Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-48958Mediumfroxlor/froxlor: Froxlor has an HTML Injection Vulnerability CVE-2025-29773Mediumfroxlor/froxlor: Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account Takeover CVE-2025-27773Highsimplesamlphp/saml2: The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding CVE-2025-0660Mediumconcrete5/concrete5: Concrete CMS affected by a stored XSS in Folder Function.The "Add Folder" functionality GHSA-G274-C6JJ-H78PMediumpocketmine/pocketmine-mp: PocketMine-MP allows malicious client data to waste server resources due to lack of limits for explode()CVE-2024-13918Mediumlaravel/framework: Laravel framework susceptible to reflected cross-site scripting CVE-2024-13919Mediumlaravel/framework: Laravel framework susceptible to reflected cross-site scripting CVE-2025-2123Mediumgeshi/geshi: GeSHi XSS possible in the get_var function of /contrib/cssgen.php CVE-2025-27517Criticallivewire/volt: Volt Allows RCE Via User-Crafted Requests CVE-2025-27515Mediumlaravel/framework: Laravel has a File Validation Bypass CVE-2025-27412Mediumredaxo/source: REDAXO allows Authenticated Reflected Cross Site Scripting - packages installation CVE-2025-27411Mediumredaxo/source: REDAXO allows Arbitrary File Upload in the mediapool page CVE-2025-27400Lowopenmage/magento-lts: Magento LTS vulnerable to stored XSS in theme config fields GHSA-C85W-X26Q-CH87Highgetformwork/formwork: Formwork improperly validates input of User role preventing site and panel availability GHSA-VF6X-59HH-332FMediumgetformwork/formwork: Formwork has a cross-site scripting (XSS) vulnerability in Site title CVE-2022-25773Mediummautic/core: Mautic allows Relative Path Traversal in assets file upload CVE-2024-47053Highmautic/core: Mautic allows Improper Authorization in Reporting API CVE-2024-47051Criticalmautic/core: Mautic allows Remote Code Execution and File Deletion in Asset Uploads CVE-2025-26533Highmoodle/moodle: Moodle has a SQL injection risk in course search module list filter CVE-2025-26530Highmoodle/moodle: Moodle allows reflected XSS via question bank filter CVE-2025-26529Highmoodle/moodle: Moodle has a stored XSS risk in admin live log CVE-2025-26532Lowmoodle/moodle: Moodle allows teachers to evade trusttext config when restoring glossary entries CVE-2025-26527Mediummoodle/moodle: Moodle's non-searchable tags can still be discovered on the tag search page and in the tags block CVE-2025-26528Lowmoodle/moodle: Moodle has a stored XSS in ddimageortext question type CVE-2025-26526Mediummoodle/moodle: Moodle's feedback response viewing and deletions did not respect Separate Groups mode

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.