Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2024-41800Mediumcraftcms/cms: Craft CMS Allows TOTP Token To Stay Valid After Use CVE-2024-40137Highdolibarr/dolibarr: Dolibarr ERP CRM vulnerable to remote code execution (RCE) CVE-2024-41709Mediumbackdrop/backdrop: Backdrop CMS does not sufficiently sanitize field labels before they are displayed in certain places CVE-2024-40400Highautomad/automad: Automad arbitrary file upload vulnerability CVE-2024-41597Lowprocesswire/processwire: ProcessWire Cross Site Request Forgery vulnerability CVE-2024-36694Mediumopencart/opencart: openCart Server-Side Template Injection (SSTI) vulnerability GHSA-52CW-PVQ9-9M5VMediumsilverstripe/framework: Silverstripe uses TinyMCE which allows svg files linked in object tags CVE-2024-40633Highsylius/sylius: Sylius has a security vulnerability via adjustments API endpoint CVE-2024-32981Mediumsilverstripe/framework: Silverstripe Framework has a Cross-site Scripting vulnerability with encoded payload CVE-2024-29885Mediumsilverstripe/reports: Silverstripe Reports are still accessible even when `canView()` returns false CVE-2024-40624Criticaltorrentpier/torrentpier: TorrentPier Deserialization of Untrusted Data vulnerability CVE-2024-39912Mediumweb-auth/webauthn-lib: The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames CVE-2023-6813Mediumauth0/wordpress: Login by Auth0 plugin for WordPress vulnerable to Reflected Cross-Site Scripting CVE-2024-39899Mediumprivatebin/privatebin: PrivateBin allows shortening of URLs for other domains CVE-2024-36676Highssddanbrown/bookstack: BookStack Incorrect Access Control vulnerability CVE-2024-40614Highegroupware/egroupware: EGroupware mishandles an ORDER BY clause CVE-2024-39325Mediumaimeos/ai-controller-frontend: ai-controller-frontend payment status in basket isn't reset CVE-2024-6524Mediumshopxo/shopxo: ShopXO Server-Side Request Forgery Vulnerability CVE-2024-39322Mediumaimeos/ai-admin-jsonadm: aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required records CVE-2024-39324Lowaimeos/ai-admin-graphql: aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own services CVE-2024-39323Highaimeos/ai-admin-graphql: aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account CVE-2023-52892Highphpseclib/phpseclib: Name confusion in x509 Subject Alternative Name fields CVE-2024-24764Lowoctober/system: October System module has an Open Redirect for Administrator Accounts CVE-2024-25637Lowoctober/system: October System module has a Reflected XSS via X-October-Request-Handler Header CVE-2024-37843Criticalcraftcms/cms: Craft CMS SQL injection vulnerability via the GraphQL API endpoint

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.