CO
Product
composer
8
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 5Medium 3Low 0
Watch
Add composer to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-40261 | 8.8 | Apr 15 | Composer has Command Injection via Malicious Perforce Reference Affected: >= 2.3.0, < 2.9.6; >= 1.0.0, < 2.2.27 |
| CVE-2026-40176 | 7.8 | Apr 15 | Composer is vulnerable to Command Injection via Malicious Perforce Repository Affected: >= 2.3, < 2.9.6; >= 1.0, < 2.2.27 |
| CVE-2026-84361 | 7.7 | Sep 1 | Composer: Perforce source URL permits P4PORT `rsh:` command execution Affected: >= 1.0, < 2.2.30; >= 2.3.0, < 2.10.3 |
| CVE-2026-45793 | 7.5 | Jul 15 | Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs Affected: >= 1.0, < 1.10.28; >= 2.0.0, < 2.2.28; >= 2.3.0, < 2.9.8 |
| CVE-2026-59948 | 7.0 | Jul 8 | Composer: Arbitrary file write outside vendor via malicious transitive package name Affected: >= 1.0, < 2.2.29; >= 2.3.0, < 2.10.2 |
| CVE-2026-59944 | 6.1 | Sep 16 | Composer: CVE-2026-59946 fix bypass via symlinked package bin path Affected: >= 1.0.0, < 2.2.30; >= 2.3.0, < 2.10.3 |
| CVE-2026-59946 | 6.1 | Jul 8 | Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files Affected: >= 1.0, < 2.2.29; >= 2.3.0, < 2.10.2 |
| CVE-2026-59947 | 4.7 | Jul 8 | Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure) Affected: >= 1.0, < 2.2.29; >= 2.3.0, < 2.10.2 |
Showing 8