The Composer packages in CISA KEV (and the two that are dev dependencies)
1,500 Composer packages have published advisories. Only 24 CVEs across them are in CISA KEV, and they cluster in CMS cores: Drupal, Craft, Magento, October. For Laravel teams the three that matter are Ignition, Livewire and an old framework RCE.
1,542packages with advisories
8,638advisories
24CVEs in CISA KEV
17packages they hit
Where KEV lands in the Composer ecosystem
1,542 packages from 656 vendors have at least one advisory (OSV.dev + FriendsOfPHP). 24 CVEs are in CISA KEV, affecting 17 package names — and most of those are CMS cores, because an unauthenticated RCE in a CMS is worth automating at internet scale.
All 30 KEV entries
| Package | CVE | What | Severity | EPSS | Fixed in |
|---|---|---|---|---|---|
| phpunit/phpunit | CVE-2017-9841 KEV | Code Injection in PHPUnit | critical 9.8 | 100% | 4.8.28, 5.6.3 |
| magento/community-edition | CVE-2024-34102 KEV | Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vul | critical 9.8 | 100% | — |
| magento/product-community-edition | CVE-2024-34102 KEV | Arbitrary Code Execution through Improper Restriction of XML External Entity Reference (XXE) vulnera | unknown 0.0 | 100% | 2.4.4, 2.4.4-p9, 2.4.5-p8 |
| drupal/core | CVE-2018-7600 KEV | A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This | critical 9.8 | 100% | 8.3.9, 8.4.6, 8.5.1 |
| drupal/drupal | CVE-2018-7600 KEV | Drupal Core Remote Code Execution Vulnerability | critical 9.8 | 100% | 7.58, 8.3.9, 8.4.6 |
| facade/ignition | CVE-2021-3129 KEV | Unauthenticated remote code execution via insecure file handling in debug mode | critical 9.8 | 100% | 2.5.2, 1.16.14 |
| craftcms/cms | CVE-2025-32432 KEV | Craft CMS Allows Remote Code Execution | critical 10.0 | 100% | 3.9.15, 4.14.15, 5.6.17 |
| phpmailer/phpmailer | CVE-2016-10033 KEV | Remote code execution via crafted Sender in the isMail transport | critical 9.8 | 100% | 5.2.20 |
| roundcube/roundcubemail | CVE-2025-49113 KEV | Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization | critical 9.9 | 100% | 1.5.10, 1.6.11 |
| magento/community-edition | CVE-2022-24086 KEV | Magento improper input validation vulnerability | critical 9.8 | 99% | 2.3.7-p3, 2.4.3-p2 |
| drupal/core | CVE-2018-7602 KEV | A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This | critical 9.8 | 99% | 8.4.8, 8.5.3, 7.59 |
| drupal/drupal | CVE-2018-7602 KEV | Drupal Core Remote Code Execution Vulnerability | critical 9.8 | 99% | 7.59, 8.4.8, 8.5.3 |
| vrana/adminer | CVE-2021-21311 KEV | SSRF in adminer | high 7.2 | 98% | 4.7.9 |
| craftcms/cms | CVE-2024-56145 KEV | Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled | critical 9.8 | 97% | 5.5.2, 4.13.2, 3.9.14 |
| livewire/livewire | CVE-2025-54068 KEV | Livewire is vulnerable to remote command execution during component property update hydration | critical 9.8 | 96% | 3.6.4 |
| magento/community-edition | CVE-2025-54236 KEV | Magento Community Edition Improper Input Validation vulnerability | critical 9.1 | 95% | — |
| magento/project-community-edition | CVE-2025-54236 KEV | Magento Community Edition Improper Input Validation vulnerability | critical 9.1 | 95% | — |
| drupal/core | CVE-2019-6340 KEV | Some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP | high 8.1 | 92% | 8.5.11, 8.6.10, 7.62.0 |
| drupal/drupal | CVE-2019-6340 KEV | Drupal Core Remote Code Execution Vulnerability | high 8.1 | 92% | 7.62.0, 8.5.11, 8.6.10 |
| october/system | CVE-2021-32648 KEV | Account Takeover in Octobercms | high 8.2 | 90% | 1.0.472, 1.1.5 |
| drupal/core | CVE-2026-9082 KEV | Drupal core includes a database abstraction API to ensure that queries executed against the database | critical 9.8 | 89% | 10.4.10, 10.5.10, 10.6.9 |
| yiisoft/yii2 | CVE-2024-58136 KEV | yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key | critical 9.0 | 88% | 2.0.52 |
| components/jquery | CVE-2020-11023 KEV | Potential XSS vulnerability in jQuery | medium 6.9 | 85% | 3.5.0 |
| pear/archive_tar | CVE-2020-28949 KEV | Potential file overwrite if archive filename starts with file:// | unknown 0.0 | 85% | 1.4.11 |
| laravel/framework | CVE-2018-15133 KEV | Laravel Framework RCE Vulnerability | high 8.1 | 77% | 5.6.30 |
| pear/archive_tar | CVE-2020-36193 KEV | Directory Traversal in Archive_Tar | high 7.5 | 71% | 1.4.13 |
| drupal/core | CVE-2020-13671 KEV | *Update November 18: Documented longer list of dangerous file extensions* Drupal core does not prop | high 8.8 | 36% | 8.8.11, 8.9.9, 9.0.8 |
| drupal/drupal | CVE-2020-13671 KEV | Drupal core Unrestricted Upload of File with Dangerous Type | high 8.8 | 36% | 7.74, 8.8.11, 8.9.9 |
| craftcms/cms | CVE-2025-23209 KEV | Craft CMS has a potential RCE with a compromised security key | high 8.0 | 22% | 5.5.8, 4.13.8 |
| craftcms/cms | CVE-2025-35939 KEV | Craft CMS stores arbitrary content provided by unauthenticated users in session files | medium 5.3 | 1% | 5.7.5, 4.15.3 |
The two that are dev dependencies
phpunit/phpunit (CVE-2017-9841, EPSS 100%) and facade/ignition (CVE-2021-3129, EPSS 100%) are among the most-exploited PHP CVEs on the internet, and neither belongs on a production server. PHPUnit's eval-stdin.php and Ignition's debug error page are only reachable when require-dev packages were deployed. composer install --no-dev --optimize-autoloader in the deploy step removes the whole class.
If you run Laravel
130 advisories touch Laravel-ecosystem packages (laravel/*, livewire, filament, spatie, ignition). Three are in KEV. Ranked by EPSS:
| Package | CVE | What | Severity | EPSS | Fixed in |
|---|---|---|---|---|---|
| facade/ignition | CVE-2021-3129 KEV | Unauthenticated remote code execution via insecure file handling in debug mode | critical 9.8 | 100% | 2.5.2, 1.16.14 |
| livewire/livewire | CVE-2025-54068 KEV | Livewire is vulnerable to remote command execution during component property update hydration | critical 9.8 | 96% | 3.6.4 |
| laravel/framework | CVE-2018-15133 KEV | Laravel Framework RCE Vulnerability | high 8.1 | 77% | 5.6.30 |
| laravel/framework | CVE-2024-52301 | Laravel environment manipulation via query string | high 0.0 | 45% | 6.20.45, 7.30.7, 8.83.28 |
| laravel/pulse | CVE-2024-55661 | Laravel Pulse Allows Remote Code Execution via Unprotected Query Method | high 0.0 | 31% | 1.3.1 |
| laravel/framework | CVE-2021-43617 | Image upload bypass | unknown 0.0 | 20% | 8.71.0 |
| rap2hpoutre/laravel-log-viewer | CVE-2018-8947 | Plaintext Storage of Sensitive Information in Laravel Log Viewer before v0.13.0 | high 7.5 | 11% | 0.13.0 |
| unisharp/laravel-filemanager | CVE-2022-40734 | UniSharp Laravel Filemanager directory traversal vulnerability | medium 6.5 | 5% | 2.6.4 |
For comparison, Symfony has 270 advisories in the feed and none in KEV; 6 clear a 10% EPSS. Advisory count says little about attack pressure.
High EPSS, not in KEV
KEV is curated and lags. These Composer packages have CVEs with EPSS ≥ 50% that are not (yet) catalogued:
| Package | CVE | What | Severity | EPSS | Fixed in |
|---|---|---|---|---|---|
| maximebf/debugbar | CVE-2020-11022 | Potential XSS vulnerability in jQuery | medium 6.9 | 99% | 1.19.0 |
| athlon1600/youtube-downloader | CVE-2020-11022 | Potential XSS vulnerability in jQuery | medium 6.9 | 99% | 4.0.1 |
| components/jquery | CVE-2020-11022 | Potential XSS vulnerability in jQuery | medium 6.9 | 99% | 3.5.0 |
| billz/raspap-webgui | CVE-2022-39986 | RaspAP Command Injection vulnerability | critical 9.8 | 99% | 2.8.8 |
| open-web-analytics/open-web-analytics | CVE-2022-24637 | Improper Privilege Management in Open Web Analytics | critical 9.8 | 99% | 1.7.4 |
| phpmyadmin/phpmyadmin | CVE-2018-12613 | phpMyAdmin Improper Authentication | high 8.8 | 98% | 4.8.2 |
| phpmailer/phpmailer | CVE-2016-10045 | Remote code execution in PHPMailer | critical 9.8 | 98% | 5.2.20 |
| froxlor/froxlor | CVE-2023-0315 | Froxlor vulnerable to Command Injection | high 8.8 | 98% | 2.0.8 |
| studio-42/elfinder | CVE-2019-9194 | elFinder command injection vulnerability in the PHP connector | critical 9.8 | 97% | 2.1.48 |
| librenms/librenms | CVE-2022-3562 | Cross-site Scripting in librenms/librenms | medium 5.4 | 94% | 22.10.0 |
| craftcms/cms | CVE-2023-41892 | Craft CMS Remote Code Execution vulnerability | critical 10.0 | 94% | 4.4.15 |
| librenms/librenms | CVE-2022-4067 | Cross-site Scripting in librenms/librenms | medium 5.4 | 94% | 22.10.0 |
What to do
- Deploy with
--no-dev. Then confirm:phpwarden deps composer.locklists dev packages if they are in the lock, and the reachability check tells you whether anything in your code references a vulnerable package. - Gate CI on exploitation, not CVSS.
fail-on: exploitedin the GitHub Action blocks the merge only for KEV entries; add a severity threshold if you want more. - Watch EPSS, not just KEV. The second table above is what KEV will look like in a few months.
Check your own project in one command
Zero dependencies, offline, Apache-2.0. Ranks by KEV → EPSS → CVSS.
pipx install phpwarden
phpwarden deps composer.lock # Composer
phpwarden scan # PHP engine on this host
phpwarden wordpress /var/www/html # WordPress core, plugins, themesIn CI: uses: oroma-alfred/phpwarden-action@v1
with fail-on: exploited. Or composer require --dev phpwarden/phpwarden.