Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-G7M4-839X-CH6VHighspomky-labs/otphp: spomky-labs/otphp: Unbounded digits parameter in a provisioning URI triggers an uncaught DivisionByZeroError in OTP generation CVE-2026-54005Highgetkirby/cms: Kirby: `pages.access` permission is not checked in the `site/find` REST API route CVE-2026-54004Mediumgetkirby/cms: Kirby: Access to files of top-level drafts is not protected by permissions CVE-2026-54003Criticalgetkirby/cms: Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header CVE-2026-54002Highgetkirby/cms: Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`CVE-2026-50188Mediumgetkirby/cms: Kirby: Request header injection in `Http\Remote`CVE-2026-49276Highgetkirby/cms: Kirby: Self cross-site scripting (self-XSS) in the writer field CVE-2026-49274Mediumgetkirby/cms: Kirby: `pages.access` permission is not checked in the pages picker for parent pages CVE-2026-55890Mediumgetgrav/grav: Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr CVE-2026-55885Mediumgetgrav/grav: Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets CVE-2026-55746Highcotonti/cotonti: Cotonti: Stored Cross-Site Scripting in the Personal File Storage (PFS) module CVE-2026-55745Mediumcotonti/cotonti: Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) module CVE-2026-55742Criticalcotonti/cotonti: Cotonti: Cross-Site Request Forgery in the administration rights handler CVE-2026-55744Highcotonti/cotonti: Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) module CVE-2026-11407Highpimcore/pimcore: Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed CVE-2026-55590Mediumcakephp/authentication: CakePHP Authentication: Open redirect weakness via backslash bypass CVE-2026-55409Highfilament/forms: Filament: Disabled RichEditor field state can be used for XSS GHSA-CRMM-HGP2-WGRPMediumlaravel/framework: Laravel Framework: Temporary Signed URL Path Confusion GHSA-5VG9-5847-VVMQHighlaravel/framework: Laravel Framework: CRLF injection in default email rule CVE-2026-55599Mediumphpseclib/phpseclib: phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information…CVE-2026-48784Mediumsymfony/routing: Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986…CVE-2026-48760Mediumsymfony/html-sanitizer: Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing…CVE-2026-48747Mediumsymfony/mailomat-mailer: Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade CVE-2026-48736Mediumsymfony/http-client: Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in…CVE-2026-48489Highsymfony/security-http: Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.