Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-54378High@haxtheweb/haxcms-nodejs: HAX CMS API Lacks Authorization Checks CVE-2025-7899Mediumin2code/powermail: Powermail extension for TYPO3 allows Insecure Direct Object Reference CVE-2025-7900Mediumin2code/femanager: Femanager extension for TYPO3 allows Insecure Direct Object Reference CVE-2025-54139Medium@haxtheweb/haxcms-nodejs: HAX CMS application pages vulnerable to clickjacking CVE-2025-54138Highlibrenms/librenms: LibreNMS has Authenticated Remote File Inclusion in ajax_form.php that Allows RCE GHSA-49XW-HW94-FMV2Highdolibarr/dolibarr: Dolibarr has Remote Code Execution Vulnerability (Bypass)CVE-2025-54082Criticalmarshmallow/nova-tiptap: nova-tiptap has Unauthenticated Arbitrary File Upload Vulnerability CVE-2025-46002Mediumsimogeo/filemanager: Filemanager is vulnerable to Relative Path Traversal through filemanager.php CVE-2025-46001Criticalsimogeo/filemanager: simogeo/filemanager arbitrary file upload vulnerability CVE-2025-54068Criticallivewire/livewire: Livewire is vulnerable to remote command execution during component property update hydration CVE-2025-53833Criticalbinarytorch/larecipe: LaRecipe is vulnerable to Server-Side Template Injection attacks CVE-2025-52994Mediumjames-heinrich/phpthumb: phpThumb is vulnerable to Command Injection through its gif_outputAsJpeg function CVE-2025-53625Highuniversal-omega/dynamic-page-list3: DynamicPageList3 vulnerability exposes hidden/suppressed usernames CVE-2025-7053Mediumcockpit-hq/cockpit: Cockpit - Content Platform vulnerable to XSS through name or email argument names CVE-2025-53369Highstarcitizentools/short-description: Citizen Short Description stored XSS vulnerability through wikitext CVE-2025-34086Highbolt/bolt: Bolt CMS vulnerable to authenticated remote code execution CVE-2025-53370Highstarcitizentools/citizen-skin: Citizen vulnerable to Stored XSS through short descriptions CVE-2025-53368Highstarcitizentools/citizen-skin: starcitizentools/citizen-skin is vulnerable to Stored XSS attack in the legacy search bar through page descriptions CVE-2025-34076Mediummicroweber/microweber: Microweber CMS API has authenticated local file inclusion vulnerability CVE-2025-53093Highstarcitizentools/tabber-neue: TabberNeue vulnerable to Stored XSS through wikitext CVE-2025-44163Highbillz/raspap-webgui: raspap-webgui has a Directory Traversal vulnerability CVE-2025-6735Lowjuzaweb/cms: JuzaWeb CMS is vulnerable to Incorrect Privilege Assignment when installing Import Page component CVE-2025-6736Lowjuzaweb/cms: JuzaWeb CMS is vulnerable to Incorrect Privilege Assignment when installing certain components CVE-2025-49550Mediummagento/project-community-edition: Magento Security feature bypass CVE-2025-49549Lowmagento/project-community-edition: Magento Authenticated Security feature bypass

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.