Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-53021Mediummoodle/moodle: Moodle Session Fixation allows unauthenticated users to hijack sessions via sesskey parameter CVE-2025-49132Criticalpterodactyl/panel: Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution CVE-2025-49597Lowhandcraftedinthealps/goodby-csv: handcraftedinthealps/goodby-csv has Potential Gadget Chain allowing Remote Code Execution GHSA-9QV6-4PWM-M68FMediumibexa/fieldtype-richtext: Ibexa RichText Field Type XSS vulnerabilities in back office GHSA-5R6X-G6JV-4V87Mediumibexa/admin-ui: Ibexa Admin UI XSS vulnerabilities in back office GHSA-VHGQ-R8GX-5FPVMediumibexa/admin-ui-assets: Ibexa Admin UI assets XSS vulnerabilities in back office GHSA-R5RX-53G9-25RJMediumezsystems/ezplatform-admin-ui-assets: Ibexa eZ Platform Admin UI assets XSS vulnerabilities in back office GHSA-R7PM-MW8G-P7PXMediumezsystems/ezplatform-admin-ui: Ibexa eZ Platform Admin UI XSS vulnerabilities in back office CVE-2025-49578Mediumstarcitizentools/citizen-skin: starcitizentools/citizen-skin allows stored XSS in user registration date message CVE-2025-49579Mediumstarcitizentools/citizen-skin: starcitizentools/citizen-skin allows stored XSS in menu heading message CVE-2025-49577Mediumstarcitizentools/citizen-skin: starcitizentools/citizen-skin allows stored XSS in preference menu heading messages CVE-2025-49576Mediumstarcitizentools/citizen-skin: starcitizentools/citizen-skin allows stored XSS in search no result messages CVE-2025-49575Mediumstarcitizentools/citizen-skin: Citizen skin vulnerable to stored XSS through multiple system messages CVE-2025-48447Mediumdrupal/lightgallery: Drupal Lightgallery Cross-site Scripting vulnerability CVE-2025-48448Highdrupal/admin_audit_trail: Drupal Admin Audit Trail Allocation of Resources Without Limits or Throttling vulnerability CVE-2025-48445Highdrupal/commerce_eurobank_redirect: Drupal Commerce Eurobank (Redirect) Incorrect Authorization vulnerability CVE-2025-48444Mediumdrupal/quick_node_block: Drupal Quick Node Block Missing Authorization vulnerability CVE-2025-48446Highdrupal/commerce_alphabank_redirect: Drupal Commerce Alphabank Redirect Incorrect Authorization vulnerability CVE-2025-48013Mediumdrupal/quick_node_block: Drupal Quick Node Block Missing Authorization vulnerability CVE-2025-43585Highmagento/project-community-edition: Magento Improper Authorization leading to security feature bypass CVE-2025-47110Criticalmagento/community-edition: Magneto contains stored XSS vulnerability CVE-2025-27206Mediummagento/project-community-edition: Magento Improper Access Control leads to security feature bypass CVE-2025-49138Mediumelmsln/haxcms: HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter CVE-2025-49137Highelmsln/haxcms: Hax CMS Stored Cross-Site Scripting vulnerability CVE-2025-49130Mediumbarryvdh/laravel-translation-manager: Laravel Translation Manager Vulnerable to Stored Cross-site Scripting

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo