CRA Readiness Snapshot
What you would have to assess for ENISA reporting tomorrow
From 11 September 2026, an actively exploited vulnerability in software you ship must be reported to ENISA within 24 hours of awareness (CRA Art. 14). In this snapshot, 1 finding is in the CISA KEV catalog (0 in production dependencies):
| Package | Your version | CVE | Fixed in | Exploit context |
|---|---|---|---|---|
| phpunit/phpunit dev | ^7.5|^9.5 (unpinned) | CVE-2017-9841 | 4.8.28 | KEV listed 2022-02-15 |
⚠ No lockfile — SBOM is not reproducible
This scan is based on a manifest (composer.json), not a lockfile. 4 of 4 dependencies are version ranges, so the exact shipped versions — and their transitive dependencies — cannot be verified. Under the CRA's full obligations (11 December 2027) you must produce a machine-readable SBOM of what you actually ship. Committing a lockfile is the single highest-impact fix in this report.
All findings (19)
| Package | Version | Advisory | Severity | EPSS | Fixed in | Summary |
|---|---|---|---|---|---|---|
| squizlabs/php_codesniffer dev | ^3.6 | CVE-2026-67434 | HIGH | 1.1% | 3.13.6 | PHP_CodeSniffer gitblame report command injection via crafted filename |
| phpseclib/phpseclib | ^2.0|^3.0|^4.0.1 | CVE-2021-30130 | HIGH | 1.1% | 3.0.7 | Improper Certificate Validation in phpseclib |
| phpseclib/phpseclib | ^2.0|^3.0|^4.0.1 | CVE-2023-27560 | HIGH | 0.8% | 3.0.19 | phpseclib Infinite Loop vulnerability |
| phpseclib/phpseclib | ^2.0|^3.0|^4.0.1 | CVE-2023-49316 | HIGH | 0.8% | 3.0.34 | Phpseclib needs guardrails on large binaryfield integers |
| phpseclib/phpseclib | ^2.0|^3.0|^4.0.1 | CVE-2024-27354 | HIGH | 0.6% | 1.0.23 | phpseclib: guardrails needed on isPrime and randomPrime |
| phpseclib/phpseclib | ^2.0|^3.0|^4.0.1 | CVE-2024-27355 | HIGH | 0.6% | 2.0.47 | phpseclib guardrails needed on OID length |
| phpseclib/phpseclib | ^2.0|^3.0|^4.0.1 | CVE-2026-32935 | HIGH | 0.4% | 3.0.50 | phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack |
| phpunit/phpunit dev | ^7.5|^9.5 | CVE-2026-24765 | HIGH | 0.4% | 8.5.52 | PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling |
| phpseclib/phpseclib | ^2.0|^3.0|^4.0.1 | CVE-2023-52892 | HIGH | 0.4% | 1.0.22 | Name confusion in x509 Subject Alternative Name fields |
| phpseclib/phpseclib | ^2.0|^3.0|^4.0.1 | CVE-2026-40194 | LOW | 0.4% | 1.0.28 | phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals() |
| phpseclib/phpseclib | ^2.0|^3.0|^4.0.1 | CVE-2026-44167 | HIGH | 0.3% | 1.0.29 | phpseclib has a CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID() |
| phpseclib/phpseclib | ^2.0|^3.0|^4.0.1 | CVE-2026-84308 | MODERATE | 0.3% | 3.0.57 | phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery |
| phpunit/phpunit dev | ^7.5|^9.5 | CVE-2026-41570 | HIGH | 0.3% | 12.5.22 | PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes |
| phpseclib/phpseclib | ^2.0|^3.0|^4.0.1 | CVE-2026-55599 | MODERATE | 0.2% | 1.0.30 | phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information... |
| phpunit/phpunit dev | ^7.5|^9.5 | GHSA-mh6w-vxff-9wqp | HIGH | — | 12.5.22 | PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes |
| squizlabs/php_codesniffer dev | ^3.6 | GHSA-3988-h75v-hwf6 | HIGH | — | 3.0.1 | Arbitrary shell execution |
| squizlabs/php_codesniffer dev | ^3.6 | GHSA-mhfv-8rc9-w38c | HIGH | — | 2.8.1 | Arbitrary shell execution |
| nategood/httpful dev | ^0.2.20 | GHSA-gcfg-hmwx-wq5h | MODERATE | — | 1.0.0 | Httpful is Missing Certificate Validation |
| phpunit/phpunit dev | ^7.5|^9.5 | CVE-2017-9841 | KEV CRITICAL | 100.0% | 4.8.28 | Code Injection in PHPUnit |
SBOM summary
4 direct dependencies scanned (0 pinned to exact versions) from composer.json. Vulnerability data: OSV.dev · exploitation status: CISA KEV · exploit probability: FIRST EPSS. Findings on unpinned dependencies cover the full constraint range and may not apply to the exact version deployed.
Using ENISA's CRA Maturity Assessment Model for SMEs? This snapshot provides evidence for the Vulnerability Management domain and the product-level technical documentation question (1.3) under Governance & Documentation.
This snapshot is an automated readiness assessment, not legal advice and not a conformity assessment under the CRA.