Packagist october/cms

Name: Packagist october/cms
Brand: Packagist

productUS

pkg:composer/october/cms

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

critical

by severity

0critical2high6medium1low

updated 2026-10-28

vulnerabilities (9)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2017-1000119US	high7.2	61.3% (99th)	Exploit	no fix	2017-10-05	≤ 1.0.412
CVE-2020-5295US	medium4.9	7.37% (94th)	Exploit	1.0.466	2020-06-03	1.0.319 → 1.0.466
CVE-2023-43876US	medium5.4	0.48% (41st)	Exploit	no fix	2023-09-28	≤ 3.4.16
CVE-2020-15246US	high7.5OT elevated	1.70% (77th)	—	1.0.469	2020-11-23	1.0.421 → 1.0.469
CVE-2020-5296US	medium4.9	1.43% (73rd)	—	1.0.466	2020-06-03	1.0.319 → 1.0.466
CVE-2020-5297US	low2.7	1.18% (68th)	—	1.0.466	2020-06-03	1.0.319 → 1.0.466
CVE-2020-15247US	medium5.2OT elevated	0.29% (22nd)	—	1.0.469	2020-11-23	1.0.319 → 1.0.469
CVE-2020-26231US	medium6.7OT elevated	0.29% (22nd)	—	1.0.470	2020-11-23	1.0.469 → 1.0.470
CVE-2021-21264US	medium5.2OT elevated	0.26% (18th)	—	1.0.472	2021-05-03	2 versions

The flaw types (CWEs) most of these CVEs share.

CWE-862Missing Authorization3 CVEs
CWE-610Externally Controlled Reference to a Resource in Another Sphere2 CVEs
CWE-73External Control of File Name or Path2 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1 CVEs
CWE-434Unrestricted Upload of File with Dangerous Type1 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1 CVEs
CWE-829Inclusion of Functionality from Untrusted Control Sphere1 CVEs
CWE-863Incorrect Authorization1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.