See the full list of npm packages compromised in the "Keyv / Cacheable Supply Chain Compromise - Aug 2026" [View compromised packages].
Find out if you have vulnerabilities that put you at risk
Test your applicationsAPPLICATION
OPERATING SYSTEM
- L
Cross-site Request Forgery (CSRF)CVE-2026-8415
Affects concrete5/concrete5 | Versions >=9.0.0RC1, <9.5.1
Has fix
ComposerPublished 27 Jun 2026
- L
Cross-site Request Forgery (CSRF)CVE-2026-8433
Affects concrete5/concrete5 | Versions >=9.0.0RC1, <9.5.1
Has fix
ComposerPublished 27 Jun 2026
- M
Missing AuthorizationCVE-2026-8238
Affects concrete5/concrete5 | Versions <9.5.1
Has fix
ComposerPublished 27 Jun 2026
- C
Relative Path TraversalCVE-2026-8134
Affects concrete5/concrete5 | Versions <9.5.1
Has fix
ComposerPublished 27 Jun 2026
- M
Use of Weak HashCVE-2026-48488
Affects thorsten/phpmyfaq | Versions <4.1.4
Has fix
ComposerPublished 27 Jun 2026
- M
Use of Weak HashCVE-2026-48488
Affects phpmyfaq/phpmyfaq | Versions <4.1.4
Has fix
ComposerPublished 27 Jun 2026
- M
Improper AuthenticationCVE-2026-44584
Affects paymenter/paymenter | Versions <1.5.0
Has fix
ComposerPublished 27 Jun 2026
- M
Server-side Request Forgery (SSRF)CVE-2026-44583
Affects paymenter/paymenter | Versions <1.5.0
Has fix
ComposerPublished 27 Jun 2026
- M
Missing AuthorizationCVE-2026-44585
Affects paymenter/paymenter | Versions <1.5.0
Has fix
ComposerPublished 27 Jun 2026
- H
Arbitrary File UploadCVE-2025-58048
Affects paymenter/paymenter | Versions <1.2.11
Has fix
ComposerPublished 27 Jun 2026
- H
Cross-site Scripting (XSS)CVE-2026-55692
Affects starcitizenwiki/embedvideo | Versions <4.1.0
Has fix
ComposerPublished 27 Jun 2026
- C
Origin Validation ErrorCVE-2026-55791
Affects craftcms/cms | Versions >=4.0.0-RC1, <4.18>=5.0.0-RC1, <5.10
Has fix
ComposerPublished 27 Jun 2026
- M
Brute ForceCVE-2026-55795
Affects craftcms/commerce | Versions >=4.0.0, <4.11.2>=5.0.0, <5.6.5
Has fix
ComposerPublished 27 Jun 2026
Affects craftcms/commerce | Versions >=4.0.0, <4.11.2>=5.0.0, <5.6.5
Has fix
ComposerPublished 27 Jun 2026
- H
Cross-site Scripting (XSS)CVE-2026-55690
Affects starcitizenwiki/embedvideo | Versions <4.1.0
Has fix
ComposerPublished 27 Jun 2026
- M
Cross-site Scripting (XSS)CVE-2026-55877
Affects symfony/ux-icons | Versions >=2.17.0, <2.36.1>=3.0.0, <3.2.0
Has fix
ComposerPublished 27 Jun 2026
- H
Cross-site Scripting (XSS)CVE-2026-55691
Affects starcitizenwiki/embedvideo | Versions <4.1.0
Has fix
ComposerPublished 27 Jun 2026
- H
Directory TraversalCVE-2026-55878
Affects symfony/ux-toolkit | Versions >=2.32.0, <2.36.1>=3.0.0, <3.2.0
Has fix
ComposerPublished 27 Jun 2026
- M
Server-side Request Forgery (SSRF)CVE-2026-55374
Affects jleehr/canto-saas-api | Versions <3.0.0
Has fix
ComposerPublished 27 Jun 2026
- M
Cross-site Scripting (XSS)CVE-2026-60092
Affects wwbn/avideo | Versions >=0.0.0
Has fix
ComposerPublished 27 Jun 2026
- C
Command InjectionCVE-2026-55173
Affects wwbn/avideo | Versions >=0.0.0
Has fix
ComposerPublished 27 Jun 2026
- M
Cross-site Request Forgery (CSRF)CVE-2026-55745
Affects cotonti/cotonti | Versions >=0.0.0
Has fix
ComposerPublished 27 Jun 2026
- H
Cross-site Request Forgery (CSRF)CVE-2026-55744
Affects cotonti/cotonti | Versions >=0.0.0
Has fix
ComposerPublished 27 Jun 2026
- C
Cross-site Request Forgery (CSRF)CVE-2026-55742
Affects cotonti/cotonti | Versions >=0.0.0
Has fix
ComposerPublished 27 Jun 2026
- M
Use of GET Request Method With Sensitive Query StringsCVE-2026-55375
Affects jleehr/canto-saas-api | Versions <3.0.0
Has fix
ComposerPublished 27 Jun 2026
- H
Cross-site Scripting (XSS)CVE-2026-55746
Affects cotonti/cotonti | Versions >=0.0.0
Has fix
ComposerPublished 27 Jun 2026
Affects spomky-labs/otphp | Versions <11.4.3
Has fix
ComposerPublished 27 Jun 2026
Affects spomky-labs/otphp | Versions <11.4.3
Has fix
ComposerPublished 27 Jun 2026
- M
Insufficiently Protected CredentialsCVE-2026-55885
Affects getgrav/grav | Versions <1.7.53
Has fix
ComposerPublished 27 Jun 2026
- M
Cross-site Scripting (XSS)CVE-2026-55890
Affects getgrav/grav | Versions <2.0.0-rc.9
Has fix
ComposerPublished 27 Jun 2026