Ccomposer

Products

Exploited and recent CVEs

• CVE-2026-59944 Medium 6.1 Composer: CVE-2026-59946 fix bypass via symlinked package bin path 0.5%
• CVE-2026-84361 High 7.7 Composer: Perforce source URL permits P4PORT `rsh:` command execution 0.5%
• CVE-2026-45793 High 7.5 Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs 1.0%
• CVE-2026-59947 Medium 4.7 Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure) 0.1%
• CVE-2026-59948 High 7.0 Composer: Arbitrary file write outside vendor via malicious transitive package name 0.1%
• CVE-2026-59946 Medium 6.1 Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files 0.1%
• CVE-2026-40261 High 8.8 Composer has Command Injection via Malicious Perforce Reference 1.7%
• CVE-2026-40176 High 7.8 Composer is vulnerable to Command Injection via Malicious Perforce Repository 1.0%
• CVE-2025-67746 Low 1.3 Composer vulnerable to ANSI sequence injection 0.5%
• CVE-2024-35242 High 8.8 Composer vulnerable to command injection via malicious git/hg branch names 3.3%
• CVE-2024-35241 High 8.8 Composer vulnerable to command injection via malicious git branch name 1.1%
• CVE-2024-24821 High 8.8 Code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php in Composer 0.3%
• CVE-2023-43655 Medium 6.4 Remote Code Execution via web-accessible composer.phar 1.5%
• CVE-2022-24828 High 8.3 Missing input validation can lead to command execution in composer 1.9%
• CVE-2021-41116 High 8.2 Command injection in composer on Windows 2.8%
• CVE-2021-29472 High 8.8 Missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial in composer 4.8%
• CVE-2020-15145 Medium 6.7 Local privilege elevation in Composer-Setup for Windows 0.4%