Packagist dompdf/dompdf

Name: Packagist dompdf/dompdf
Brand: Packagist

productUS

pkg:composer/dompdf/dompdf

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

unpatched

by severity

5critical8high7medium0low

updated 2026-10-27

vulnerabilities (20)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2022-28368US	critical9.8	83.9% (100th)	Exploit	1.2.1	2022-04-03	< 1.2.1
CVE-2014-2383US	medium6.8	39.4% (99th)	Exploit	0.6.1	2014-04-28	0.6.0 → 0.6.1
CVE-2022-41343US	high7.5	5.98% (93rd)	Exploit	2.0.1	2022-09-25	< 2.0.1
CVE-2010-4879US	high7.5	5.23% (92nd)	Exploit	0.6.1	2011-10-07	0.6 → 0.6.1
CVE-2023-23924US	critical9.8OT high	3.57% (89th)	Exploit	2.0.2	2023-02-01	< 2.0.2
CVE-2026-59941US	high7.5	0.64% (51st)	Exploit	3.1.6	2026-07-28	< 3.1.6
CVE-2014-5013US	high8.8	4.48% (91st)	—	0.6.2	2020-01-10	0.6 → 0.6.2
CVE-2023-24813US	critical9.8	2.49% (85th)	—	2.0.3	2023-02-07	2.0.2 → 2.0.3
CVE-2014-5011US	medium6.5	1.49% (74th)	—	0.6.2	2020-01-10	0.6 → 0.6.2
CVE-2023-50262US	high7.5	1.46% (73rd)	—	2.0.4	2023-12-13	< 2.0.4
CVE-2021-3838US	critical9.8	1.43% (73rd)	—	2.0.0	2024-11-15	< 2.0.0
CVE-2014-5012US	medium6.5	1.23% (69th)	—	0.6.2	2020-01-10	0.6 → 0.6.2
CVE-2022-2400US	medium5.3	1.21% (68th)	—	2.0.0	2022-07-18	< 2.0.0
CVE-2022-0085US	medium5.3	1.00% (63rd)	—	2.0.0	2022-06-28	< 2.0.0
CVE-2021-3902US	critical9.8	0.95% (61st)	—	2.0.0	2024-11-15	< 2.0.0
CVE-2026-59942US	high7.5	0.90% (59th)	—	3.1.6	2026-07-28	< 3.1.6
CVE-2026-55555US	high7.5	0.51% (43rd)	—	3.1.6	2026-07-28	< 3.1.6
CVE-2026-55554US	high7.5	0.45% (39th)	—	3.1.6	2026-07-28	< 3.1.6
CVE-2026-56722US	medium5.3	0.45% (39th)	—	3.1.6	2026-07-28	< 3.1.6
CVE-2026-59943US	medium5.3	0.42% (36th)	—	3.1.6	2026-07-28	< 3.1.6

The flaw types (CWEs) most of these CVEs share.

CWE-20Improper Input Validation3 CVEs
CWE-400Uncontrolled Resource Consumption3 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor2 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')2 CVEs
CWE-203Observable Discrepancy1 CVEs
CWE-209Generation of Error Message Containing Sensitive Information1 CVEs
CWE-436Interpretation Conflict1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.