CO
Product
Composer
9
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 7Medium 1Low 0
Watch
Add Composer to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-40261 | 8.8 | Apr 15 | Composer has Command Injection via Malicious Perforce Reference Affected: 1.0.0 through 2.2.26; 2.3.0 through 2.9.5 |
| CVE-2023-43655 | 8.8 | Sep 29 | Composer is a dependency manager for PHP Affected: before 1.10.27; 2.0.0 before 2.2.21; 2.3.0 before 2.6.4 |
| CVE-2015-8371 | 8.8 | Sep 21 | Composer before 2016-02-10 allows cache poisoning from other projects built on the same host Affected: 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +5 more |
| CVE-2022-24828 | 8.8 | Apr 13 | Composer is a dependency manager for the PHP programming language Affected: before 1.10.26; 2.0.0 before 2.2.12; 2.3.0 before 2.3.5 |
| CVE-2021-29472 | 8.8 | Apr 27 | Composer is a dependency manager for PHP Affected: before 1.10.22; 2.0 before 2.0.13 |
| CVE-2026-40176 | 7.8 | Apr 15 | Composer is vulnerable to Command Injection via Malicious Perforce Repository Affected: 1.0.0 through 2.2.26; 2.3.0 through 2.9.5 |
| CVE-2024-24821 | 7.8 | Feb 9 | Composer is a dependency Manager for the PHP language Affected: 2.0.0 before 2.2.23; 2.3.0 before 2.7.0 |
Showing 7