Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-33297Mediumwwbn/avideo: AVideo: IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php CVE-2026-33296Lowwwbn/avideo: AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php CVE-2026-33295Highwwbn/avideo: AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php CVE-2026-33294Mediumwwbn/avideo: AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources CVE-2026-33293Highwwbn/avideo: AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter CVE-2026-33292Highwwbn/avideo: AVideo has an Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos CVE-2026-32935Highphpseclib/phpseclib: phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack GHSA-5X2W-37XF-7962Mediumwwbn/avideo: AVideo has Unauthenticated PGP Message Decryption via Public Endpoint CVE-2026-33319Mediumwwbn/avideo: AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command CVE-2026-33238Mediumwwbn/avideo: AVideo has a Path Traversal in listFiles.json.php Enables Server Filesystem Enumeration CVE-2026-33237Mediumwwbn/avideo: AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation CVE-2026-33204Highkelvinmo/simplejwt: SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering CVE-2026-33080Highfilament/tables: Filament Unvalidated Range and Values summarizer values can be used for XSS CVE-2026-33177Mediumstatamic/cms: Statamic is missing authorization check on taxonomy term creation via fieldtype CVE-2026-33171Mediumstatamic/cms: Statamic has a path traversal in file dictionary fieldtype CVE-2026-33172Highstatamic/cms: Statamic has Stored XSS via SVG Sanitization Bypass CVE-2026-1323Mediumcpsit/typo3-mailqueue: The mailqueue TYPO3 extension has Insecure Deserialization in `TransportFailure` class CVE-2026-33051Mediumcraftcms/cms: Craft CMS Vulnerable to Stored XSS in Revision Context Menu CVE-2026-1217Mediumyoast/duplicate-post: Yoast Duplicate Post has an Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite CVE-2026-33039Highwwbn/avideo: AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy CVE-2026-33035Mediumwwbn/avideo: Unauthenticated Reflected XSS via innerHTML in AVideo CVE-2026-33043Highwwbn/avideo: AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS CVE-2026-33041Mediumwwbn/avideo: AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php CVE-2026-33038Highwwbn/avideo: AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments CVE-2026-31891Highcockpit-hq/cockpit: Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.