Composer wintercms/winter has 4 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2023-37269 | Winter CMS stored XSS through privileged upload of SVG file | low | 2.0 | <1.2.3 | 1.2.3 |
| CVE-2024-29686 | Winter CMS Server-Side Template Injection (SSTI) vulnerability | high | 8.8 | <=1.2.3 | – |
| CVE-2022-39357 | Prototype pollution in Snowboard framework | high | 8.1 | >=1.1.8 and <1.1.10 or >=1.2.0 and <1.2.1 | 1.1.10, 1.2.1 |
| GHSA-q37h-jhf3-85cj | Bypass of CMS Safe Mode Security Feature | medium | 0.0 | <1.0.475 or >=1.1.0 and <1.1.9 | 1.0.475, 1.1.9 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked