Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-4208Highralffreit/mfa-email: Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email)CVE-2026-4202Lowayacoo/redirect-tab: Broken Access Control in extension "Redirect Tab" (redirect_tab)CVE-2026-32813Highadmidio/admidio: Admidio has a Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)CVE-2026-32818Mediumadmidio/admidio: Admidio is Missing Authorization on Forum Topic and Post DeletionCVE-2026-32757Mediumadmidio/admidio: Admidio has an HTMLPurifier Bypass in eCard Message Allows HTML Email InjectionCVE-2026-32817Criticaladmidio/admidio: Admidio is Missing Authorization and CSRF Protection on Document and Folder DeletionCVE-2026-32812Mediumadmidio/admidio: Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata EndpointCVE-2026-32755Mediumadmidio/admidio: Admidio is Missing CSRF Protection on Role Membership Date ChangesCVE-2026-32816Mediumadmidio/admidio: Admidio is Missing CSRF Validation on Role Delete, Activate, and Deactivate ActionsCVE-2026-32756Highadmidio/admidio: File Upload(RCE) Vulnerability in admidioCVE-2026-32268Highcraftcms/azure-blob: Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerabilityCVE-2026-32267Highcraftcms/cms: Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()CVE-2026-32266Lowcraftcms/google-cloud: Google Cloud Storage for Craft CMS has an Information Disclosure VulnerabilityCVE-2026-32265Mediumcraftcms/aws-s3: Amazon S3 for Craft CMS has an Information Disclosure vulnerabilityCVE-2026-32264Highcraftcms/cms: Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsControllerCVE-2026-32263Highcraftcms/cms: Craft CMS vulnerable to behavior injection RCE via EntryTypesControllerCVE-2026-32262Mediumcraftcms/cms: Craft CMS has a Path Traversal Vulnerability in AssetsControllerCVE-2026-32261Highcraftcms/webhooks: RCE via SSTI for users with permissions to access the Craft CMS Webhooks pluginCVE-2026-4175Mediumaureuserp/aureuserp: Aureus ERP vulnerable to cross-site scripting in the Chatter Message HandlerCVE-2026-32612Mediumstatamic/cms: Statamic vulnerable to privilege escalation via stored cross-site scriptingCVE-2026-32600Highsimplesamlphp/xml-security: simplesamlphp/xml-security: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized DecryptionCVE-2026-32313Highrobrichards/xmlseclibs: xmlseclibs: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized DecryptionCVE-2026-27591Criticalwinter/wn-backend-module: Winter vulnerable to privilege escalation by authenticated backend usersCVE-2026-31889Highshopware/platform: Shopware vulnerable to a potential take over of app credentialsCVE-2026-31888Mediumshopware/platform: Shopware has user enumeration via distinct error codes on Store API login endpoint

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo