Login Request a demo
CO
Product
Composer
by Getcomposer · last CVE Apr 15, 2026
11
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities11In the news0Timeline
Severity mix
Critical 1High 9Medium 1Low 0
Severity
All severities11Critical1High9Medium1Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Composer to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-40261
8.8
2%
Apr 15
Composer has Command Injection via Malicious Perforce Reference
Affected: 1.0.0 through 2.2.26; 2.3.0 through 2.9.5
CVE-2024-35242
8.8
3%
Jun 10
Composer vulnerable to command injection via malicious git/hg branch names
Affected: 2.0 before 2.2.24; 2.3 before 2.7.7
CVE-2024-35241
8.8
1%
Jun 10
Composer vulnerable to command injection via malicious git branch name
Affected: 2.0 before 2.2.24; 2.3 before 2.7.7
CVE-2023-43655
8.8
2%
Sep 29
Remote Code Execution via web-accessible composer.phar
Affected: before 1.10.27; 2.0.0 before 2.2.21; 2.3.0 before 2.6.4
CVE-2015-8371
8.8
1%
Sep 21
Composer before 2016-02-10 allows cache poisoning from other projects built on the same host
Affected: 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +5 more
CVE-2022-24828
8.8
2%
Apr 13
Composer is a dependency manager for the PHP programming language
Affected: before 1.10.26; 2.0.0 before 2.2.12; 2.3.0 before 2.3.5
CVE-2021-29472
8.8
5%
Apr 27
Composer is a dependency manager for PHP
Affected: before 1.10.22; 2.0 before 2.0.13
CVE-2026-40176
7.8
1%
Apr 15
Composer is vulnerable to Command Injection via Malicious Perforce Repository
Affected: 1.0.0 through 2.2.26; 2.3.0 through 2.9.5
CVE-2024-24821
7.8
0%
Feb 8
Code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php in Composer
Affected: 2.0.0 before 2.2.23; 2.3.0 before 2.7.0
Showing 9