Packagist october/october

Name: Packagist october/october
Brand: Packagist

productUS

pkg:composer/october/october

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

1critical4high5medium0low

updated 2026-10-28

vulnerabilities (12)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2017-16244US	high8.8	1.98% (80th)	Exploit	1.0.427	2017-11-01	< 1.0.427
CVE-2018-1999009US	high8.1	2.39% (84th)	—	1.0.437	2018-07-23	< 1.0.437
CVE-2015-5612US	medium4.3	1.84% (79th)	—	1.0.319	2015-09-04	< 1.0.319
CVE-2017-1000194US	critical9.8	1.24% (69th)	—	1.0.413	2017-11-17	< 1.0.413
CVE-2021-41126US	medium6.5	1.09% (65th)	—	2.1.12	2021-10-06	2.1.0 → 2.1.12
CVE-2017-1000193US	medium6.1	1.00% (63rd)	—	1.0.413	2017-11-17	< 1.0.413
CVE-2023-37692US	medium5.4	0.52% (44th)	—	no fix	2023-07-26	≤ 3.4.4
CVE-2024-45962US	—	0.51% (44th)	—	no fix	2024-10-02	≤ 3.6.4
CVE-2024-51991US	medium4.9	0.38% (32nd)	—	3.7.5	2025-05-05	< 3.7.5
CVE-2023-25365US	high7.8	0.36% (29th)	—	no fix	2024-02-08	≤ 3.2.0
CVE-2026-100909US	high7.3	0.30% (22nd)	—	4.3.5	2026-09-28	4.3.0 → 4.3.5
CVE-2026-26274US	—OT elevated	0.23% (14th)	—	3.7.14	2026-04-21	2 versions

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')5 CVEs
CWE-434Unrestricted Upload of File with Dangerous Type4 CVEs
CWE-184Incomplete List of Disallowed Inputs1 CVEs
CWE-20Improper Input Validation1 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor1 CVEs
CWE-287Improper Authentication1 CVEs
CWE-352Cross-Site Request Forgery (CSRF)1 CVEs
CWE-863Incorrect Authorization1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.