https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T22:26:22.587085+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2024-04880 bdu:2024-04880 2026-10-03T22:26:22.708794+00:00 bdu:2024-04880 https://cve.radiocsirt.org/vuln/bit-composer-2024-35242 BIT-composer-2024-35242 — Composer vulnerable to command injection via malicious git/hg branch names 2026-10-03T22:26:22.708872+00:00

Affected: Bitnami: composer

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.

 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0836 certfr-2025-avi-0836 — De multiples vulnérabilités ont été découvertes dans Tenable Security Center. Elles permettent à un attaquant de provoq… 2026-10-03T22:26:22.708917+00:00 certfr-2025-avi-0836 https://cve.radiocsirt.org/vuln/cleanstart-2024-dd29597 CLEANSTART-2024-DD29597 — Composer is a dependency manager for PHP 2026-10-03T22:26:22.708937+00:00

Affected: CleanStart: composer

Security vulnerability affects the composer package. Composer is a dependency manager for PHP.

 https://cve.radiocsirt.org/vuln/euvd-2026-217420 EUVD-2026-217420 2026-10-03T22:26:22.708958+00:00 EUVD-2026-217420 https://cve.radiocsirt.org/vuln/fkie_cve-2024-35242 fkie_cve-2024-35242 2026-10-03T22:26:22.708970+00:00

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.

 https://cve.radiocsirt.org/vuln/ghsa-v9qv-c7wm-wgmf GHSA-v9qv-c7wm-wgmf — Composer has multiple command injections via malicious git/hg branch names 2026-10-03T22:26:22.708993+00:00

Affected: Packagist: composer/composer

### Impact

The `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. So this requires cloning untrusted repositories.

### Patches

2.2.24 for 2.2 LTS or 2.7.7 for mainline

### Workarounds

Avoid cloning potentially compromised repositories.

 https://cve.radiocsirt.org/vuln/opensuse-su-2024:14040-1 openSUSE-SU-2024:14040-1 — php-composer2-2.7.7-1.1 on GA media 2026-10-03T22:26:22.709020+00:00

php-composer2-2.7.7-1.1 on GA media

 https://cve.radiocsirt.org/vuln/suse-su-2024:2107-1 SUSE-SU-2024:2107-1 — Security update for php-composer2 2026-10-03T22:26:22.709039+00:00

Security update for php-composer2

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-35242 UBUNTU-CVE-2024-35242 2026-10-03T22:26:22.709054+00:00

Affected: Ubuntu:Pro:16.04:LTS: composer, Ubuntu:Pro:18.04:LTS: composer, Ubuntu:Pro:20.04:LTS: composer, Ubuntu:Pro:22.04:LTS: composer, Ubuntu:Pro:24.04:LTS: composer

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.