composer/composer vulnerabilities
CVEs whose affected-version data names the composer/composer package (composer). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-84361HighPoCComposer is a dependency Manager for the PHP language
Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url…
▾ Midnightcomposer · composer/composerEPSS 0.41%via NVD
CVE-2026-59947Medium· 4.7Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)
Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)
▾ Sunlitcomposer · composer/composerEPSS 0.14%via GHSA
CVE-2026-59946Medium· 6.1Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files
Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files
▾ Sunlitcomposer · composer/composerEPSS 0.17%via GHSA
CVE-2026-59948High· 7.0Composer: Arbitrary file write outside vendor via malicious transitive package name
Composer: Arbitrary file write outside vendor via malicious transitive package name
▾ Twilightcomposer · composer/composerEPSS 0.16%via GHSA