Composer adminneo-org/adminneo has 7 known advisories in the phpwarden feed. Feed 2026.11.03.2, updated 2026-11-03.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2026-59978 | AdminNeo: version-cache array injection causes persistent denial of service | high | 7.5 | >=4.6.2 and <5.5.0 | 5.5.0 |
| CVE-2026-96631 | AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers | high | 8.2 | >=4.6.0 and <5.5.1 | 5.5.1 |
| CVE-2026-96633 | AdminNeo SQLite Database-List Drop Arbitrary File Deletion | high | 8.1 | <5.5.1 | 5.5.1 |
| CVE-2026-96630 | AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass) | high | 7.2 | <5.5.1 | 5.5.1 |
| CVE-2026-96629 | AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery | medium | 6.8 | <5.5.1 | 5.5.1 |
| CVE-2026-96632 | AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass) | high | 0.0 | <5.5.1 | 5.5.1 |
| CVE-2026-96634 | AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE | medium | 0.0 | <5.5.1 | 5.5.1 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# PHP projects (recommended) composer require --dev phpwarden/phpwarden # then vendor/bin/phpwarden deps composer.lock # or, without Composer pipx install phpwarden && phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked