Package ecosystem
Packagist package vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 6,590 vulnerabilities in Packagist packages: 4 in the last 7 days and 314 in the last 90 days, 131 of them critical and 22 exploited in the wild. The most recent, CVE-2026-84987, was published on 12 November 2026. 34 vulnerabilities in the last four weeks, down 65% on the four before (98). 1 critical against 5. 336 packages have a page of their own.
- Last 7 days
- 4
- Last 90 days
- 314
- Critical, all time
- 131
- Exploited in the wild
- 22
About Packagist
Composer repository for PHP packages.
Packagist packages
- moodle/moodle (Packagist)434
- magento/community-edition (Packagist)362
- typo3/cms (Packagist)187
- wwbn/avideo (Packagist)164
- magento/project-community-edition (Packagist)161
- drupal/core (Packagist)150
- pimcore/pimcore (Packagist)145
- craftcms/cms (Packagist)143
- dolibarr/dolibarr (Packagist)127
- getgrav/grav (Packagist)127
- typo3/cms-core (Packagist)127
- concrete5/concrete5 (Packagist)122
- thorsten/phpmyfaq (Packagist)119
- librenms/librenms (Packagist)107
- phpmyadmin/phpmyadmin (Packagist)107
- microweber/microweber (Packagist)106
- symfony/symfony (Packagist)102
- silverstripe/framework (Packagist)93
- snipe/snipe-it (Packagist)81
- drupal/drupal (Packagist)79
- mantisbt/mantisbt (Packagist)74
- shopware/platform (Packagist)71
- shopware/core (Packagist)65
- froxlor/froxlor (Packagist)60
- mautic/core (Packagist)58
- baserproject/basercms (Packagist)56
- getkirby/cms (Packagist)55
- phpmyfaq/phpmyfaq (Packagist)54
- admidio/admidio (Packagist)50
- statamic/cms (Packagist)44
- intelliants/subrion (Packagist)43
- nilsteampassnet/teampass (Packagist)42
- showdoc/showdoc (Packagist)42
- contao/core-bundle (Packagist)40
- ci4-cms-erp/ci4ms (Packagist)36
- phpoffice/phpspreadsheet (Packagist)35
- shopware/shopware (Packagist)34
- zendframework/zendframework1 (Packagist)34
- kimai/kimai (Packagist)33
- prestashop/prestashop (Packagist)33
- pocketmine/pocketmine-mp (Packagist)31
- yeswiki/yeswiki (Packagist)31
- mediawiki/core (Packagist)28
- laravel/framework (Packagist)28
- centreon/centreon (Packagist)27
- cockpit-hq/cockpit (Packagist)26
- contao/contao (Packagist)26
- facturascripts/facturascripts (Packagist)26
- funadmin/funadmin (Packagist)26
- grumpydictator/firefly-iii (Packagist)26
- openmage/magento-lts (Packagist)26
- october/system (Packagist)25
- simplesamlphp/simplesamlphp (Packagist)25
- sylius/sylius (Packagist)25
- typo3/cms-backend (Packagist)25
- magento/core (Packagist)24
- twig/twig (Packagist)24
- phpoffice/phpexcel (Packagist)23
- remdex/livehelperchat (Packagist)23
- zendframework/zendframework (Packagist)23
- cakephp/cakephp (Packagist)22
- tribalsystems/zenario (Packagist)22
- feehi/cms (Packagist)21
- symfony/security-http (Packagist)21
- alextselegidis/easyappointments (Packagist)20
- bagisto/bagisto (Packagist)20
- codeigniter4/framework (Packagist)20
- craftcms/commerce (Packagist)20
- dompdf/dompdf (Packagist)20
- pterodactyl/panel (Packagist)19
- studio-42/elfinder (Packagist)19
- topthink/framework (Packagist)19
- devcode-it/openstamanager (Packagist)18
- forkcms/forkcms (Packagist)18
- genix/cms (Packagist)18
- guzzlehttp/guzzle (Packagist)18
- league/commonmark (Packagist)18
- opencart/opencart (Packagist)18
- redaxo/source (Packagist)18
- smarty/smarty (Packagist)18
- composer/composer (Packagist)17
- francoisjacquet/rosariosis (Packagist)17
- nukeviet/nukeviet (Packagist)17
- pimcore/admin-ui-classic-bundle (Packagist)17
- sulu/sulu (Packagist)17
- symfony/security (Packagist)17
- yetiforce/yetiforce-crm (Packagist)17
- ezsystems/ezpublish-kernel (Packagist)16
- phpbb/phpbb (Packagist)16
- silverstripe/cms (Packagist)16
- wallabag/wallabag (Packagist)16
- bolt/bolt (Packagist)15
- ec-cube/ec-cube (Packagist)15
- symfony/http-foundation (Packagist)15
- winter/wn-backend-module (Packagist)15
- feehi/feehicms (Packagist)14
- leantime/leantime (Packagist)14
- modx/revolution (Packagist)14
- lavalite/cms (Packagist)14
- phpmailer/phpmailer (Packagist)14
- phpseclib/phpseclib (Packagist)14
- elefant/cms (Packagist)13
- impresscms/impresscms (Packagist)13
- october/october (Packagist)13
- pagekit/pagekit (Packagist)13
- yiisoft/yii2 (Packagist)13
- shopper/framework (Packagist)12
- backpack/crud (Packagist)11
- ezsystems/ezplatform-kernel (Packagist)11
- ezsystems/ezpublish-legacy (Packagist)11
- tinymce/tinymce (Packagist)11
- billz/raspap-webgui (Packagist)10
- code16/sharp (Packagist)10
- croogo/croogo (Packagist)10
- ezsystems/ezplatform-admin-ui (Packagist)10
- mediawiki/semantic-media-wiki (Packagist)10
- roundcube/roundcubemail (Packagist)10
- spatie/browsershot (Packagist)10
- ssddanbrown/bookstack (Packagist)10
- verbb/formie (Packagist)10
- azuracast/azuracast (Packagist)9
- Composer (Packagist)9
- concrete5/core (Packagist)9
- contao/core (Packagist)9
- flarum/core (Packagist)9
- in2code/femanager (Packagist)9
- in2code/powermail (Packagist)9
- kevinpapst/kimai2 (Packagist)9
- krayin/laravel-crm (Packagist)9
- opensource-workshop/connect-cms (Packagist)9
- october/cms (Packagist)9
- vrana/adminer (Packagist)9
- pimcore/customer-management-framework-bundle (Packagist)9
- simplesamlphp/saml2 (Packagist)9
- starcitizentools/citizen-skin (Packagist)9
- typo3/cms-form (Packagist)9
- yourls/yourls (Packagist)9
- api-platform/core (Packagist)8
- automad/automad (Packagist)8
- backdrop/backdrop (Packagist)8
- codiad/codiad (Packagist)8
- directmailteam/direct-mail (Packagist)8
- enshrined/svg-sanitize (Packagist)8
- filament/filament (Packagist)8
- gilacms/gila (Packagist)8
- joomla/joomla-cms (Packagist)8
- limesurvey/limesurvey (Packagist)8
- phanan/koel (Packagist)8
- privatebin/privatebin (Packagist)8
- silverstripe/admin (Packagist)8
- silverstripe/graphql (Packagist)8
- symfony/http-kernel (Packagist)8
- tecnickcom/tcpdf (Packagist)8
- twbs/bootstrap (Packagist)8
- adminneo-org/adminneo (Packagist)7
- egroupware/egroupware (Packagist)7
- getformwork/formwork (Packagist)7
- idno/known (Packagist)7
- livewire/livewire (Packagist)7
- october/backend (Packagist)7
- passbolt/passbolt_api (Packagist)7
- paymenter/paymenter (Packagist)7
- shopxo/shopxo (Packagist)7
- unopim/unopim (Packagist)7
- wpglobus/wpglobus (Packagist)7
- yiisoft/yii2-dev (Packagist)7
- adodb/adodb-php (Packagist)6
- auth0/symfony (Packagist)6
- auth0/wordpress (Packagist)6
- cachethq/cachet (Packagist)6
- drupal/core-recommended (Packagist)6
- dweeves/magmi (Packagist)6
- gleez/cms (Packagist)6
- guzzlehttp/psr7 (Packagist)6
- ibexa/admin-ui (Packagist)6
- icecoder/icecoder (Packagist)6
- mineadmin/mineadmin (Packagist)6
- nystudio107/craft-seomatic (Packagist)6
- october/rain (Packagist)6
- oro/platform (Packagist)6
- pheditor/pheditor (Packagist)6
- processwire/processwire (Packagist)6
- silverstripe/assets (Packagist)6
- solspace/craft-freeform (Packagist)6
- symfony/ux-live-component (Packagist)6
- symfony/yaml (Packagist)6
- typo3/cms-install (Packagist)6
- typo3/html-sanitizer (Packagist)6
- zoujingli/thinkadmin (Packagist)6
- anchorcms/anchor-cms (Packagist)5
- auth0/auth0-php (Packagist)5
- auth0/login (Packagist)5
- bottelet/flarepoint (Packagist)5
- buddypress/buddypress (Packagist)5
- codeigniter/framework (Packagist)5
- elgg/elgg (Packagist)5
- flightphp/core (Packagist)5
- gugoan/economizzer (Packagist)5
- ibexa/core (Packagist)5
- illuminate/database (Packagist)5
- mautic/core-lib (Packagist)5
- neos/flow (Packagist)5
- neos/neos (Packagist)5
- notrinos/notrinos-erp (Packagist)5
- juzaweb/cms (Packagist)5
- pear/archive_tar (Packagist)5
- phppgadmin/phppgadmin (Packagist)5
- phpservermon/phpservermon (Packagist)5
- phpxmlrpc/phpxmlrpc (Packagist)5
- shopware/storefront (Packagist)5
- starcitizenwiki/embedvideo (Packagist)5
- symfony/html-sanitizer (Packagist)5
- symfony/security-bundle (Packagist)5
- symfony/security-core (Packagist)5
- tcg/voyager (Packagist)5
- thinkcmf/thinkcmf (Packagist)5
- tpwd/ke_search (Packagist)5
- typo3/flow (Packagist)5
- woocommerce/woocommerce (Packagist)5
- aws/aws-sdk-php (Packagist)4
- bref/bref (Packagist)4
- bytefury/crater (Packagist)4
- ckeditor/ckeditor (Packagist)4
- codeigniter4/shield (Packagist)4
- cotonti/cotonti (Packagist)4
- dcat/laravel-admin (Packagist)4
- elmsln/haxcms (Packagist)4
- evolutioncms/evolution (Packagist)4
- ezsystems/ezplatform (Packagist)4
- ezyang/htmlpurifier (Packagist)4
- filament/tables (Packagist)4
- filegator/filegator (Packagist)4
- flarum/framework (Packagist)4
- friendsofsymfony/user-bundle (Packagist)4
- froala/wysiwyg-editor (Packagist)4
- ibexa/fieldtype-richtext (Packagist)4
- knplabs/knp-snappy (Packagist)4
- magento/product-community-edition (Packagist)4
- moonshine/moonshine (Packagist)4
- oro/commerce (Packagist)4
- drupal/ai (Packagist)4
- phpunit/phpunit (Packagist)4
- pixelfed/pixelfed (Packagist)4
- pontedilana/php-weasyprint (Packagist)4
- prestashop/ps_checkout (Packagist)4
- pyrocms/pyrocms (Packagist)4
- react/http (Packagist)4
- reportico-web/reportico (Packagist)4
- robrichards/xmlseclibs (Packagist)4
- simplesamlphp/saml2-legacy (Packagist)4
- sjbr/sr-feuser-register (Packagist)4
- sylius/resource-bundle (Packagist)4
- symfony/routing (Packagist)4
- tastyigniter/tastyigniter (Packagist)4
- torrentpier/torrentpier (Packagist)4
- typo3/cms-frontend (Packagist)4
- web-auth/webauthn-framework (Packagist)4
- wintercms/winter (Packagist)4
- wp-graphql/wp-graphql (Packagist)4
- wp-premium/gravityforms (Packagist)4
- yiisoft/yii (Packagist)4
- zendframework/zendopenid (Packagist)4
- aimeos/ai-admin-graphql (Packagist)3
- aimeos/aimeos-core (Packagist)3
- amphp/http-client (Packagist)3
- apache-solr-for-typo3/solr (Packagist)3
- appwrite/server-ce (Packagist)3
- artesaos/seotools (Packagist)3
- badaso/core (Packagist)3
- bbpress/bbpress (Packagist)3
- cakephp/database (Packagist)3
- coreshop/core-shop (Packagist)3
- doctrine/orm (Packagist)3
- enhavo/enhavo-app (Packagist)3
- ezsystems/ezplatform-admin-ui-assets (Packagist)3
- ezsystems/ezplatform-richtext (Packagist)3
- facade/ignition (Packagist)3
- firebase/php-jwt (Packagist)3
- fixpunkt/fp-newsletter (Packagist)3
- geshi/geshi (Packagist)3
- goalgorilla/open_social (Packagist)3
- google/protobuf (Packagist)3
- ibexa/user (Packagist)3
- illuminate/auth (Packagist)3
- joomla/framework (Packagist)3
- laravel/laravel (Packagist)3
- matomo/matomo (Packagist)3
- mediawiki/cargo (Packagist)3
- mongodb/mongodb (Packagist)3
- nitsan/ns-backup (Packagist)3
- noumo/easyii (Packagist)3
- onelogin/php-saml (Packagist)3
- orchid/platform (Packagist)3
- phalcon/cphalcon (Packagist)3
- phenx/php-svg-lib (Packagist)3
- phpsysinfo/phpsysinfo (Packagist)3
- pimcore/studio-backend-bundle (Packagist)3
- piwik/piwik (Packagist)3
- prestashop/productcomments (Packagist)3
- qcubed/qcubed (Packagist)3
- quickapps/cms (Packagist)3
- rudloff/alltube (Packagist)3
- saloonphp/saloon (Packagist)3
- silverstripe/userforms (Packagist)3
- squizlabs/php_codesniffer (Packagist)3
- swiftmailer/swiftmailer (Packagist)3
- sylius/paypal-plugin (Packagist)3
- symfony/cache (Packagist)3
- symfony/form (Packagist)3
- symfony/framework-bundle (Packagist)3
- symfony/mime (Packagist)3
- symfony/ux-autocomplete (Packagist)3
- symfony/validator (Packagist)3
- typo3/cms-recycler (Packagist)3
- typo3/neos (Packagist)3
- typo3/phar-stream-wrapper (Packagist)3
- unisharp/laravel-filemanager (Packagist)3
- uvdesk/community-skeleton (Packagist)3
- verbb/comments (Packagist)3
- verot/class.upload.php (Packagist)3
- web-auth/webauthn-lib (Packagist)3
- webonyx/graphql-php (Packagist)3
- winter/wn-cms-module (Packagist)3
- winter/wn-system-module (Packagist)3
- yungifez/skuul (Packagist)3
- zencart/zencart (Packagist)3
- zendframework/zend-diactoros (Packagist)3
- zendframework/zend-http (Packagist)3
- zendframework/zendrest (Packagist)3
- zendframework/zendservice-amazon (Packagist)3
- zendframework/zendservice-api (Packagist)3
- zendframework/zendservice-audioscrobbler (Packagist)3
- zendframework/zendservice-nirvanix (Packagist)3
- zendframework/zendservice-slideshare (Packagist)3
- zendframework/zendservice-technorati (Packagist)3
- zendframework/zendservice-windowsazure (Packagist)3
Latest Packagist package vulnerabilities
- CVE-2026-84987: code16/sharp server-side request forgery in autocomplete endpointmediumCVSS 5.4
- CVE-2026-84974: Code16 Sharp arbitrary class instantiation in embed_key parametermediumCVSS 5.4
- CVE-2026-94619: FileGator path traversal in file upload via temporary directorymediumCVSS 5.9EPSS 0.2%
- CVE-2026-94618: FileGator missing authorization in batch downloadmediumCVSS 5.4EPSS 0.2%
- CVE-2026-33944: Dolibarr SQL injection in localtax parametershighCVSS 8.8
- CVE-2026-55186: SilverStripe MFA authentication bypass in password resetmediumCVSS 4.2
- CVE-2026-96634: AdminNeo SQLite regex backtracking filter bypass in ATTACH statement checkmediumCVSS 4
- CVE-2026-96633: AdminNeo SQLite database-list drop arbitrary file deletionhighCVSS 8.1
- CVE-2026-96631: AdminNeo cookie attribute injection via X-Forwarded-PrefixhighCVSS 8.2
- CVE-2026-96632: AdminNeo XSS via rogue MySQL server version string (CSP nonce bypass)highCVSS 4
- CVE-2026-96630: AdminNeo RCE via SQLite VACUUM INTO ATTACH blocklist bypasshighCVSS 7.2
- CVE-2026-96629: AdminNeo CSRF token vulnerability with session secret recoverymediumCVSS 6.8
- CVE-2026-59978: AdminNeo array injection in version endpoint causes denial of servicehighCVSS 7.5EPSS 0.7%
- CVE-2026-108515: Drupal core Link module cross-site scripting in markup sanitizationinfo
