Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-51586Mediumprestashop/prestashop: Presta Shop vulnerable to email enumeration CVE-2025-9824Mediummautic/core: Mautic Vulnerable to User Enumeration via Response Timing CVE-2025-9823Mediummautic/core: Mautic vulnerable to reflected XSS in lead:addLeadTags - Quick Add CVE-2025-9822Mediummautic/core: Mautic vulnerable to secret data extraction via elfinder CVE-2025-9821Lowmautic/core: Mautic vulnerable to SSRF via webhook function GHSA-FQQV-56H5-F57GHighpocketmine/pocketmine-mp: PocketMine-MP `ResourcePackDataInfoPacket` amplification vulnerability due to lack of resource pack sequence status checking CVE-2025-57759Mediumcontao/core-bundle: Contao does not properly manage privileges for page and article fields CVE-2025-57757Mediumcontao/core-bundle: Contao can disclose sensitive information in the news module CVE-2025-57756Mediumcontao/core-bundle: Contao discloses sensitive information in the front end search index CVE-2025-57758Mediumcontao/core-bundle: Contao applies improper access control in the back end voters CVE-2025-52122Criticalsolspace/craft-freeform: The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability CVE-2025-52353Highbadaso/core: Badaso CMS file upload vulnerability CVE-2025-50383Mediumalextselegidis/easyappointments: Easy!Appointments SQL injection vulnerability CVE-2025-57811Mediumcraftcms/cms: Craft CMS Potential Remote Code Execution via Twig SSTI CVE-2025-43960Highvrana/adminer: Adminer PHP Object Injection issue leads to Denial of Service CVE-2025-54370Highphpoffice/phpspreadsheet: PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser CVE-2025-55745Lowunopim/unopim: UnoPim has CSV Injection on Quick Export feature CVE-2025-55741Highunopim/unopim: UnoPim has Broken Access Control CVE-2025-55744Mediumunopim/unopim: UnoPim vulnerable to CSRF on Product edit feature and creation of other types CVE-2025-55743Highunopim/unopim: UnoPim vulnerable to remote code execution through Arbitrary File upload CVE-2025-55742Mediumunopim/unopim: UnoPim has Stored Cross-site Scripting vulnerability in user creation functionality CVE-2025-8678Mediumjohnbillion/wp-crontrol: WP Crontrol Authenticated (Administrator+) plugin vulnerable to Blind Server-Side Request Forgery CVE-2025-51510Mediummoonshine/moonshine: MoonShine SQL Injection Vulnerability CVE-2025-51487Mediummoonshine/moonshine: moonshine Stored Cross-Site Scripting Vulnerability in Create Article CVE-2025-51488Mediummoonshine/moonshine: moonshine Stored Cross-Site Scripting Vulnerability in Create Admin

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.