Product by Open Source
Composer
8 known vulnerabilities in Composer (Open Source), 0 of them actively exploited (CISA KEV).
Key figures
8
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-40261 | Composer has Command Injection via Malicious Perforce Reference | 8.8 | |
| High | CVE-2026-40176 | Composer is vulnerable to Command Injection via Malicious Perforce Repository | 7.8 | |
| Medium | CVE-2026-59944 | Composer: CVE-2026-59946 fix bypass via symlinked package bin path | 6.1 | |
| Medium | CVE-2026-11914 | Composer - Critical - Unsupported - SA-CONTRIB-2026-046 | 5.9 | |
| High | CVE-2026-59948 | Composer: Arbitrary file write outside vendor via malicious transitive package name | 7.0 | |
| High | CVE-2024-24821 | Composer: Inclusion of Functionality from Untrusted Control Sphere | 8.8 | |
| Medium | CVE-2026-59946 | Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files | 6.1 | |
| Medium | CVE-2026-59947 | Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure) | 4.7 |