Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-31887Highshopware/core: Shopware: Unauthenticated data extraction possible through store-api.order endpointGHSA-G3HP-VVQF-8VW6Lowcraftcms/cms: Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions PageCVE-2026-31857Highcraftcms/cms: CraftCMS has an RCE vulnerability via relational conditionals in the control panelCVE-2026-31858Highcraftcms/cms: CraftCMS's `ElementSearchController` Affected by Blind SQL InjectionCVE-2026-31859Mediumcraftcms/cms: CraftCMS vulnerable to reflective XSS via incomplete return URL sanitizationCVE-2026-31825Mediumsylius/sylius: Sylius has a DQL Injection via API Order FiltersCVE-2026-31824Highsylius/sylius: Sylius has a Promotion Usage Limit Bypass via Race ConditionCVE-2026-31823Mediumsylius/sylius: Sylius Vulnerable to Authenticated Stored XSSCVE-2026-31822Mediumsylius/sylius: Sylius has a XSS vulnerability in checkout login formCVE-2026-31821Mediumsylius/sylius: Sylius is Missing Authorization in API v2 Add Item EndpointCVE-2026-31820Highsylius/sylius: Sylius affected by IDOR in Cart and Checkout LiveComponentsCVE-2026-31819Mediumsylius/sylius: Sylius has an Open Redirect via Referer HeaderCVE-2025-56421Highlimesurvey/limesurvey: LimeSurvey is vulnerable to SQL injectionCVE-2026-31867Mediumcraftcms/commerce: Craft Commerce: Potential IDOR in Commerce cartsCVE-2026-29177Lowcraftcms/commerce: Craft Commerce has stored XSS in Craft Commerce Order Details SlideoutCVE-2026-29176Mediumcraftcms/commerce: Craft Commerce has stored XSS in Inventory Location NameCVE-2026-29175Highcraftcms/commerce: Craft Commerce has multiple Stored XSS in Commerce Inventory Page, Leading to Session HijackingCVE-2026-29174Highcraftcms/commerce: Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table SortingCVE-2026-29173Lowcraftcms/commerce: Craft Commerce is Vulnerable to Stored XSS while updating Order Status from Orders TableCVE-2026-29172Highcraftcms/commerce: Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table SortingCVE-2026-29113Lowcraftcms/cms: Craft CMS has a potential information disclosure vulnerability in preview tokensCVE-2026-30964Mediumweb-auth/webauthn-framework: Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validationCVE-2026-30913Mediumflarum/nicknames: flarum/nicknames extension has display name injection in notification emails (autolink & markdown)GHSA-93FX-5QGC-WR38Highazuracast/azuracast: AzuraCast: RCE via Liquidsoap string interpolation injection in station metadata and playlist URLsCVE-2026-30927Mediumadmidio/admidio: Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo