Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2024-47605Mediumsilverstripe/framework: Silverstripe Framework has a XSS via insert media remote file oembed CVE-2025-23081Mediummediawiki/data-transfer: Mediawiki - DataTransfer Extension Cross-Site Request Forgery (CSRF) and Cross-site Scripting (XSS)CVE-2024-55945Mediumtypo3/cms-lowlevel: TYPO3 DB Check Module vulnerable to Cross-Site Request Forgery CVE-2024-55924Hightypo3/cms-scheduler: TYPO3 Scheduler Module vulnerable to Cross-Site Request Forgery CVE-2024-55923Mediumtypo3/cms-indexed-search: TYPO3 Indexed Search Module vulnerable to Cross-Site Request Forgery CVE-2024-55922Mediumtypo3/cms-form: TYPO3 Form Framework Module vulnerable to Cross-Site Request Forgery CVE-2024-55921Hightypo3/cms-extensionmanager: TYPO3 Extension Manager Module vulnerable to Cross-Site Request Forgery CVE-2024-55920Mediumtypo3/cms-dashboard: TYPO3 Cross-Site Request Forgery in Dashboard Module CVE-2024-55894Mediumtypo3/cms-beuser: TYPO3 Cross-Site Request Forgery in Backend User Module CVE-2024-55893Mediumtypo3/cms-belog: TYPO3 Cross-Site Request Forgery in Log Module CVE-2024-55892Mediumtypo3/cms-core: TYPO3 Potential Open Redirect via Parsing Differences CVE-2024-55891Lowtypo3/cms-install: TYPO3 Information Disclosure via Exception Handling/Logger CVE-2024-33298Mediummicroweber/microweber: Microweber Cross-site Scripting vulnerability CVE-2024-33299Mediummicroweber/microweber: Microweber Cross-site Scripting vulnerability CVE-2024-33297Mediummicroweber/microweber: Microweber Cross-site Scripting vulnerability CVE-2024-13274Mediumgoalgorilla/open_social: Drupal Open Social allows Functionality Misuse CVE-2025-22145Mediumnesbot/carbon: Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale GHSA-95M2-CHM4-MQ7MHighnetcarver/textile: PHP-Textile has persistent XSS vulnerability in image link handling CVE-2024-35498Lowgetgrav/grav: Grav Cross-site Scripting vulnerability CVE-2024-46209Lowredaxo/source: REDAXO CMS Cross-site Scripting vulnerability CVE-2025-21617Mediumguzzlehttp/oauth-subscriber: Guzzle OAuth Subscriber has insufficient nonce entropy CVE-2025-21612Highstarcitizentools/tabber-neue: Extension:TabberNeue vulnerable to Cross-site Scripting CVE-2024-56412Mediumphpoffice/phpspreadsheet: PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters CVE-2024-56411Mediumphpoffice/phpspreadsheet: PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header CVE-2024-56410Mediumphpoffice/phpspreadsheet: PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo