P
Vendor security profile
packagist
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs303
Critical27
CISA KEV0
Public exploit78
Patch rate%64
Avg. CVSS6.8
12-month vulnerability rate
0
0
0
2
7
1
1
18
74
103
82
13
CVE KEV
CVE severity distribution
303toplam CVE
Critical27 (9%)
High122 (40%)
Medium123 (41%)
Low22 (7%)
Uncertain9 (3%)
Patch and exploitation view
%64
Verified patch
%0
CISA KEV
%26
Public exploit
194Patch available
0Partial
2Workaround
0Vendor: no patch
107Unknown
Latest vulnerabilities
8.6
CVE-2026-65954
PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()
P
Patch status unknownEPSS %0
4.3
CVE-2026-107851
Contao: Improper access control in the table access voter
C
Patch status unknownEPSS %0
4.3
CVE-2026-107850
Contao: Improper access control in the preview links module
C
Patch status unknownEPSS %0
3.5
CVE-2026-107848
Contao: Cross-site request forgery in custom backend actions
C
Patch status unknownEPSS %0
9.3
CVE-2026-107845
Contao: Cross-site scripting in the comments bundle
C
Patch status unknownEPSS %0
5.3
CVE-2026-107844
Contao: Path traversal in the images controller
C
Patch status unknownEPSS %0
5.3
CVE-2026-107843
Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check
C
Patch status unknownEPSS %0
5.3
CVE-2026-107842
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
C
Patch status unknownEPSS %0
6.5
CVE-2026-107381
svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences
P
Patch status unknown
5.4
CVE-2026-107380
enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision
D
Patch status unknownEPSS %0