Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-25513Highfacturascripts/facturascripts: FacturaScripts has SQL Injection in API ORDER BY Clause CVE-2025-67852Lowmoodle/moodle: Moodle Open Redirect vulnerability CVE-2025-67853Highmoodle/moodle: Moodle Affected by Improper Restriction of Excessive Authentication Attempts CVE-2025-67857Mediummoodle/moodle: Moodle Inserts Sensitive Information Into Sent Data CVE-2025-67855Mediummoodle/moodle: Moodle vulnerable to Cross-site Scripting CVE-2025-67856Mediummoodle/moodle: Moodle has an authorization logic flaw CVE-2025-67851Mediummoodle/moodle: Moodle formula injection vulnerability CVE-2025-67848Highmoodle/moodle: Moodle authentication bypass vulnerability CVE-2025-67850Highmoodle/moodle: Moodle vulnerable to Cross-site Scripting CVE-2025-67849Highmoodle/moodle: Moodle Cross-site Scripting (XSS) vulnerability CVE-2025-70958Mediumintelliants/subrion: Subrion CMS vulnerable to cross-site scripting CVE-2026-25523Mediumopenmage/magento-lts: Magento's X-Original-Url header can expose admin url CVE-2026-25522Mediumcraftcms/commerce: Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation CVE-2026-25490Mediumcraftcms/commerce: Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation CVE-2026-25489Mediumcraftcms/commerce: Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation CVE-2026-25488Mediumcraftcms/commerce: Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation CVE-2026-25487Mediumcraftcms/commerce: Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation CVE-2026-25486Mediumcraftcms/commerce: Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation CVE-2026-25485Mediumcraftcms/composer: Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation CVE-2026-25484Mediumcraftcms/commerce: Craft Commerce has Stored XSS in Product Type Name CVE-2026-25483Mediumcraftcms/commerce: Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration CVE-2026-25482Mediumcraftcms/commerce: Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)CVE-2026-25510Criticalci4-cms-erp/ci4ms: CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor CVE-2026-25509Mediumci4-cms-erp/ci4ms: CI4MS Vulnerable to User Email Enumeration via Password Reset Flow CVE-2026-23997Highfacturascripts/facturascripts: FacturaScripts has Stored Cross-Site Scripting (XSS) in "Observations" field via History View

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo