Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-62418Mediumbagisto/bagisto: bagisto has a Cross Site Scripting (XSS) vulnerability in TinyMCE Image Upload (SVG)CVE-2025-62416Mediumbagisto/bagisto: bagisto has Server Side Template Injection (SSTI) in Product Description CVE-2025-62412Lowlibrenms/librenms: LibreNMS alert-rules has a Cross-Site Scripting Vulnerability CVE-2025-61924Lowprestashop/ps_checkout: PrestaShop Checkout Target PayPal merchant account hijacking from backoffice CVE-2025-61923Mediumprestashop/ps_checkout: PrestaShop Checkout Backoffice directory traversal allows arbitrary file disclosure CVE-2025-61922Criticalprestashop/ps_checkout: PrestaShop Checkout allows customer account takeover via email CVE-2025-62415Mediumbagisto/bagisto: bagisto has Cross Site Scripting (XSS) issue in TinyMCE Image Upload (HTML)CVE-2025-62411Mediumlibrenms/librenms: LibreNMS has a Stored XSS vulnerability in its Alert Transport name field CVE-2025-54265Mediummagento/community-edition: Magento allows incorrect authorization CVE-2025-54263Highmagento/community-edition: Magento provides incorrect authorization through a security feature bypass CVE-2025-54267Mediummagento/project-community-edition: Magento vulnerable to privilege escalation due to incorrect authorization CVE-2025-54266Mediummagento/project-community-edition: Magento vulnerable to stored Cross-Site Scripting (XSS)CVE-2025-54264Highmagento/project-community-edition: Magento vulnerable to stored Cross-Site Scripting (XSS)CVE-2025-62365Mediumlibrenms/librenms: LibreNMS is vulnerable to Reflected-XSS in `report_this` function CVE-2025-60880Highbagisto/bagisto: Bagisto is vulnerable to XSS through Admin Panel's product creation path CVE-2025-60868Mediumalt-design/alt-redirect: Alt Redirect: Potential Authentication Bypass by Spoofing through query-string stripping logic flaw CVE-2025-11570Lowdrupal-pattern-lab/unified-twig-extensions: drupal-pattern-lab/unified-twig-extensions is vulnerable to XXS CVE-2025-61183Mediumwebreinvent/vaahcms: VaahCMS is vulnerable to XSS through its Avatar Upload endpoint CVE-2025-10352Criticalmelisplatform/melis-core: Melis Platform CMS Unauthenticated Admin Account Creation CVE-2025-10353Criticalmelisplatform/melis-cms-slider: Melis Platform CMS Unauthenticated File Upload Leading to RCE CVE-2025-10351Criticalmelisplatform/melis-cms: Melis Platform CMS SQL Injection CVE-2025-11322Lownovosga/novosga: NovoSGA: Manipulation of User Creation Page can lead to weak password requirements CVE-2025-59943Highthorsten/phpmyfaq: phpMyFAQ duplicate email registration allows multiple accounts with the same email CVE-2025-56588Highdolibarr/dolibarr: Dolibarr vulnerable to RCE via the computed field parameter GHSA-7JP2-5H22-M432Lowauth0/symfony: Auth0 Symfony SDK Does Not Properly Handle File Types in Bulk User Import

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.