Composer vulnerabilities
CVEs whose affected-version data names the Composer package (composer). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-109153Medium· 6.3A vulnerability was detected in MosaicML Composer up to 0.32.1
A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint Extraction. The manipulation results in path traversal. The…
▾ SunlitMosaicML · ComposerEPSS 0.49%via NVD
CVE-2026-59944Medium· 6.1Composer is a dependency Manager for the PHP language
Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because Composer validates litera…
▾ Sunlitcomposer · composerEPSS 0.47%via NVD