Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-55878Highsymfony/ux-toolkit: symfony/ux-toolkit: Path Traversal Allows Arbitrary File Write and Read via Crafted Recipe Manifest CVE-2026-55877Mediumsymfony/ux-icons: symfony/ux-icons: XSS via unsanitized SVG content in local files and Iconify on-demand responses CVE-2026-55692Highstarcitizenwiki/embedvideo: StarCitizenWiki Extension Embed Video: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled CVE-2026-55795Mediumcraftcms/commerce: Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass GHSA-78VR-Q6CF-C7P6Mediumcraftcms/commerce: Craft Commerce: Partial Payment Amount Without Lower Bound Validation CVE-2026-55791Criticalcraftcms/cms: Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs CVE-2026-55691Highstarcitizenwiki/embedvideo: StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template CVE-2026-55690Highstarcitizenwiki/embedvideo: StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exception text CVE-2026-49216Mediumsymfony/ux-autocomplete: symfony/ux-autocomplete: XSS via unescaped AJAX response data CVE-2026-49215Lowsymfony/ux-live-component: symfony/ux-live-component: CSRF Protection Bypass — Accept Header is CORS-Safelisted CVE-2026-49212Lowsymfony/ux-live-component: symfony/ux-live-component: LiveComponentHydrator HMAC checksum lacks component and slot binding CVE-2026-49211Mediumsymfony/ux-autocomplete: symfony/ux-autocomplete: Information exposure via unescaped LIKE wildcards in EntitySearchUtil CVE-2026-49210Mediumsymfony/ux-live-component: symfony/ux-live-component: XSS via attacker-controlled child component tag CVE-2026-49209Lowsymfony/ux-live-component: symfony/ux-live-component: Denial of service via unbounded batch action requests CVE-2026-49208Mediumsymfony/ux-live-component: ux-live-component: Format-less date LiveProps parsed with the permissive DateTime constructor CVE-2026-55767Mediumguzzlehttp/guzzle: guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts CVE-2026-55766Mediumguzzlehttp/psr7: guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization CVE-2026-55568Mediumguzzlehttp/guzzle: guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext CVE-2026-55375Mediumjleehr/canto-saas-api: canto-saas-api: OAuth credentials exposed in URL query string and exception messages CVE-2026-55374Mediumjleehr/canto-saas-api: canto-saas-api: Authenticated API requests can be redirected via unencoded path variables GHSA-5739-39V2-5754Mediumweb-token/jwt-library: PHP JWT Library: RSA1_5 (RSAES-PKCS1-v1_5) decryption lacks implicit rejection, exposing a Bleichenbacher/Marvin padding oracle GHSA-JC38-X7X8-2XC8Highweb-token/jwt-library: PHP JWT Framework: JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks GHSA-3PRJ-6HQW-CM82Highweb-token/jwt-library: PHP JWT Library: PBES2-HS*+A*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of service GHSA-6VVH-PXR4-25R7Mediumweb-token/jwt-experimental: PHP JWT Framework: Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on…GHSA-2JX3-65F3-XR8RMediumspomky-labs/otphp: spomky-labs/otphp: Mass-assignment in Factory::loadFromProvisioningUri lets a hostile provisioning URI corrupt OTP state or leak an…

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo