Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-534C-HCR7-67JGHighkimai/kimai: Kimai has an XXE Leading to Local File Read CVE-2024-45803Mediumwireui/wireui: Wire UI has a JS XSS Vulnerability on route /wireui/button?label=Content CVE-2024-47047Mediumin2code/powermail: powermail TYPO3 extension has Insecure Direct Object Reference CVE-2024-47049Mediumczim/file-handling: czim/file-handling vulnerable to SSRF and directory traversal CVE-2024-45612Mediumcontao/core-bundle: Contao affected by insert tag injection via canonical URL CVE-2024-45604Mediumcontao/core-bundle: Contao affected by directory traversal in the file selector widget CVE-2024-45398Highcontao/core-bundle: Contao affected by remote command execution through file upload CVE-2024-8661Mediumconcrete5/concrete5: Concrete CMS Stored XSS in the "Next&Previous Nav" block CVE-2024-45592Mediumdamienharper/auditor-bundle: auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped CVE-2024-44902Criticaltopthink/framework: ThinkPHP deserialization vulnerability CVE-2024-45411Mediumtwig/twig: Twig has a possible sandbox bypass CVE-2024-45406Mediumcraftcms/cms: Craft CMS vulnerable to stored XSS in breadcrumb list and title fields GHSA-GCFG-HMWX-WQ5HMediumnategood/httpful: Httpful is Missing Certificate Validation GHSA-HQ76-662X-7MW4Highpimcore/data-importer: Pimcore includes vulnerable PHPOffice/PhpSpreadsheet CVE-2024-45232Mediumin2code/powermail: "powermail" (powermail) Insecure Direct Object Reference (IDOR)CVE-2024-45048Highphpoffice/phpspreadsheet: XXE in PHPSpreadsheet encoding is returned CVE-2024-45046Mediumphpoffice/phpspreadsheet: PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information CVE-2024-41964Highgetkirby/cms: Kirby has insufficient permission checks in the language settings CVE-2024-8296Mediumfeehi/cms: FeehiCMS User[avatar] unrestricted upload CVE-2024-8294Mediumfeehi/cms: FeehiCMS file upload vulnerability CVE-2024-8295Mediumfeehi/cms: FeehiCMS BannerForm[img] unrestricted upload CVE-2024-45440Mediumdrupal/drupal: Drupal Full Path Disclosure CVE-2024-45233Mediumin2code/powermail: Powermail TYPO3 extension Broken Access Control in the OutputController GHSA-34QG-65M4-F23MHighfroxlor/froxlor: Froxlor: /etc/pure-ftpd/db/mysql.conf is chmod 644 but contains <SQL_UNPRIVILEGED_PASSWORD>CVE-2024-43407Mediumckeditor4: Code Snippet GeSHi plugin in CKEditor 4 has reflected cross-site scripting (XSS) vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.