Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-52777Criticalyeswiki/yeswiki: YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserializeCVE-2026-52775Highyeswiki/yeswiki: YesWiki has Authenticated SQL Injection via ReactionManager CVE-2026-52774Mediumyeswiki/yeswiki: YesWiki Vulnerable to Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML AttributesCVE-2026-52773Mediumyeswiki/yeswiki: YesWiki Vulnerable to Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php`CVE-2026-52772Mediumyeswiki/yeswiki: YesWiki has stored XSS in Bazar form-field templates via unescaped field.label / field.hint (|raw('html'))CVE-2026-52771Highyeswiki/yeswiki: YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)CVE-2026-52770Highyeswiki/yeswiki: YesWiki: SQL Injection possible through public Bazar entry-listing APIs via numeric `query`/`queries` filtersCVE-2026-52769Highyeswiki/yeswiki: YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`CVE-2026-52767Highyeswiki/yeswiki: YesWiki Vulnerable to Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`CVE-2026-52766Criticalyeswiki/yeswiki: YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` actionCVE-2026-52763Mediumyeswiki/yeswiki: YesWiki: SQL injection via the `recentchanges` action `period` argument leads to arbitrary DB readCVE-2026-52762Highyeswiki/yeswiki: YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic TemplatesCVE-2026-53932Highwnx/laravel-backup-restore: laravel-backup-restore has an OS Command Injection during database restoreCVE-2026-53760Mediumadmidio/admidio: Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET RequestsGHSA-86VW-X4WW-X467Highcraftcms/cms: Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreviewGHSA-C43V-4CR8-6MVPLowcraftcms/cms: Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file readCVE-2026-53634Mediumcode16/sharp: Sharp Missing Authorization Check in Quick Creation Command EndpointsGHSA-GQ4G-FPC9-VJFQLowweb-auth/webauthn-lib: Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration…CVE-2026-45016Mediumegroupware/egroupware: EGroupware Vulnerable to Local File Inclusion via file:// URI in Mail ComposeCVE-2026-40187Highegroupware/egroupware: EGroupware has Authenticated RCE via Malicious eTemplate UploadCVE-2026-27823Criticalegroupware/egroupware: EGroupware has a Remote Code Execution VulnerabilityCVE-2026-55794Highcraftcms/cms: Craft CMS: Potential authenticated Remote Code Execution via referrer redirectCVE-2026-55793Mediumcraftcms/cms: Craft CMS: Stored XSS via Structure entry title in table viewCVE-2026-55792Mediumcraftcms/cms: Craft CMS: Sensitive File Disclosure / Server-Side File ReadCVE-2026-55790Highcraftcms/cms: Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo