composer vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 20212
3. 20221
4. 20231
5. 20243
6. 20251
7. 20268

Newest CVEs

• CVE-2026-59944

  Composer: CVE-2026-59946 fix bypass via symlinked package bin path

  composer · composer

  Medium6.1
• CVE-2026-84361

  Composer: Perforce source URL permits P4PORT `rsh:` command execution

  composer · composer

  High7.7
• CVE-2026-45793

  Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs

  composer · composer

  High7.5
• CVE-2026-59947

  Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)

  composer · composer

  Medium4.7
• CVE-2026-59948

  Composer: Arbitrary file write outside vendor via malicious transitive package name

  composer · composer

  High7.0
• CVE-2026-59946

  Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files

  composer · composer

  Medium6.1
• CVE-2026-40261

  Composer has Command Injection via Malicious Perforce Reference

  composer · composer

  High8.8
• CVE-2026-40176

  Composer is vulnerable to Command Injection via Malicious Perforce Repository

  composer · composer

  High7.8
• CVE-2025-67746

  Composer vulnerable to ANSI sequence injection

  composer · composer

  Low1.3
• CVE-2024-35242

  Composer vulnerable to command injection via malicious git/hg branch names

  composer · composer

  High8.8