CVE-2026-45793 | High | 7.5 | 2026-07-15 | Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth toke… |
CVE-2026-59948 | High | 7.0 | 2026-07-08 | Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packag… |
CVE-2026-59947 | Medium | 4.7 | 2026-07-08 | Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential… |
CVE-2026-59946 | Medium | 6.1 | 2026-07-08 | Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside… |
CVE-2026-40261 | High | 8.8 | 2026-04-15 | Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCode… |
CVE-2026-40176 | High | 7.8 | 2026-04-15 | Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generate… |
CVE-2025-67746 | Medium | 4.3 | 2025-12-30 | Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer downloads… |
CVE-2024-35242 | High | 8.8 | 2024-06-10 | Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg reposito… |
CVE-2024-35241 | High | 8.8 | 2024-06-10 | Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages i… |
CVE-2024-24821 | High | 8.8 | 2024-02-09 | Composer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included during the invocation… |
CVE-2023-43655 | Medium | 6.4 | 2023-09-29 | Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php f… |
CVE-2022-24828 | High | 8.3 | 2022-04-13 | Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injectio… |
CVE-2021-41116 | High | 8.2 | 2021-10-05 | Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are s… |
CVE-2021-29472 | High | 8.8 | 2021-04-27 | Composer is a dependency manager for PHP. URLs for Mercurial repositories in the root composer.json and package source download URLs are not sanitized correctl… |
CVE-2020-15145 | Medium | 6.7 | 2020-08-14 | In Composer-Setup for Windows before version 6.0.0, if the developer's computer is shared with other users, a local attacker may be able to exploit the followi… |