Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-54718Highsymbiote/silverstripe-advancedworkflow: silverstripe-advancedworkflow vulnerable to remote code execution via advanced workflow email template CVE-2026-54713Lowcakephp/queue: cakephp/queue's Incomplete Comparison in getUniqueId vulnerable to collisions CVE-2026-54721Highsilverstripe/userforms: silverstripe/userforms vulnerable to remote code execution via userforms email subject CVE-2026-54720Mediumsilverstripe/framework: Silverstripe Framework: Possible XSS attack through media embed CVE-2026-44701Lowdevcode-it/openstamanager: OpenSTAManager has HTML Injection in modules/utenti/edit.php GHSA-7W8C-QGXG-M7JXHighlibrenms/librenms: LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates CVE-2026-54614Mediumcakephp/debug_kit: cakephp/debug_kit: MailPreview contains unsafe reflection GHSA-PG62-F8G4-4WQHHighphpmyfaq/phpmyfaq: phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold GHSA-MF8R-WM2W-F8C5Mediumthorsten/phpmyfaq: phpMyFAQ public FAQ APIs expose inactive FAQ content GHSA-88G4-74F3-63X9Mediumthorsten/phpmyfaq: phpMyFAQ has Potential Authenticated Path Traversal in PDF Export CVE-2026-63135Highyourls/yourls: YOURLS has stored XSS in referrer statistics chart via crafted Referer header CVE-2026-59989Criticalphalcon/cphalcon: Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)GHSA-8HGV-XC77-JMCRMediumgetgrav/grav: Grav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's assets.addJs/addCss allowlist, escalating to…GHSA-HQ84-X37P-J6Q5Mediumwinter/wn-backend-module: Winter: Reflected XSS through the search query parameter in the backend Table widget GHSA-P2CH-C2C3-4XM5Mediumwinter/wn-backend-module: Winter: CSRF through AJAX handler names reachable as backend page actions GHSA-5CWR-5JXG-PCF6Mediumwinter/wn-backend-module: Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles GHSA-FM29-4MQ3-PHG6Highwinter/wn-backend-module: Winter: ImportExportController AJAX handlers bypass granular import/export permission gate GHSA-MPMW-F6H6-3G26Mediumwinter/wn-backend-module: Winter: My Account preview exposes another backend user's profile by record ID GHSA-7MPF-4465-7FC2Lowwinter/wn-backend-module: Winter: Stored XSS through Backend List widget image columns GHSA-8CFW-PCWH-V63WHighwinter/wn-system-module: Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149)GHSA-2223-F22X-24CQMediumwinter/wn-system-module: Winter: Local File Inclusion through =include directives in JavaScript asset compilation CVE-2026-63179Mediumwinter/wn-backend-module: Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets CVE-2026-57570Mediumbackpack/crud: Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation CVE-2026-54256Mediumwinter/wn-backend-module: Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata CVE-2026-54182Highbackpack/crud: Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo