Composer phanan/koel has 8 known advisories in the phpwarden feed. Feed 2026.10.29.4, updated 2026-10-29.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2021-33563 | Improper rate limiting in Koel | high | 0.0 | <5.1.4 | 5.1.4 |
| CVE-2026-54494 | Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv | medium | 0.0 | <9.7.1 | 9.7.1 |
| CVE-2026-54493 | Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations | high | 7.7 | <9.7.0 | 9.7.0 |
| CVE-2026-54492 | Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation | medium | 4.3 | <9.7.0 | 9.7.0 |
| CVE-2026-54491 | Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths | high | 7.1 | <9.7.1 | 9.7.1 |
| CVE-2026-47260 | Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs | high | 7.7 | <9.3.5 | 9.3.5 |
| CVE-2026-50552 | Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail | medium | 6.3 | <9.7.1 | 9.7.1 |
| GHSA-8q6q-m837-fv64 | Koel has SSRF through Authenticated Subsonic podcast feed URLs | medium | 6.4 | <9.7.0 | 9.7.0 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# PHP projects (recommended) composer require --dev phpwarden/phpwarden # then vendor/bin/phpwarden deps composer.lock # or, without Composer pipx install phpwarden && phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked