Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-54476Mediumjoomla/filter: Joomla! CMS vulnerable to XSS via the input filter CVE-2025-59839Highstarcitizenwiki/embedvideo: Star Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes CVE-2025-10909Lownovosga/novosga: Mangati NovoSGA XSS vulnerability in /admin CVE-2025-57407Lows-cart/core: GP247 and S-Cart have a stored cross-site scripting (XSS) vulnerability CVE-2025-59713Mediumsnipe/snipe-it: Snipe-IT allows unsafe deserialization CVE-2025-59712Mediumsnipe/snipe-it: Snipe-IT allows XSS CVE-2025-10316Lowlavitto/typo3-form-to-database: TYPO3 "Form to Database" extension susceptible to Cross-site Scripting CVE-2025-59397Mediumopen-web-analytics/open-web-analytics: Open Web Analytics Server is vulnerable to SQL Injection CVE-2025-56556Mediumintelliants/subrion: Subrion CMS: Authenticated administrators are able to gain escalated access through Run SQL Query tool GHSA-9V82-VCJX-M76JHighshopware/shopware: Shopware: Reflective Cross Site-Scripting (XSS) in CMS components CVE-2025-58759Mediumdatahihi1/tiny-env: TinyEnv: Inline comments not stripped properly in .env values CVE-2025-58758Mediumdatahihi1/tiny-env: TinyEnv: Missing .env file not required — may cause unexpected behavior CVE-2025-58449Highmahocommerce/maho: Maho is Vulnerable to Authenticated Remote Code Execution via File Upload CVE-2025-52277Mediumyeswiki/yeswiki: YesWiki Cross Site Scripting vulnerability CVE-2025-54236Criticalmagento/community-edition: Magento Community Edition Improper Input Validation vulnerability CVE-2025-59016Mediumtypo3/cms-core: TYPO3 CMS exposes sensitive information in an error message CVE-2025-59018Hightypo3/cms-workspaces: TYPO3 Workspaces Module Information Disclosure CVE-2025-59017Mediumtypo3/cms-workspaces: TYPO3 backend modules have Broken Access Control CVE-2025-59019Mediumtypo3/cms-backend: TYPO3 CSV download feature information disclosure CVE-2025-59014Mediumtypo3/cms-backend: TYPO3 Bookmark Toolbar vulnerable to denial of service CVE-2025-59013Mediumtypo3/cms-core: TYPO3 CMS has an open‑redirect vulnerability CVE-2025-59015Mediumtypo3/cms-core: TYPO3 CMS uses insufficient entropy when generating passwords CVE-2025-51586Mediumprestashop/prestashop: Presta Shop vulnerable to email enumeration CVE-2025-9824Mediummautic/core: Mautic Vulnerable to User Enumeration via Response Timing CVE-2025-9823Mediummautic/core: Mautic vulnerable to reflected XSS in lead:addLeadTags - Quick Add

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.