CO
Vendor
composer
13
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-59944 | CO composer composer | 6.1 | Sep 16 | Composer: CVE-2026-59946 fix bypass via symlinked package bin path |
| CVE-2026-84361 | CO composer composer | 7.7 | Sep 1 | Composer: Perforce source URL permits P4PORT `rsh:` command execution |
| CVE-2026-45793 | CO composer composer | 7.5 | Jul 15 | Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs |
| CVE-2026-59947 | CO composer composer | 4.7 | Jul 8 | Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure) |
| CVE-2026-59948 | CO composer composer | 7.0 | Jul 8 | Composer: Arbitrary file write outside vendor via malicious transitive package name |
| CVE-2026-59946 | CO composer composer | 6.1 | Jul 8 | Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files |
| CVE-2026-40261 | CO composer composer | 8.8 | Apr 15 | Composer has Command Injection via Malicious Perforce Reference |
| CVE-2026-40176 | CO composer composer | 7.8 | Apr 15 | Composer is vulnerable to Command Injection via Malicious Perforce Repository |
| CVE-2025-67746 | CO composer composer | 4.3 | Dec 30 | Composer vulnerable to ANSI sequence injection |
| CVE-2024-35242 | CO composer composer | 8.8 | Jun 10 | Composer vulnerable to command injection via malicious git/hg branch names |
| CVE-2024-35241 | CO composer composer | 8.8 | Jun 10 | Composer vulnerable to command injection via malicious git branch name |
| CVE-2024-24821 | CO composer composer | 7.8 | Feb 8 | Code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php in Composer |
| CVE-2023-43655 | CO composer composer | 8.8 | Sep 29 | Remote Code Execution via web-accessible composer.phar |