CVE Tools
Track your stack

Packagist

5,111 CVEs across 186 months on the top 200 list since Feb 2006. Peak rank #4 in 2 months, last Jun 2015. 21 of them are now in CISA KEV.

Packagist CVEs per month since Feb 2006

Oct 2021 to Sep 2026 in the lens. Point at a month to read it, or drag the frame to move through the record.Tallest in the lens: 323, May 2024
Oct 2021: 32 CVEs · 4 critical · 0 now in CISA KEV · rank #22 · mostly Grumpydictator/firefly-iii, Snipe/snipe-it, Typo3/cms-coreNov 2021: 46 CVEs · 7 critical · 0 now in CISA KEV · rank #13 · mostly Concrete5/core, Moodle/moodle, Symfony/symfonyDec 2021: 63 CVEs · 10 critical · 0 now in CISA KEV · rank #12 · mostly Yetiforce/yetiforce-crm, Showdoc/showdoc, Snipe/snipe-itJan 2022: 88 CVEs · 5 critical · 0 now in CISA KEV · rank #7 · mostly Remdex/livehelperchat, Pimcore/pimcore, Moodle/moodleFeb 2022: 86 CVEs · 8 critical · 1 now in CISA KEV · rank #11 · mostly Microweber/microweber, Drupal/core, Librenms/librenmsMar 2022: 110 CVEs · 13 critical · 0 now in CISA KEV · rank #7 · mostly Showdoc/showdoc, Microweber/microweber, Moodle/moodleApr 2022: 53 CVEs · 4 critical · 0 now in CISA KEV · rank #17 · mostly Pimcore/pimcore, Remdex/livehelperchat, Shopware/shopwareMay 2022: 34 CVEs · 5 critical · 0 now in CISA KEV · rank #24 · mostly Moodle/moodle, Facturascripts/facturascripts, Microweber/microweberJun 2022: 60 CVEs · 6 critical · 0 now in CISA KEV · rank #13 · mostly Elefant/cms, Typo3/cms-core, Typo3/cmsJul 2022: 35 CVEs · 2 critical · 0 now in CISA KEV · rank #23 · mostly Microweber/microweber, Moodle/moodle, Idno/knownAug 2022: 45 CVEs · 4 critical · 0 now in CISA KEV · rank #20 · mostly Magento/community-edition, Forkcms/forkcms, Getkirby/cmsSep 2022: 51 CVEs · 6 critical · 0 now in CISA KEV · rank #18 · mostly Typo3/cms-core, Typo3/cms, Moodle/moodleOct 2022: 28 CVEs · 5 critical · 0 now in CISA KEV · rank #39 · mostly Thorsten/phpmyfaq, Magento/community-edition, Noumo/easyiiNov 2022: 80 CVEs · 8 critical · 0 now in CISA KEV · rank #8 · mostly Concrete5/concrete5, Librenms/librenms, Tribalsystems/zenarioDec 2022: 54 CVEs · 4 critical · 0 now in CISA KEV · rank #19 · mostly Feehi/feehicms, Typo3/cms, Typo3/cms-coreJan 2023: 65 CVEs · 6 critical · 0 now in CISA KEV · rank #10 · mostly Thorsten/phpmyfaq, Cakephp/cakephp, Froxlor/froxlorFeb 2023: 58 CVEs · 3 critical · 0 now in CISA KEV · rank #12 · mostly Thorsten/phpmyfaq, Wallabag/wallabag, Pimcore/pimcoreMar 2023: not on the top 200 that monthApr 2023: 91 CVEs · 8 critical · 0 now in CISA KEV · rank #7 · mostly Pimcore/pimcore, Thorsten/phpmyfaq, Concrete5/concrete5May 2023: 51 CVEs · 3 critical · 0 now in CISA KEV · rank #13 · mostly Pimcore/pimcore, Craftcms/cms, Thorsten/phpmyfaqJun 2023: 56 CVEs · 9 critical · 0 now in CISA KEV · rank #13 · mostly Magento/community-edition, Magento/project-community-edition, Nilsteampassnet/teampassJul 2023: 40 