- CVE-2026-108514: Drupal Navigation module cross-site scripting in attributesinfo
- CVE-2026-108097: Drupal Core remote code execution in Field UI moduleinfo
- CVE-2026-107260: Drupal Sector distribution cross-site scripting in media namesinfo
- CVE-2026-119193: PHPUnit predictable temp directory in code coverage for PHPT testsmediumCVSS 4EPSS 0.1%
- CVE-2026-56828: Shopper privilege escalation via improper Livewire authorizationhighCVSS 8.8
- CVE-2026-116675: TinyMCE media plugin stored cross-site scriptinghighCVSS 4
- Laravel Livewire authorization bypass via reordered parameters and #[Json] execution ordermediumCVSS 6.5
- CVE-2026-108360: PHPOffice PhpSpreadsheet redirect validation bypass in external image loadingmediumCVSS 6.4EPSS 0.2%
- CVE-2026-108359: PhpSpreadsheet denial-of-service via unbounded row repetitionhighCVSS 4EPSS 0.4%
- CVE-2026-108358: PhpSpreadsheet XmlScanner XML entity expansion denial of servicehighCVSS 4EPSS 0.5%
- CVE-2026-108357: PHPOffice PhpSpreadsheet XML entity expansion denial of servicehighCVSS 4EPSS 0.4%
Most severe Packagist package vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-9082: Drupal Drupal core SQL injection in database abstraction APIcriticalexploited in the wildCVSS 9.8EPSS 15.7%
- CVE-2025-54236: Magento Community Edition Improper Input Validation vulnerabilitycriticalexploited in the wildCVSS 9.1EPSS 94.5%
- CVE-2017-9841: Code Injection in PHPUnitcriticalexploited in the wildCVSS 3.1EPSS 100.0%
- CVE-2024-34102: Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerabilitycriticalexploited in the wildCVSS 3.1EPSS 100.0%
- CVE-2021-3129: Unauthenticated remote code execution in Ignitioncriticalexploited in the wildCVSS 3.1EPSS 99.9%
- CVE-2025-32432: Craft CMS Allows Remote Code Executioncriticalexploited in the wildCVSS 3.1EPSS 99.8%
- CVE-2016-10033: Remote code execution in PHPMailercriticalexploited in the wildCVSS 3.1EPSS 99.7%
- CVE-2018-7602: Drupal Core Remote Code Execution Vulnerabilitycriticalexploited in the wildCVSS 3.1EPSS 99.2%
- CVE-2022-24086: Magento improper input validation vulnerabilitycriticalexploited in the wildCVSS 3.1EPSS 99.2%
- CVE-2025-49113: Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserializationcriticalexploited in the wildCVSS 3.1EPSS 98.9%
Vulnerabilities per week
34 vulnerabilities in the last four weeks, down 65% on the four before (98). 1 critical against 5. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 45 | 3 | |
| 24 Aug 2026 | 51 | 3 | |
| 31 Aug 2026 | 45 | 3 | |
| 7 Sep 2026 | 39 | 1 | |
| 14 Sep 2026 | 59 | 3 | |
| 21 Sep 2026 | 23 | 1 | |
| 28 Sep 2026 | 6 | 0 | |
| 5 Oct 2026 | 10 | 1 | |
| 12 Oct 2026 | 8 | 0 | |
| 19 Oct 2026 | 8 | 1 | |
| 26 Oct 2026 | 14 | 0 | |
| 2 Nov 2026 | 4 | 0 | |
| 9 Nov 2026 | 2 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Packagist package vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/packagist)<a href="https://junglewise.ai/threats/vendors/packagist"><img src="https://junglewise.ai/threats/vendors/packagist/badge.svg" alt="Packagist package vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/packagist.json, and this page as text at https://junglewise.ai/threats/vendors/packagist.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Packagist package vulnerabilities", https://junglewise.ai/threats/vendors/packagist, 13 November 2026.