Vulnerabilities

TI-2026-29055 CVE-2026-40261 · GHSA-gqw4-4w2p-838q

Composer has Command Injection via Malicious Perforce Reference

MEDIUM 43

Composer is a dependency manager for PHP.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01688 Published 2026-04-15 Fixed in 2.9.6, 2.2.27 CWE-20

TI-2026-28990 CVE-2026-40176 · GHSA-wg36-wvj6-r67p

LOW 38

Composer is a dependency manager for PHP.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.01045 Published 2026-04-15 Fixed in 2.9.6, 2.2.27 CWE-20

TI-2025-41442 CVE-2025-67746 · GHSA-59pp-r3rg-353g

LOW 8

Composer is a dependency manager for PHP.

CVSS 4.0LOW 1.3 Network Low privileges No interaction EPSS 0.00453 Published 2025-12-30 Fixed in 2.2.26, 2.9.3 CWE-74

TI-2024-16338 CVE-2024-24821 · GHSA-7c6p-848j-wh5h

MEDIUM 40

Composer is a dependency Manager for the PHP language.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00279 Published 2024-02-08 Fixed in 2.2.23, 2.7 +1 CWE-829

TI-2023-23380 CVE-2023-43655 · GHSA-jm6m-4632-36hf

MEDIUM 43

Composer is a dependency manager for PHP.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01532 Published 2023-09-29 Fixed in 2.2.22, 1.10.27 +1 CWE-74

TI-2015-06892 CVE-2015-8371 · GHSA-725m-w832-q973

HIGH 73

Composer before 2016-02-10 allows cache poisoning from other projects built on the same host.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00723 Published 2023-09-21 Fixed in 1.0.0 CWE-345

TI-2022-08641 CVE-2022-24828 · GHSA-x7cr-6qr6-2hh6

MEDIUM 44

Composer is a dependency manager for the PHP programming language.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01886 Published 2022-04-13 Fixed in 1.10.26, 2.2.12 +2 CWE-20

TI-2021-17955 CVE-2021-41116 · GHSA-frqg-7g38-6gcf

MEDIUM 47

Composer is an open source dependency manager for the PHP language.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02825 Published 2021-10-05 Fixed in 1.10.23, 2.1.9 CWE-77

TI-2021-10185 CVE-2021-29472 · GHSA-h5h8-pc6h-jvvx

MEDIUM 46

Composer is a dependency manager for PHP.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.04752 Published 2021-04-27 Fixed in 1.10.22, 2.0.13 CWE-88