Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-68455Highcraftcms/cms: Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior CVE-2025-68456Highcraftcms/cms: Unauthenticated Craft CMS users can trigger a database backup CVE-2025-68454Mediumcraftcms/cms: Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI CVE-2025-68437Mediumcraftcms/cms: Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation CVE-2025-68436Mediumcraftcms/cms: Craft CMS vulnerable to potential information disclosure via unchecked asset relocation CVE-2026-21449Highbagisto/bagisto: Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users CVE-2026-21447Highbagisto/bagisto: Bagisto has IDOR in Customer Order Reorder Functionality CVE-2026-21448Highbagisto/bagisto: Bagisto has Normal & Blind SSTI from low-privilege user when ordering product CVE-2026-21450Highbagisto/bagisto: Bagisto SSTI vulnerability in type parameter can lead to RCE CVE-2026-21451Mediumbagisto/bagisto: Bagisto has HTML Filter Bypass that Enables Stored XSS CVE-2026-21446Highbagisto/bagisto: Bagisto Missing Authentication on Installer API Endpoints CVE-2025-69277Mediumparagonie/sodium_compat: libsodium has Incomplete List of Disallowed Inputs CVE-2025-69210Highfacturascripts/facturascripts: FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload GHSA-6MP4-Q625-MXJPHighyourls/yourls: YOURLS is vulnerable to XSS through JSONP and Callback request parameters CVE-2025-67746Lowcomposer/composer: Composer is vulnerable to ANSI sequence injection CVE-2025-69200Highthorsten/phpmyfaq: phpMyFAQ has unauthenticated config backup download via /api/setup/backup GHSA-MGR9-6C2J-JXRQLowpterodactyl/panel: Pterodactyl has a Reflected XSS vulnerability in “Create New Database Host”CVE-2025-68951Mediumthorsten/phpmyfaq: phpMyFAQ has Stored XSS in user list via admin-managed display_name CVE-2024-42718Highcroogo/croogo: Croogo CMS has a path traversal vulnerability CVE-2025-51511Highcadmium-org/cadmium-cms: Cadmium CMS has a background arbitrary file upload vulnerability CVE-2025-68614Mediumlibrenms/librenms: LibreNMS Alert Rule API Cross-Site Scripting Vulnerability CVE-2023-53957Highkimai/kimai: Kimai contains a SameSite cookie vulnerability CVE-2025-14761Mediumaws/aws-sdk-php: AWS SDK for PHP's S3 Encryption Client has a Key Commitment Issue CVE-2023-53929Mediumthorsten/phpmyfaq: phpMyFAQ contains a CSV injection vulnerability GHSA-VVG7-8RMQ-92G7Mediumauth0/wordpress: Auth0 WordPress has Improper Audience Validation via Auth0-PHP SDK Dependency

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.