Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2024-55417Mediumtcg/voyager: DevDojo Voyager Arbitrary File Write CVE-2024-55416Lowtcg/voyager: DevDojo Voyager vulnerable to reflected Cross-site Scripting CVE-2025-24374Mediumtwig/twig: Twig security issue where escaping was missing when using null coalesce operator CVE-2025-24856Mediumcausal/oidc: TYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc)CVE-2024-11956Mediumpimcore/customer-management-framework-bundle: pimcore/customer-data-framework vulnerable to SQL Injection CVE-2024-11954Highpimcore/pimcore: Pimcore Authenticated Stored Cross-Site Scripting (XSS) Via Search Document CVE-2024-55228Lowdolibarr/dolibarr: Dolibarr Cross-site Scripting vulnerability CVE-2024-55227Lowdolibarr/dolibarr: Dolibarr Cross-site Scripting vulnerability GHSA-74J9-XHQR-6QV3Lowsilverstripe/framework: Reflected Cross Site Scripting (XSS) in error message CVE-2025-24530Mediumphpmyadmin/phpmyadmin: phpMyAdmin XSS when checking tables CVE-2025-24027Mediumprestashop/ps_contactinfo: ps_contactinfo has a potential XSS due to usage of the nofilter tag in template CVE-2025-24013Mediumcodeigniter4/framework: Missing validation of header name and value in codeigniter4/framework CVE-2025-22131Mediumphpoffice/phpspreadsheet: Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet CVE-2025-24019Highyeswiki/yeswiki: Authenticated arbitrary file deletion in YesWiki CVE-2025-24018Highyeswiki/yeswiki: Authenticated Stored XSS in YesWiki CVE-2025-24017Highyeswiki/yeswiki: Unauthenticated DOM Based XSS in YesWiki CVE-2025-23209Highcraftcms/cms: Craft CMS has a potential RCE with a compromised security key CVE-2025-23201Mediumlibrenms/librenms: Librenms has a reflected XSS on error alert CVE-2025-23200Mediumlibrenms/librenms: LibreNMS Misc Section Stored Cross-site Scripting vulnerability CVE-2025-23199Mediumlibrenms/librenms: LibreNMS Ports Stored Cross-site Scripting vulnerability CVE-2025-23198Mediumlibrenms/librenms: LibreNMS Display Name Stored Cross-site Scripting vulnerability CVE-2024-56144Mediumlibrenms/librenms: LibreNMS Display Name 2 Stored Cross-site Scripting vulnerability CVE-2025-25286Criticalislandora/crayfish: Crayfish allows Remote Code Execution via Homarus Authorization header GHSA-MQF3-QPC3-G26QLowsilverstripe/framework: Silverstripe Framework has a Reflected Cross Site Scripting (XSS) in error message CVE-2024-53277Mediumsilverstripe/framework: Silverstripe Framework has a XSS in form messages

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.