Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-26531Lowmoodle/moodle: Moodle has an IDOR in badges allows disabling of arbitrary badges CVE-2025-26525Highmoodle/moodle: Moodle has an arbitrary file read risk through pdfTeX GHSA-F679-254H-QHVJLowleantime/leantime: Leantime allows Cross-Site Scripting (XSS)CVE-2025-28254Mediumleantime/leantime: Leantime affected by Improper Neutralization of HTML Tags GHSA-3HFJ-QCVJ-4HX8Lowleantime/leantime: Leantime has Missing Authorization Check for Host Parameter GHSA-C39W-3PJX-QC7MHighleantime/leantime: Leantime allows Stored Cross-Site Scripting (XSS)GHSA-92XH-6X7V-4RMQMediumleantime/leantime: Leantime allows Cross-Site Request Forgery (CSRF)GHSA-V4Q9-437P-MHPGHighleantime/leantime: Leantime allows Cross Site Scripting (XSS) and SQL Injection (SQLi)GHSA-63CR-XG3F-8JVRMediumleantime/leantime: Leantime allows Stored Cross-Site Scripting (XSS)GHSA-52XF-H226-PFGXMediumleantime/leantime: Leantime allows Refelected Cross-Site Scripting (XSS)GHSA-H6W8-27PH-C385Mediumleantime/leantime: Leantime has Insufficiently Protected Credentials GHSA-MG4C-884J-PCQ9Mediumleantime/leantime: Leantime allows Stored Cross-Site Scripting (XSS)GHSA-99R5-84GR-59F6Mediumleantime/leantime: Leantime has Host Header Injection Vulnerability CVE-2024-57602Criticalalextselegidis/easyappointments: Easy!Appointments Improper Restriction of Excessive Authentication Attempts CVE-2024-57601Mediumalextselegidis/easyappointments: Remote code execution in alextselegidis/easyappointments GHSA-C2P2-HGJG-9R3FCriticalislandora/crayfish: Crayfish Allows Remote Code Execution via hypercube X-Islandora-Args Header CVE-2025-24434Criticalmagento/community-edition: Improper Authorization vulnerability in Magento and Adobe Commerce CVE-2025-24437Mediummagento/community-edition: Magento Improper Access Control vulnerability CVE-2025-24436Mediummagento/community-edition: Magento Improper Access Control vulnerability CVE-2025-24435Mediummagento/community-edition: Magento Improper Access Control vulnerability CVE-2025-24438Highmagento/community-edition: Magento stored Cross-Site Scripting (XSS) vulnerability CVE-2025-24427Mediummagento/community-edition: Magento Improper Access Control vulnerability CVE-2025-24425Mediummagento/community-edition: Magento Business Logic Error vulnerability CVE-2025-24428Mediummagento/community-edition: Magento stored Cross-Site Scripting (XSS) vulnerability CVE-2025-24430Lowmagento/community-edition: Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo