Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-8GRV-JQ2G-CFHWMediumamphp/http-server: amphp/http-server affected by HTTP/2 DDoS vulnerability CVE-2026-25892Highvrana/adminer: Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint CVE-2026-25878Mediumfrosh/adminer-platform: FroshAdminer Adminer UI is accessible without admin session CVE-2026-25498Highcraftcms/cms: Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior CVE-2026-25497Highcraftcms/cms: Craft CMS: GraphQL Asset Mutation Privilege Escalation CVE-2026-25496Mediumcraftcms/cms: Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields CVE-2026-25495Highcraftcms/cms: Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`CVE-2026-25494Mediumcraftcms/cms: Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation CVE-2026-25493Mediumcraftcms/cms: Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect CVE-2026-25492Mediumcraftcms/craft: Craft CMS: save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host CVE-2026-25491Lowcraftcms/cms: Craft CMS Vulnerable to Stored XSS in Entry Types Name CVE-2026-24419Highdevcode-it/openstamanager: OpenSTAManager has a SQL Injection in the Prima Nota module CVE-2026-24418Highdevcode-it/openstamanager: OpenSTAManager has a SQL Injection vulnerability in the Scadenzario bulk operations module CVE-2026-24417Highdevcode-it/openstamanager: OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service CVE-2026-24416Highdevcode-it/openstamanager: OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module CVE-2025-69216Highdevcode-it/openstamanager: OpenSTAManager has a SQL Injection in Scadenzario Print Template CVE-2025-69214Highdevcode-it/openstamanager: OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)CVE-2025-69212Criticaldevcode-it/openstamanager: OpenSTAManager has an OS Command Injection in P7M File Processing CVE-2025-70791Lowmicroweber/microweber: Microweber has a Cross-site Scripting vulnerability CVE-2025-70792Lowmicroweber/microweber: Microweber Cross-site Scripting vulnerability CVE-2026-22254Lowwinter/wn-cms-module: Winter CMS has Stored Cross-site Scripting (XSS) in Asset Manager CVE-2026-25597Mediumprestashop/prestashop: PrestaShop affected by time based enumeration in FO login form CVE-2025-69215Highdevcode-it/openstamanager: OpenSTAManager has an SQL Injection in the Stampe Module CVE-2025-69213Highdevcode-it/openstamanager: OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)CVE-2026-25514Highfacturascripts/facturascripts: FacturaScripts has SQL Injection in Autocomplete Actions

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.