https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T09:08:57.404992+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2024-04878 bdu:2024-04878 2026-10-03T09:08:57.523467+00:00 bdu:2024-04878 https://cve.radiocsirt.org/vuln/bit-composer-2024-35241 BIT-composer-2024-35241 — Composer vulnerable to command injection via malicious git branch name 2026-10-03T09:08:57.523504+00:00

Affected: Bitnami: composer

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.

 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0836 certfr-2025-avi-0836 — De multiples vulnérabilités ont été découvertes dans Tenable Security Center. Elles permettent à un attaquant de provoq… 2026-10-03T09:08:57.523539+00:00 certfr-2025-avi-0836 https://cve.radiocsirt.org/vuln/cleanstart-2024-nd02975 CLEANSTART-2024-ND02975 — Composer is a dependency manager for PHP 2026-10-03T09:08:57.523558+00:00

Affected: CleanStart: composer

Security vulnerability affects the composer package. Composer is a dependency manager for PHP.

 https://cve.radiocsirt.org/vuln/euvd-2026-232172 EUVD-2026-232172 2026-10-03T09:08:57.523579+00:00 EUVD-2026-232172 https://cve.radiocsirt.org/vuln/fkie_cve-2024-35241 fkie_cve-2024-35241 2026-10-03T09:08:57.523590+00:00

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.

 https://cve.radiocsirt.org/vuln/ghsa-47f6-5gq3-vx9c GHSA-47f6-5gq3-vx9c — Composer has a command injection via malicious git branch name 2026-10-03T09:08:57.523613+00:00

Affected: Packagist: composer/composer

### Impact

The `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code.

### Patches

2.2.24 for 2.2 LTS or 2.7.7 for mainline

### Workarounds

Avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.

 https://cve.radiocsirt.org/vuln/opensuse-su-2024:14040-1 openSUSE-SU-2024:14040-1 — php-composer2-2.7.7-1.1 on GA media 2026-10-03T09:08:57.523638+00:00

php-composer2-2.7.7-1.1 on GA media

 https://cve.radiocsirt.org/vuln/suse-su-2024:2107-1 SUSE-SU-2024:2107-1 — Security update for php-composer2 2026-10-03T09:08:57.523656+00:00

Security update for php-composer2

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-35241 UBUNTU-CVE-2024-35241 2026-10-03T09:08:57.523671+00:00

Affected: Ubuntu:Pro:16.04:LTS: composer, Ubuntu:Pro:18.04:LTS: composer, Ubuntu:Pro:20.04:LTS: composer, Ubuntu:Pro:22.04:LTS: composer, Ubuntu:Pro:24.04:LTS: composer

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.