Medium
CVE-2026-59944
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 19
Reset filters
High
CVE-2026-76839
Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()
High
CVE-2026-76846
Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled
High
CVE-2026-84361
Composer arbitrary command execution via a malicious package's Perforce source URL
Medium
CVE-2026-59946
Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files
Medium
CVE-2026-59947
Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)
High
CVE-2026-59948
Composer: Arbitrary file write outside vendor via malicious transitive package name
High
CVE-2026-45793
Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs
High
CVE-2026-40176
Composer has a command injection via malicious perforce repository
High
CVE-2026-40261
Composer has a command injection via malicious perforce reference
Low
CVE-2025-67746
Composer is vulnerable to ANSI sequence injection
High
CVE-2024-35241
Composer has a command injection via malicious git branch name
High
CVE-2024-35242
Composer has multiple command injections via malicious git/hg branch names
High
CVE-2024-24821
Composer code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php
High
CVE-2023-43655
Composer Remote Code Execution vulnerability via web-accessible composer.phar
High
CVE-2015-8371
Composer allows cache poisoning from other projects built on the same host
High
CVE-2022-24828
Missing input validation can lead to command execution in composer
High
CVE-2021-41116
Improper escaping of command arguments on Windows leading to command injection
High
CVE-2021-29472
Composer's missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.