CVEs · 2 critical · 0 now in CISA KEV · rank #19 · mostly Pimcore/pimcore, Nilsteampassnet/teampass, Getkirby/cmsAug 2023: 45 CVEs · 4 critical · 0 now in CISA KEV · rank #19 · mostly Cockpit-hq/cockpit, Prestashop/prestashop, Wallabag/wallabagSep 2023: 51 CVEs · 7 critical · 0 now in CISA KEV · rank #15 · mostly Librenms/librenms, Gugoan/economizzer, Thorsten/phpmyfaqOct 2023: 55 CVEs · 2 critical · 0 now in CISA KEV · rank #15 · mostly Magento/project-community-edition, Magento/community-edition, Concrete5/concrete5Nov 2023: 67 CVEs · 4 critical · 0 now in CISA KEV · rank #9 · mostly Moodle/moodle, Symfony/symfony, Librenms/librenmsDec 2023: 43 CVEs · 1 critical · 0 now in CISA KEV · rank #16 · mostly Concrete5/concrete5, Automad/automad, Microweber/microweberJan 2024: 36 CVEs · 3 critical · 0 now in CISA KEV · rank #25 · mostly Gilacms/gila, Tinymce/tinymce, Wwbn/avideoFeb 2024: 64 CVEs · 6 critical · 0 now in CISA KEV · rank #17 · mostly Moodle/moodle, Getkirby/cms, Typo3/cms-coreMar 2024: 47 CVEs · 1 critical · 0 now in CISA KEV · rank #22 · mostly Phpmyfaq/phpmyfaq, Getgrav/grav, Friendsofsymfony1/symfony1Apr 2024: 42 CVEs · 3 critical · 0 now in CISA KEV · rank #26 · mostly Centreon/centreon, Concrete5/concrete5, Contao/core-bundleMay 2024: 323 CVEs · 8 critical · 0 now in CISA KEV · rank #8 · mostly Silverstripe/framework, Typo3/cms-core, Moodle/moodleJun 2024: 165 CVEs · 2 critical · 1 now in CISA KEV · rank #7 · mostly Typo3/cms, Zendframework/zendframework1, Zendframework/zendframeworkJul 2024: 35 CVEs · 5 critical · 0 now in CISA KEV · rank #30 · mostly Icecoder/icecoder, Auth0/wordpress, Admidio/admidioAug 2024: 49 CVEs · 1 critical · 0 now in CISA KEV · rank #17 · mostly Magento/community-edition, Magento/project-community-edition, Shopware/platformSep 2024: 36 CVEs · 1 critical · 0 now in CISA KEV · rank #21 · mostly Mautic/core, Mautic/core-lib, Concrete5/concrete5Oct 2024: 72 CVEs · 4 critical · 0 now in CISA KEV · rank #15 · mostly Magento/community-edition, Funadmin/funadmin, Librenms/librenmsNov 2024: 74 CVEs · 2 critical · 0 now in CISA KEV · rank #12 · mostly Moodle/moodle, Librenms/librenms, Symfony/symfonyDec 2024: 42 CVEs · 7 critical · 1 now in CISA KEV · rank #18 · mostly Drupal/core, Drupal/core-recommended, Drupal/drupalJan 2025: 59 CVEs · 2 critical · 1 now in CISA KEV · rank #19 · mostly Phpoffice/phpspreadsheet, Phpoffice/phpexcel, Librenms/librenmsFeb 2025: 60 CVEs · 4 critical · 0 now in CISA KEV · rank #12 · mostly Magento/community-edition, Magento/project-community-edition, Leantime/leantimeMar 2025: 62 CVEs · 5 critical · 0 now in CISA KEV · rank #16 · mostly Drupal/ai, Drupal/core, Shopxo/shopxoApr 2025: 59 CVEs · 8 critical · 2 now in CISA KEV · rank #15 · mostly Moodle/moodle, Yeswiki/yeswiki, Shopware/platformMay 2025: 42 CVEs · 5 critical · 1 now in CISA KEV · rank #25 · mostly Mautic/core, Typo3/cms-core, Nitsan/ns-backupJun 2025: 39 CVEs · 2 critical · 1 now in CISA KEV · rank #26 · mostly Starcitizentools/citizen-skin, Magento/community-edition, Magento/project-community-editionJul 2025: 25 CVEs · 5 critical · 1 now in CISA KEV · rank #46 · mostly Starcitizentools/citizen-skin, Codeigniter4/framework, Elmsln/haxcmsAug 2025: 39 CVEs · 4 critical · 0 now in CISA KEV · rank #28 · mostly Magento/community-edition, Magento/project-community-edition, Unopim/unopimSep 2025: 28 CVEs · 1 critical · 1 now in CISA KEV · rank #37 · mostly Mautic/core, Typo3/cms-core, Typo3/cms-backendOct 2025: 64 CVEs · 1 critical · 0 now in CISA KEV · rank #15 · mostly Moodle/moodle, Bagisto/bagisto, Magento/project-community-editionNov 2025: 39 CVEs · 1 critical · 0 now in CISA KEV · rank #15 · mostly Mantisbt/mantisbt, Phppgadmin/phppgadmin, Drupal/coreDec 2025: 64 CVEs · 9 critical · 0 now in CISA KEV · rank #16 · mostly Getgrav/grav, Feehi/feehicms, Thorsten/phpmyfaqJan 2026: 58 CVEs · 6 critical · 0 now in CISA KEV · rank #14 · mostly Bagisto/bagisto, Craftcms/cms, Mineadmin/mineadminFeb 2026: 96 CVEs · 4 critical · 0 now in CISA KEV · rank #5 · mostly Craftcms/cms, Moodle/moodle, Craftcms/commerceMar 2026: 88 CVEs · 8 critical · 0 now in CISA KEV · rank #12 · mostly Craftcms/cms, Wwbn/avideo, Admidio/admidioApr 2026: 57 CVEs · 0 critical · 0 now in CISA KEV · rank #16 · mostly Wwbn/avideo, Froxlor/froxlor, Pocketmine/pocketmine-mpMay 2026: 43 CVEs · 1 critical · 0 now in CISA KEV · rank #26 · mostly Phpmyfaq/phpmyfaq, Thorsten/phpmyfaq, Azuracast/azuracastJun 2026: 18 CVEs · 0 critical · 0 now in CISA KEV · rank #51 · mostly Web-token/jwt-library, Web-token/jwt-framework, Spomky-labs/otphpJul 2026: 24 CVEs · 0 critical · 0 now in CISA KEV · rank #47 · mostly Guzzlehttp/guzzle, Poweradmin/poweradmin, Craftcms/cmsAug 2026: 41 CVEs · 0 critical · 0 now in CISA KEV · rank #29 · mostly Craftcms/cms, Winter/wn-backend-module, Guzzlehttp/guzzleSep 2026 so far: 11 CVEs · 0 critical · 0 now in CISA KEV · rank #111 · mostly League/commonmark, Mediawiki/semantic-media-wiki, In2code/femanager

In the lens

The products that kept showing up in Packagist's monthly top three from Oct 2021 to Sep 2026. Move the lens and the list follows.

  1. Moodle/moodle12813 months
  2. Magento/community-edition1099 months
  3. Typo3/cms804 months
  4. Magento/project-community-edition777 months
  5. Thorsten/phpmyfaq768 months
  6. Craftcms/cms636 months
  7. Typo3/cms-core638 months
  8. Pimcore/pimcore516 months
  9. Microweber/microweber505 months
  10. Silverstripe/framework501 month

Year by year

Each year's months on the top 200 list. Pick a year to read it in the lens.

The record

Peak rank
#4 in 2 months, last Jun 2015
Busiest month
May 2024, 323 CVEs
Months with a KEV entry
18 of 186 on the list
On the top 200 list
186 of 248 monthly snapshots

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store