Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-32426Mediumverbb/formie: Formie has XSS vulnerability for email notification content for preview CVE-2025-32427Mediumverbb/formie: Formie has XSS vulnerability for importing forms CVE-2025-32027Mediumyiisoft/yii: Yii does not prevent XSS in scenarios where fallback error renderer is used GHSA-256Q-HX8W-XCQXMediumsilverstripe/framework: Silverstripe Framework user enumeration via timing attack on login and password reset forms CVE-2025-30148Mediumsilverstripe/framework: Silverstripe Framework has a XSS vulnerability in HTML editor CVE-2025-25197Mediumdnadesign/silverstripe-elemental: Silverstripe cross-site scripting (XSS) attack in elemental "Content blocks in use" report GHSA-CJ3W-G42V-WCJ6Highibexa/fieldtype-richtext: ibexa/fieldtype-richtext allows access to external entities in XML GHSA-2JQJ-5QV2-XVCGHighezsystems/ezplatform-richtext: ezsystems/ezplatform-richtext allows access to external entities in XML CVE-2024-58136Criticalyiisoft/yii2: yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key CVE-2025-32378Lowshopware/core: Shopware default newsletter opt-in settings allow for mass sign-up abuse GHSA-5PM7-CP8F-P2C2Mediumwallabag/wallabag: wallabag/wallabag Has Multiple Cross-Site Request Forgery (CSRF) Vulnerabilities CVE-2025-27191Mediummagento/project-community-edition: Magento Improper Access Control leads to Security feature bypass CVE-2025-27188Mediummagento/community-edition: Magento Improper Authorization vulnerability CVE-2025-27190Mediummagento/project-community-edition: Magento Improper Access Control leads to Security feature bypass CVE-2025-27192Lowmagento/project-community-edition: Magento does not properly protect credentials CVE-2025-22871Criticalspiral/roadrunner: RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency CVE-2025-25226Mediumjoomla/database: Joomla Framework Database Package Vulnerable to SQL Injection CVE-2025-25227Highjoomla/joomla-cms: Joomla CMS Multi-Factor Authentication Bypass GHSA-68WV-G3FW-PQ7QMediumshopware/core: Shopware Broken ACL on Document retrieval to access other customers documents CVE-2025-27892Highshopware/core: Shopware Vulnerable to Blind SQL-injection in DAL aggregations CVE-2025-30166Lowpimcore/admin-ui-classic-bundle: Pimcore's Admin Classic Bundle allows HTML Injection CVE-2025-30151Highshopware/core: Shopware allows Denial Of Service via password length CVE-2025-30150Mediumshopware/core: Shopware 6 allows attackers to check for registered accounts through the store-api CVE-2025-31485Highapi-platform/graphql: GraphQL grant on a property might be cached with different objects CVE-2025-31481Highapi-platform/graphql: GraphQL query operations security can be bypassed

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.