Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-30849Criticalmantisbt/mantisbt: MantisBT is vulnerable to authentication bypass through the SOAP API on MySQLCVE-2026-27131Mediumputyourlightson/craft-sprig: Sprig Plugin for Craft CMS potentially discloses sensitive information via Sprig PlaygroundCVE-2026-4587Mediumhybridauth/hybridauth: HybridAuth Has Improper SSL Certificate Validation in Curl HTTP ClientCVE-2026-33513Highwwbn/avideo: AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)CVE-2026-33512Highwwbn/avideo: AVideo has an unauthenticated decrypt oracle leaking any ciphertextCVE-2026-33507Highwwbn/avideo: AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin UploadCVE-2025-55988Highdreamfactory/df-core: DreamFactory has a directory traversalCVE-2026-33502Criticalwwbn/avideo: AVideo has Unauthenticated SSRF via plugin/Live/test.phpCVE-2026-33501Mediumwwbn/avideo: AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions PluginCVE-2026-33500Mediumwwbn/avideo: AVideo - Incomplete Fix for CVE-2026-27568: Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks SanitizationCVE-2026-33499Mediumwwbn/avideo: AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.phpCVE-2026-33493Highwwbn/avideo: AVideo has a Path Traversal in import.json.php Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI ParameterCVE-2026-33492Highwwbn/avideo: AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session RegenerationCVE-2026-33488Highwwbn/avideo: AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl PluginCVE-2026-33485Highwwbn/avideo: AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name ParameterCVE-2026-33483Highwwbn/avideo: AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.phpCVE-2026-33482Highwwbn/avideo: AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()CVE-2026-33480Highwwbn/avideo: AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks ProxyCVE-2026-33479Highwwbn/avideo: AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against AdminCVE-2026-33478Criticalwwbn/avideo: AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command InjectionCVE-2026-4267Mediumjohnbillion/query-monitor: The Query Monitor plugin for WordPress has Reflected Cross-Site Scripting via Request URICVE-2026-33354Highwwbn/avideo: AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`CVE-2026-33352Criticalwwbn/avideo: AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)CVE-2026-33351Criticalwwbn/avideo: AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification BypassCVE-2026-33347Mediumleague/commonmark: league/commonmark has an embed extension allowed_domains bypass

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo