Composer kevinpapst/kimai2 has 9 known advisories in the phpwarden feed. Feed 2026.10.29.4, updated 2026-10-29.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2021-3985 | kimai2 is vulnerable to Cross-site Scripting | high | 8.0 | <1.16.3 | 1.16.3 |
| CVE-2021-3992 | kimai2 is vulnerable to Improper Access Control | medium | 6.5 | <1.16.3 | 1.16.3 |
| CVE-2021-43515 | Improper Neutralization of Formula Elements in a CSV File in Kimai 2 | high | 7.8 | <1.14.1 | 1.14.1 |
| CVE-2019-15481 | Kimai v2 is vulnerable to Cross-Site Scripting (XSS) | medium | 6.1 | <1.1 | 1.1 |
| CVE-2021-3983 | Cross-site Scripting in kimai2 | medium | 6.3 | <1.16.3 | 1.16.3 |
| CVE-2021-4033 | Cross-Site Request Forgery in kimai2 | medium | 6.5 | <1.16.7 | 1.16.7 |
| CVE-2021-3976 | Cross-site Scripting in kimai2 | medium | 4.3 | <1.16.2 | 1.16.2 |
| CVE-2021-3963 | Cross-site Scripting in kimai2 | medium | 4.3 | <1.16 | 1.16 |
| CVE-2021-3957 | Cross-site Scripting in kimai2 | medium | 4.6 | <1.16 | 1.16 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# PHP projects (recommended) composer require --dev phpwarden/phpwarden # then vendor/bin/phpwarden deps composer.lock # or, without Composer pipx install phpwarden && phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked