Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-47939Mediumtypo3/cms-core: TYPO3 Allows Unrestricted File Upload in File Abstraction Layer CVE-2025-47938Lowtypo3/cms-core: TYPO3 Unverified Password Change for Backend Users CVE-2025-47937Lowtypo3/cms-core: TYPO3 Allows Information Disclosure via DBAL Restriction Handling CVE-2025-47936Lowtypo3/cms-webhooks: TYPO3 CMS Webhooks Server Side Request Forgery CVE-2025-47946Mediumsymfony/ux-twig-component: Symfony UX allows unsanitized HTML attribute injection via ComponentAttributes CVE-2025-47931Lowlibrenms/librenms: LibreNMS stored Cross-site Scripting vulnerability in poller group name GHSA-9FWJ-9MJF-RHJ3Criticalauth0/login: laravel-auth0 SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions GHSA-2F4R-34M4-3W8QCriticalauth0/wordpress: Auth0 Wordpress plugin Vulnerable to Brute Force Authentication Tags of CookieStore Sessions GHSA-9WG9-93H9-J8CHCriticalauth0/symfony: Auth0 Symfony SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions CVE-2025-47275Criticalauth0/auth0-php: Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK CVE-2024-11718Mediumcouleurcitron/tarteaucitron-wp: tarteaucitron-wp WordPress Plugin Vulnerable to Stored Cross-Site Scripting CVE-2025-47778Mediumsulu/sulu: Sulu vulnerable to XXE in SVG File upload Inspector CVE-2025-30159Mediumgetkirby/kirby: Kirby vulnerable to path traversal of snippet names in the `snippet()` helper CVE-2025-30207Lowgetkirby/cms: Kirby vulnerable to path traversal in the router for PHP's built-in server CVE-2025-31493Mediumgetkirby/cms: Kirby vulnerable to path traversal of collection names during file system lookup CVE-2024-56526Highoxid-esales/oxideshop-ce: OXID eShop May Display User Information CVE-2025-35939Mediumcraftcms/cms: Craft CMS stores arbitrary content provided by unauthenticated users in session files CVE-2025-29746Mediumkoillection/koillection: Koillection Cross Site Scripting vulnerability CVE-2025-29448Mediumalextselegidis/easyappointments: Easy!Appointments Denial of Service (DoS)CVE-2025-46734Mediumleague/commonmark: league/commonmark contains a XSS vulnerability in Attributes extension CVE-2025-46731Highcraftcms/cms: Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI CVE-2024-51991Lowoctober/system: October CMS Allows Unprotected SVG Rename in Media Manager CVE-2025-47226Mediumsnipe/snipe-it: Grokability Snipe-IT has incorrect authorization for accessing asset information CVE-2025-46337Criticaladodb/adodb-php: SQL injection in ADOdb PostgreSQL driver pg_insert_id() method CVE-2025-0520Criticalshowdoc/showdoc: ShowDoc unrestricted file upload vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.