# Packagist


- [CVE-2025-32432](https://insights.sbomify.com/CVE-2025-32432/): Craft CMS Code Injection (critical 10.0, exploited in the wild)
- [CVE-2025-49113](https://insights.sbomify.com/CVE-2025-49113/): RoundCube Webmail Deserialization of Untrusted Data (critical 9.9, exploited in the wild)
- [CVE-2026-9082](https://insights.sbomify.com/CVE-2026-9082/): Drupal Core SQL Injection (critical 9.8, exploited in the wild)
- [CVE-2024-34102](https://insights.sbomify.com/CVE-2024-34102/): Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) (critical 9.8, exploited in the wild)
- [CVE-2022-24086](https://insights.sbomify.com/CVE-2022-24086/): Adobe Commerce and Magento Open Source Improper Input Validation (critical 9.8, exploited in the wild)
- [CVE-2021-3129](https://insights.sbomify.com/CVE-2021-3129/): Laravel Ignition File Upload (critical 9.8, exploited in the wild)
- [CVE-2018-7600](https://insights.sbomify.com/CVE-2018-7600/): Drupal Core Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2017-9841](https://insights.sbomify.com/CVE-2017-9841/): PHPUnit Command Injection (critical 9.8, exploited in the wild)
- [CVE-2016-10033](https://insights.sbomify.com/CVE-2016-10033/): PHPMailer Command Injection (critical 9.8, exploited in the wild)
- [CVE-2024-56145](https://insights.sbomify.com/CVE-2024-56145/): Craft CMS Code Injection (critical 9.3, exploited in the wild)
- [CVE-2025-54068](https://insights.sbomify.com/CVE-2025-54068/): Laravel Livewire Code Injection (critical 9.2, exploited in the wild)
- [CVE-2025-54236](https://insights.sbomify.com/CVE-2025-54236/): Adobe Commerce and Magento Improper Input Validation (critical 9.1, exploited in the wild)

---
From sbomify Insights: https://insights.sbomify.com/ecosystems/packagist/