Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-RWR8-XRPW-9QF5Lowsolspace/craft-freeform: solspace/craft-freeform Exposed to Known Axios Vulnerabilities via Precompiled Assets GHSA-44JG-MV3H-WJ6GLowsolspace/craft-freeform: solspace/craft-freeform Vulnerable to XSS in `PhpSpreadsheet` HTML Writer Due to Unsanitized Styling Data GHSA-58Q2-9X27-H2JMLowsolspace/craft-freeform: solspace/craft-freeform Has a DoS Vulnerability CVE-2026-23622Highalextselegidis/easyappointments: alextselegidis/easyappointments is Vulnerable to CSRF Protection Bypass CVE-2021-47763Highaimeos/aimeos-laravel: Aimeos contains a SQL injection vulnerability in the json api 'sort' parameter CVE-2026-23496Mediumpimcore/web2print-tools-bundle: Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization CVE-2026-23495Mediumpimcore/admin-ui-classic-bundle: Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing CVE-2026-23494Mediumpimcore/pimcore: Pimcore is Vulnerable to Broken Access Control: Missing Function Level Authorization on "Static Routes" Listing CVE-2026-23493Highpimcore/pimcore: Pimcore ENV Variables and Cookie Informations are exposed in http_error_log GHSA-595P-G7XC-C333Mediumalgolia/algoliasearch-magento-2: Algolia Search & Discovery for Magento 2 Has Untrusted Data Handling CVE-2026-23492Highpimcore/pimcore: Pimcore Has an Incomplete Patch for CVE-2023-30848 CVE-2025-63644Mediumph7software/ph7builder: pH7-Social-Dating-CMS affected by a stored cross-site scripting (XSS) vulnerability CVE-2026-23498Highshopware/shopware: Shopware Has Improper Control of Generation of Code in Twig rendered views CVE-2022-50807Mediumconcrete5/concrete5: Concrete5 CMS contains an XPath injection vulnerability CVE-2026-0859Mediumtypo3/cms-core: TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool CVE-2025-59022Hightypo3/cms-recycler: TYPO3 CMS Allows Broken Access Control in Recycler Module CVE-2025-59021Mediumtypo3/cms-redirects: TYPO3 CMS Allows Broken Access Control in Redirects Module CVE-2025-59020Mediumtypo3/cms-backend: TYPO3 CMS Allows Broken Access Control in Edit Document Controller CVE-2025-61676Mediumoctober/system: October CMS Vulnerable to Stored XSS via Branding Styles CVE-2025-61674Mediumoctober/system: October CMS Vulnerable to Stored XSS via Editor and Branding Styles CVE-2026-21896Mediumgetkirby/cms: Kirby is missing permission checks in the content changes API CVE-2026-22242Mediumcoreshop/core-shop: CoreShop Vulnerable to SQL Injection via Admin Reports CVE-2025-69197Mediumpterodactyl/panel: Pterodactyl TOTPs can be reused during validity window CVE-2025-68954Highpterodactyl/panel: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced CVE-2026-21857Highredaxo/source: Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.