TI-2026-42751 CVE-2026-59944 · GHSA-96h3-5x6v-m776
Composer: CVE-2026-59946 fix bypass via symlinked package bin path
Priority LOW 28
Composer is a dependency Manager for the PHP language.
Vulnerabilities
18 records
TI-2026-57973 CVE-2026-84361 · GHSA-rvx4-ffvw-m9q3
Composer: Perforce source URL permits P4PORT `rsh:` command execution
Priority LOW 36
Composer is a dependency Manager for the PHP language.
TI-2026-33528 CVE-2026-45793 · GHSA-f9f8-rm49-7jv2
Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs
Priority MEDIUM 41
Composer is a dependency Manager for the PHP language.
TI-2026-42753 CVE-2026-59947 · GHSA-g6xq-892h-64w3
Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)
Priority LOW 20
Composer is a dependency Manager for the PHP language.
TI-2026-42754 CVE-2026-59948 · GHSA-499r-g7pc-vmp9
Composer: Arbitrary file write outside vendor via malicious transitive package name
Priority LOW 32
Composer is a dependency Manager for the PHP language.
TI-2026-42752 CVE-2026-59946 · GHSA-gjfg-22fp-rrxx
Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files
Priority LOW 26
Composer is a dependency Manager for the PHP language.
TI-2026-29055 CVE-2026-40261 · GHSA-gqw4-4w2p-838q
Composer has Command Injection via Malicious Perforce Reference
Priority MEDIUM 43
Composer is a dependency manager for PHP.
TI-2026-28990 CVE-2026-40176 · GHSA-wg36-wvj6-r67p
Composer is vulnerable to Command Injection via Malicious Perforce Repository
Priority LOW 38
Composer is a dependency manager for PHP.
TI-2025-41442 CVE-2025-67746 · GHSA-59pp-r3rg-353g
Composer vulnerable to ANSI sequence injection
Priority LOW 8
Composer is a dependency manager for PHP.
TI-2024-23311 CVE-2024-35242 · GHSA-v9qv-c7wm-wgmf
Composer vulnerable to command injection via malicious git/hg branch names
Priority MEDIUM 46
Composer is a dependency manager for PHP.
TI-2024-23310 CVE-2024-35241 · GHSA-47f6-5gq3-vx9c
Composer vulnerable to command injection via malicious git branch name
Priority MEDIUM 42
Composer is a dependency manager for PHP.
TI-2024-16338 CVE-2024-24821 · GHSA-7c6p-848j-wh5h
Code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php in Composer
Priority MEDIUM 40
Composer is a dependency Manager for the PHP language.
TI-2023-23380 CVE-2023-43655 · GHSA-jm6m-4632-36hf
Remote Code Execution via web-accessible composer.phar
Priority MEDIUM 43
Composer is a dependency manager for PHP.
TI-2015-06892 CVE-2015-8371 · GHSA-725m-w832-q973
Composer before 2016-02-10 allows cache poisoning from other projects built on the same…
Priority HIGH 73
Composer before 2016-02-10 allows cache poisoning from other projects built on the same host.
TI-2022-08641 CVE-2022-24828 · GHSA-x7cr-6qr6-2hh6
Missing input validation can lead to command execution in composer
Priority MEDIUM 44
Composer is a dependency manager for the PHP programming language.
TI-2021-17955 CVE-2021-41116 · GHSA-frqg-7g38-6gcf
Command injection in composer on Windows
Priority MEDIUM 47
Composer is an open source dependency manager for the PHP language.
TI-2021-10185 CVE-2021-29472 · GHSA-h5h8-pc6h-jvvx
Code injection in composer
Priority MEDIUM 46
Composer is a dependency manager for PHP.
Priority LOW 36
In Composer-Setup for Windows before version 6.0.0, if the developer's computer is shared with other users, a local attacker may be able to exploit the following scenarios.