Packagist kevinpapst/kimai2

Name: Packagist kevinpapst/kimai2
Brand: Packagist

productUS

pkg:composer/kevinpapst/kimai2

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

EPSS ≥ 10%

unpatched

by severity

1critical1high7medium0low

updated 2026-10-28

vulnerabilities (9)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2021-3985US	critical9.0	1.26% (69th)	—	1.16.3	2021-12-01	< 1.16.3
CVE-2021-3992US	medium6.5OT elevated	1.06% (65th)	—	1.16.3	2021-12-01	< 1.16.3
CVE-2021-43515US	high7.8	1.01% (63rd)	—	1.14.1	2022-04-08	< 1.14.1
CVE-2019-15481US	medium6.1	0.86% (58th)	—	1.1	2019-08-23	< 1.1
CVE-2021-3983US	medium6.1	0.79% (56th)	—	1.16.3	2021-12-01	< 1.16.3
CVE-2021-4033US	medium6.5	0.52% (44th)	—	1.16.7	2021-12-09	< 1.16.7
CVE-2021-3976US	medium6.5	0.40% (34th)	—	1.16.2	2021-11-19	< 1.16.2
CVE-2021-3963US	medium4.3	0.40% (34th)	—	1.16	2021-11-19	< 1.16
CVE-2021-3957US	medium4.3	0.38% (32nd)	—	1.16	2021-11-19	< 1.16

The flaw types (CWEs) most of these CVEs share.

CWE-352Cross-Site Request Forgery (CSRF)4 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')3 CVEs
CWE-1236Improper Neutralization of Formula Elements in a CSV File1 CVEs
CWE-284Improper Access Control1 CVEs
CWE-639Authorization Bypass Through User-Controlled Key1 CVEs
CWE-863Incorrect Authorization1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.