CO
Vendor
composer
8
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-59944 | CO composer composer | 6.1 | Sep 16 | Composer: CVE-2026-59946 fix bypass via symlinked package bin path |
| CVE-2026-84361 | CO composer composer | 7.7 | Sep 1 | Composer: Perforce source URL permits P4PORT `rsh:` command execution |
| CVE-2026-45793 | CO composer composer | 7.5 | Jul 15 | Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs |
| CVE-2026-59947 | CO composer composer | 4.7 | Jul 8 | Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure) |
| CVE-2026-59948 | CO composer composer | 7.0 | Jul 8 | Composer: Arbitrary file write outside vendor via malicious transitive package name |
| CVE-2026-59946 | CO composer composer | 6.1 | Jul 8 | Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files |
| CVE-2026-40261 | CO composer composer | 8.8 | Apr 15 | Composer has Command Injection via Malicious Perforce Reference |
| CVE-2026-40176 | CO composer composer | 7.8 | Apr 15 | Composer is vulnerable to Command Injection via Malicious Perforce Repository |