Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-3192Highspatie/browsershot: Browsershot Server-Side Request Forgery (SSRF) via setURL() Function CVE-2023-47639Mediumapi-platform/core: API Platform Core can leak exceptions message that may contain sensitive information CVE-2025-3153Mediumconcrete5/concrete5: Concrete CMS Vulnerable to Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS)CVE-2025-3130Mediumdrupal/obfuscate: Drupal Obfuscate Vulnerable to Stored Cross-Site Scripting (XSS)CVE-2025-31131Highyeswiki/yeswiki: Yeswiki Path Traversal vulnerability allows arbitrary read of files CVE-2025-31695Lowdrupal/link_field_display_mode_formatter: Drupal Link field display mode formatter Cross-Site Scripting (XSS) vulnerability CVE-2025-31692Mediumdrupal/ai: Drupal AI Vulnerable to OS Command Injection via Optional Automator Types CVE-2025-31694Highdrupal/tfa: Drupal Two-factor Authentication (TFA) Vulnerable to Forceful Browsing CVE-2025-3057Mediumdrupal/core: Drupal Core Potential Cross-Site Scripting (XSS) via Error Messages CVE-2025-31696Lowdrupal/rapidoc_elements_field_formatter: Drupal RapiDoc OAS Field Formatter Cross-Site Scripting (XSS) vulnerability CVE-2025-31697Lowdrupal/formatter_suite: Drupal Formatter Suite Vulnerable to Cross-Site Scripting (XSS) via Link Element Attributes CVE-2025-31691Highdrupal/oauth2_server: Drupal OAuth2 Server Missing Authorization vulnerability CVE-2025-31693Mediumdrupal/ai: Drupal AI Vulnerable to OS Command Injection CVE-2025-31689Mediumdrupal/gdpr: Drupal General Data Protection Regulation Cross-Site Request Forgery (CSRF) vulnerability CVE-2025-31685Mediumgoalgorilla/open_social: Drupal Open Social Missing Authorization vulnerability CVE-2025-31688Lowdrupal/config_split: Drupal Configuration Split Cross-Site Request Forgery (CSRF) vulnerability CVE-2025-31684Lowdrupal/oauth2_client: Drupal OAuth2 Client Cross-Site Request Forgery (CSRF)CVE-2025-31679Mediumdrupal/ignition: Drupal Ignition Cross-Site Scripting (XSS) vulnerability CVE-2025-31680Lowdrupal/matomo: Drupal Matomo Analytics Cross-Site Request Forgery (CSRF) vulnerability CVE-2025-31687Lowdrupal/spamspan: Drupal SpamSpan Cross-Site Scripting (XSS) vulnerability CVE-2025-31690Mediumdrupal/cache_utility: Drupal Cache Utility Cross-Site Request Forgery (CSRF) vulnerability CVE-2025-31686Highgoalgorilla/open_social: Drupal Open Social Missing Authorization vulnerability CVE-2025-31682Mediumdrupal/google_tag: Drupal Google Tag Cross-Site Scripting (XSS) vulnerability CVE-2025-31681Highdrupal/alogin: Drupal Authenticator Login Missing Authorization vulnerability CVE-2025-31683Mediumdrupal/google_tag: Drupal Google Tag Cross-Site Request Forgery (CSRF)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo