Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-54181Mediumbackpack/crud: Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are invertedCVE-2026-54180Highbackpack/crud: Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)CVE-2026-54179Mediumbackpack/crud: Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public diskCVE-2026-54178Highbackpack/crud: Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDiskCVE-2026-54177Mediumbackpack/crud: Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserverCVE-2026-54176Mediumbackpack/crud: Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password checkCVE-2026-54175Highbackpack/crud: Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignmentCVE-2026-62673Highgetgrav/grav: Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystemsCVE-2026-61807Mediumsnipe/snipe-it: Snipe-IT: Stored DOM XSS via table selected-count IDsCVE-2026-55703Mediumsnipe/snipe-it: Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GETCVE-2026-55694Highsnipe/snipe-it: Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File TakeoverCVE-2026-55643Highsnipe/snipe-it: Snipe-IT: Tenant Isolation Bypass in FMCS Floater ModeCVE-2026-53965Highmcp/sdk: MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiterGHSA-7GWW-X7FH-JF9JHighlibrenms/librenms: LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig pageGHSA-7CJ5-V4PP-V632Mediumlibrenms/librenms: LibreNMS: Stored XSS via graph_descr admin config settings echoed without escaping to all authenticated usersGHSA-JF24-8G2H-2WG7Mediumlibrenms/librenms: LibreNMS Vulnerable to Remote Code Execution via AboutControllerCVE-2026-62988Criticalfroxlor/froxlor: Froxlor: Credential and 2FA secret disclosure via Froxlor API endpointsCVE-2026-55593Mediumfroxlor/froxlor: Froxlor has CSRF Vulnerability in AJAX Endpoint — Missing Cross-Site Request Forgery ProtectionCVE-2026-54543Mediumfroxlor/froxlor: Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fieldsCVE-2026-54348Highfroxlor/froxlor: Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database ExfiltrationCVE-2026-54347Highfroxlor/froxlor: Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account TakeoverCVE-2026-55224Highmineadmin/mineadmin: MineAdmin Vulnerable to Path Traversal via Unsanitized identifier in Plugin Install/UninstallCVE-2026-54133Criticalmtdowling/jmespath.php: jmespath.php has CompilerRuntime code injection via unescaped function namesCVE-2026-55182Highlibrenms/librenms: LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation moduleCVE-2026-53653Highgetgrav/grav: Grav: Unauthenticated denial of service via unbounded image derivative dimensions

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo