CO
Product
composer
8
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 5Medium 3Low 0
Watch
Add composer to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-59944 | 6.1 | Sep 16 | Composer: CVE-2026-59946 fix bypass via symlinked package bin path Affected: >= 1.0.0, < 2.2.30; >= 2.3.0, < 2.10.3 |
| CVE-2026-59946 | 6.1 | Jul 8 | Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files Affected: >= 1.0, < 2.2.29; >= 2.3.0, < 2.10.2 |
| CVE-2026-59947 | 4.7 | Jul 8 | Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure) Affected: >= 1.0, < 2.2.29; >= 2.3.0, < 2.10.2 |
Showing 3