cms: Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fieldsCVE-2026-33885Mediumstatamic/cms: Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differentialCVE-2026-33884Mediumstatamic/cms: Statamic's live preview token bypasses content protection for unrelated entriesCVE-2026-33883Mediumstatamic/cms: Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tagCVE-2026-33882Mediumstatamic/cms: Statamic's Markdown preview endpoint exposes sensitive user dataCVE-2026-33867Criticalwwbn/avideo: AVideo has Plaintext Video Password Storage

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo