CRA Readiness Snapshot
What you would have to assess for ENISA reporting tomorrow
No dependency in this snapshot currently appears in CISA's Known Exploited Vulnerabilities catalog. Today, nothing would trigger the 24-hour early-warning obligation of CRA Art. 14. That can change any day a new KEV entry lands, which is exactly what continuous monitoring is for.
⚠ No lockfile — SBOM is not reproducible
This scan is based on a manifest (composer.lock, package.json), not a lockfile. 52 of 323 dependencies are version ranges, so the exact shipped versions — and their transitive dependencies — cannot be verified. Under the CRA's full obligations (11 December 2027) you must produce a machine-readable SBOM of what you actually ship. Committing a lockfile is the single highest-impact fix in this report.
All findings (22)
| Package | Version | Advisory | Severity | EPSS | Fixed in | Summary |
|---|---|---|---|---|---|---|
| postcss dev | ^8.5.28 | CVE-2021-23368 | MODERATE | 3.5% | 7.0.36 | Regular Expression Denial of Service in postcss |
| postcss dev | ^8.5.28 | CVE-2021-23382 | MODERATE | 2.6% | 8.2.13 | Regular Expression Denial of Service in postcss |
| webpack dev | ^5.111.1 | CVE-2023-28154 | CRITICAL | 1.4% | 5.76.0 | Cross-realm object access in Webpack 5 |
| highlight.js | ^11.12.0 | CVE-2020-26237 | MODERATE | 1.3% | 9.18.2 | Prototype Pollution in highlight.js |
| mathjax | ^4.1.3 | CVE-2018-1999024 | MODERATE | 1.3% | 2.7.4 | Macro in MathJax running untrusted Javascript within a web browser |
| webpack dev | ^5.111.1 | CVE-2024-43788 | MODERATE | 1.0% | 5.94.0 | Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS |
| postcss dev | ^8.5.28 | CVE-2023-44270 | MODERATE | 0.8% | 8.4.31 | PostCSS line return parsing error |
| mathjax | ^4.1.3 | CVE-2023-39663 | HIGH | 0.8% | — | MathJax Regular expression Denial of Service (ReDoS) |
| @materializecss/materialize | ^1.2.2 | CVE-2019-11002 | MODERATE | 0.8% | 1.1.0-alpha | Materialize-css vulnerable to Cross-site Scripting in tooltip component |
| @materializecss/materialize | ^1.2.2 | CVE-2019-11004 | MODERATE | 0.8% | 1.1.0-alpha | Materialize-css vulnerable to Improper Neutralization of Input During Web Page Generation |
| @materializecss/materialize | ^1.2.2 | CVE-2019-11003 | MODERATE | 0.8% | 1.1.0-alpha | Materialize-css vulnerable to Cross-site Scripting in autocomplete component |
| postcss dev | ^8.5.28 | CVE-2026-45623 | HIGH | 0.6% | 8.5.12 | PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments |
| postcss dev | ^8.5.28 | CVE-2026-73646 | HIGH | 0.5% | 8.5.18 | PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure |
| postcss dev | ^8.5.28 | CVE-2026-69153 | MODERATE | 0.5% | 8.5.23 | PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset |
| phpseclib/phpseclib | 3.0.55 | CVE-2026-84308 | MODERATE | 0.3% | 3.0.57 | phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery |
| postcss dev | ^8.5.28 | CVE-2026-41305 | MODERATE | 0.3% | 8.5.10 | PostCSS has XSS via Unescaped </style> in its CSS Stringify Output |
| webpack dev | ^5.111.1 | CVE-2025-68157 | LOW | 0.2% | 5.104.0 | webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence |
| webpack dev | ^5.111.1 | CVE-2025-68458 | LOW | 0.2% | 5.104.1 | webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior |
| @babel/core dev | ^7.29.7 | CVE-2026-49356 | LOW | 0.2% | 8.0.0-rc.6 | @babel/core: Arbitrary File Read via sourceMappingURL Comment |
| spomky-labs/otphp | 10.0.3 | GHSA-g7m4-839x-ch6v | HIGH | — | 11.4.3 | spomky-labs/otphp: Unbounded digits parameter in a provisioning URI triggers an uncaught DivisionByZeroError in OTP generation |
| spomky-labs/otphp | 10.0.3 | GHSA-2jx3-65f3-xr8r | MODERATE | — | 11.4.3 | spomky-labs/otphp: Mass-assignment in Factory::loadFromProvisioningUri lets a hostile provisioning URI corrupt OTP state or leak an uncaught... |
| highlight.js | ^11.12.0 | GHSA-7wwv-vh3v-89cq | MODERATE | — | 10.4.1 | ReDOS vulnerabities: multiple grammars |
SBOM summary
323 direct dependencies scanned (271 pinned to exact versions) from composer.lock, package.json. Vulnerability data: OSV.dev · exploitation status: CISA KEV · exploit probability: FIRST EPSS. Findings on unpinned dependencies cover the full constraint range and may not apply to the exact version deployed.
Using ENISA's CRA Maturity Assessment Model for SMEs? This snapshot provides evidence for the Vulnerability Management domain and the product-level technical documentation question (1.3) under Governance & Documentation.
This snapshot is an automated readiness assessment, not legal advice and not a conformity assessment under the CRA.