CO
Product
composer
8
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 5Medium 3Low 0
Watch
Add composer to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-40261 | 8.8 | Apr 15 | Composer has Command Injection via Malicious Perforce Reference Affected: >= 2.3.0, < 2.9.6; >= 1.0.0, < 2.2.27 |
| CVE-2026-40176 | 7.8 | Apr 15 | Composer is vulnerable to Command Injection via Malicious Perforce Repository Affected: >= 2.3, < 2.9.6; >= 1.0, < 2.2.27 |
| CVE-2026-84361 | 7.7 | Sep 1 | Composer: Perforce source URL permits P4PORT `rsh:` command execution Affected: >= 1.0, < 2.2.30; >= 2.3.0, < 2.10.3 |
| CVE-2026-45793 | 7.5 | Jul 15 | Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs Affected: >= 1.0, < 1.10.28; >= 2.0.0, < 2.2.28; >= 2.3.0, < 2.9.8 |
| CVE-2026-59948 | 7.0 | Jul 8 | Composer: Arbitrary file write outside vendor via malicious transitive package name Affected: >= 1.0, < 2.2.29; >= 2.3.0, < 2.10.2 |
Showing 5