Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-51489Mediummoonshine/moonshine: MoonShine Arbitrary File Upload Vulnerability CVE-2025-55296Mediumlibrenms/librenms: LibreNMS allows stored XSS in Alert Template name field CVE-2025-52392Highsoosyze/soosyze: Soosyze CMS's /user/login endpoint missing rate-limiting and lockout mechanisms CVE-2025-55166Mediumenshrined/svg-sanitize: svg-sanitizer Bypasses Attribute Sanitization CVE-2025-49554Highmagento/project-community-edition: Magento vulnerable to denial of service CVE-2025-49559Mediummagento/project-community-edition: Magento vulnerable to path traversal CVE-2025-49557Highmagento/community-edition: Magento Cross-site Scripting vulnerability CVE-2025-49556Highmagento/project-community-edition: Magento has incorrect authorization issue that leads to arbitrary file system read CVE-2025-49558Mediummagento/project-community-edition: Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability CVE-2025-49555Highmagento/project-community-edition: Magento Cross-Site Request Forgery (CSRF) vulnerability CVE-2025-54417Mediumcraftcms/cms: Craft CMS has a theoretical bypass for CVE-2025-23209 CVE-2025-7954Mediumshopware/platform: Shopware race condition bypasses voucher restrictions CVE-2025-8573Lowconcrete5/concrete5: Concrete CMS is vulnerable to Stored XSS from Home Folder on Members Dashboard page CVE-2025-8571Mediumconcrete5/concrete5: Concrete CMS vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page CVE-2025-50706Criticaltopthink/framework: ThinkPHP Path Traversal Vulnerability CVE-2025-54869Mediumsetasign/fpdi: FPDI allows Memory Exhaustion (OOM) in PDF Parser which leads to Denial of Service CVE-2025-54119Criticaladodb/adodb-php: The ADOdb sqlite3 driver allows SQL injection CVE-2025-51502Mediummicroweber/microweber: Microweber has Reflected XSS Vulnerability in the layout Parameter CVE-2025-51501Mediummicroweber/microweber: Microweber has Reflected XSS Vulnerability in the id Parameter CVE-2025-51504Mediummicroweber/microweber: Microweber XSS Vulnerability in the homepage Endpoint CVE-2025-45769Lowfirebase/php-jwt: php-jwt contains weak encryption CVE-2025-51503Lowmicroweber/microweber: Microweber Has Stored XSS Vulnerability in User Profile Fields CVE-2025-45346Highbacula-web/bacula-web: Bacula-web SQL Injection Vulnerability CVE-2025-8264Highz-push/z-push-dev: z-push/z-push-dev SQL Injection Vulnerability CVE-2025-54418Criticalcodeigniter4/framework: CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.