Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-55696Mediumprivatebin/privatebin: PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required…CVE-2026-55634Criticalpimcore/pimcore: Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name CVE-2026-55220Criticalpimcore/pimcore: Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)CVE-2026-55212Highpimcore/studio-backend-bundle: Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation CVE-2026-55208Highpimcore/studio-backend-bundle: Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password…CVE-2026-55207Highpimcore/studio-backend-bundle: Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass CVE-2026-55584Highphpsysinfo/phpsysinfo: phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers CVE-2026-55516Highsnipe/snipe-it: Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update CVE-2026-55515Mediumsnipe/snipe-it: Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint CVE-2026-55481Mediumsnipe/snipe-it: Snipe-IT has CSS Injection via `header_color` Setting CVE-2026-55479Mediumsnipe/snipe-it: Snipe-IT has incorrect permission for legacy license checkin API CVE-2026-55478Mediumsnipe/snipe-it: Snipe-IT has missing object-level authorization in Kits API CVE-2026-55476Mediumsnipe/snipe-it: Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter CVE-2026-55475Mediumsnipe/snipe-it: Snipe-IT's import created_by can be overwritten CVE-2026-55474Highsnipe/snipe-it: Snipe-IT vulnerable to directory traversal in displaySig CVE-2026-55472Mediumsnipe/snipe-it: Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation CVE-2026-55469Lowsnipe/snipe-it: Snipe-IT has a path traversal vulnerability via CSV import `image` field CVE-2026-55466Mediumsnipe/snipe-it: Snipe-IT vulnerable to stored XSS via inline-served attachment CVE-2026-55464Mediumsnipe/snipe-it: Snipe-IT vulnerable to stored XSS via Markdown custom field CVE-2026-55462Mediumsnipe/snipe-it: Snipe-IT has an authorization bypass on print inventory page CVE-2026-55461Mediumsnipe/snipe-it: Snipe-IT has an Open Redirect After User Edit CVE-2026-55460Highsnipe/snipe-it: Snipe-IT has an authorization bypass on bulk editing users CVE-2026-55452Mediumsnipe/snipe-it: Snipe-IT has CSV formula injection in Activity Report export CVE-2026-57584Highphalcon/cphalcon: Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS CVE-2026-54736Highphalcon/cphalcon: Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo