Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2025-31677Mediumdrupal/ai: Drupal AI Cross-Site Request Forgery (CSRF) vulnerabilityCVE-2025-31675Lowdrupal/core: Drupal Core Cross-Site Scripting (XSS) VulnerabilityCVE-2025-31678Mediumdrupal/ai: Drupal AI Missing Authorization vulnerabilityCVE-2025-31674Mediumdrupal/core: Drupal Core Improperly Controlled Modification of Dynamically-Determined Object Attributes VulnerabilityCVE-2025-31673Mediumdrupal/core: Drupal Core Vulnerable to Forceful BrowsingCVE-2025-2967Mediumconcrete5/concrete5: ConcreteCMS Cross-Site Scripting (XSS) via HTML Block Text FieldCVE-2025-28092Mediumshopxo/shopxo: ShopXO Vulnerable to Server-Side Request Forgery (SSRF) via Image UploadCVE-2025-28094Mediumshopxo/shopxo: ShopXO Vulnerable to Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS)CVE-2025-28093Mediumshopxo/shopxo: ShopXO Vulnerable to Server-Side Request Forgery (SSRF) via Email SettingsCVE-2024-11847Mediumdigimix/wp-svg-upload: wp-svg-upload WordPress plugin vulnerable to Stored Cross-site ScriptingCVE-2025-30741Mediumpixelfed/pixelfed: Pixelfed may allow unauthorized actor to view private posts and private usersCVE-2025-23204Mediumapi-platform/core: API Platform Core does not call GraphQl securityAfterResolverCVE-2025-2689Mediumyiisoft/yii2-dev: yiisoft Yii2 Deserialization of Untrusted DataCVE-2025-30152Mediumsylius/paypal-plugin: Sylius PayPal Plugin has an Order Manipulation Vulnerability after PayPal CheckoutCVE-2025-30081Mediumclickstorm/cs-seo: Clickstorm SEO Allows Cross-Site Scripting (XSS)CVE-2025-30083Mediumcodingms/additional-tca: Additional TCA Allows Cross-Site Scripting (XSS)CVE-2025-29790Mediumcontao/core-bundle: Contao Vulnerable to Cross-Site Scripting (XSS) through SVG uploadsCVE-2024-44313Hightastyigniter/tastyigniter: TastyIgniter Has an Incorrect Access Control Vulnerability via `invoice()` FunctionCVE-2024-44314Mediumtastyigniter/tastyigniter: TastyIgniter Has an Incorrect Access Control VulnerabilityCVE-2025-29788Mediumsylius/paypal-plugin: Sylius PayPal Plugin Payment Amount Manipulation VulnerabilityCVE-2025-28010Lowmodx/revolution: MODX allows cross-site scripting (XSS) via an SVG fileCVE-2025-27794Mediumflarum/core: Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie OverwriteGHSA-3WGQ-H4FR-CWG5Mediummacropay-solutions/laravel-crud-wizard-free: laravel-crud-wizard-free has File Validation Bypass CVE-2025-2214Lowmicroweber/microweber: Microweber vulnerable to XSS attack due to insure `group` component in its Settings handlerCVE-2025-27617Mediumpimcore/pimcore: Pimcore Vulnerable to SQL Injection in getRelationFilterCondition

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo