Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.28.3, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2017-9841 KEV | phpunit/phpunit | Code Injection in PHPUnit | critical | 9.8 | 100% |
| CVE-2026-109618 KEV | PHP engine | Upload-progress use-after-free and remote process-memory disclosure | critical | 9.2 | 100% |
| CVE-2026-109619 KEV | PHP engine | Fatal-error backtrace use-after-free and OPcache type confusion | critical | 9.2 | 100% |
| CVE-2024-34102 KEV | magento/community-edition, magento/product-community-edition | Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability | critical | 9.8 | 100% |
| CVE-2018-7600 KEV | drupal/core, drupal/drupal | A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows a | critical | 9.8 | 100% |
| CVE-2024-4577 KEV | PHP engine | PHP-CGI argument injection to RCE on Windows via Best-Fit encoding | critical | 9.8 | 100% |
| CVE-2021-3129 KEV | facade/ignition | Unauthenticated remote code execution via insecure file handling in debug mode | critical | 9.8 | 100% |
| CVE-2025-32432 KEV | craftcms/cms | Craft CMS Allows Remote Code Execution | critical | 10.0 | 100% |
| CVE-2019-11043 KEV | PHP engine | PHP-FPM remote code execution via env_path_info buffer underflow | critical | 9.8 | 100% |
| CVE-2016-10033 KEV | phpmailer/phpmailer | Remote code execution via crafted Sender in the isMail transport | critical | 9.8 | 100% |
| CVE-2025-49113 KEV | roundcube/roundcubemail | Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization | critical | 9.9 | 100% |
| CVE-2022-24086 KEV | magento/community-edition | Magento improper input validation vulnerability | critical | 9.8 | 99% |
| CVE-2018-7602 KEV | drupal/core, drupal/drupal | A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows a | critical | 9.8 | 99% |
| CVE-2021-21311 KEV | vrana/adminer | SSRF in adminer | high | 7.2 | 98% |
| CVE-2020-11738 KEV | duplicator (WordPress plugin) | The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the f | high | 7.5 | 98% |
| CVE-2024-56145 KEV | craftcms/cms | Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled | critical | 9.8 | 97% |
| CVE-2020-25213 KEV | wp-file-manager (WordPress plugin) | Unauthenticated arbitrary file upload to RCE via the elFinder connector | critical | 10.0 | 97% |
| CVE-2025-54068 KEV | livewire/livewire | Livewire is vulnerable to remote command execution during component property update hydration | critical | 9.8 | 96% |
| CVE-2025-54236 KEV | magento/community-edition, magento/project-community-edition | Magento Community Edition Improper Input Validation vulnerability | critical | 9.1 | 95% |
| CVE-2019-6340 KEV | drupal/core, drupal/drupal | Some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in s | high | 8.1 | 92% |
| CVE-2021-32648 KEV | october/system | Account Takeover in Octobercms | high | 8.2 | 90% |
| CVE-2026-9082 KEV | drupal/core | Drupal core includes a database abstraction API to ensure that queries executed against the database are sanitized to pr | critical | 9.8 | 89% |
| CVE-2020-35489 KEV | contact-form-7 (WordPress plugin) | Unrestricted file upload via unsanitised filenames (double extension) | critical | 10.0 | 89% |
| CVE-2024-58136 KEV | yiisoft/yii2 | yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key | critical | 9.0 | 88% |
| CVE-2020-11023 KEV | components/jquery | Potential XSS vulnerability in jQuery | medium | 6.9 | 85% |
| CVE-2020-28949 KEV | pear/archive_tar | Potential file overwrite if archive filename starts with file:// | unknown | 0.0 | 85% |
| CVE-2018-15133 KEV | laravel/framework | Laravel Framework RCE Vulnerability | high | 8.1 | 77% |
| CVE-2019-9978 KEV | social-warfare (WordPress plugin), social-warfare-pro (WordPress plugin) | The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter | medium | 6.1 | 73% |
| CVE-2020-36193 KEV | pear/archive_tar | Directory Traversal in Archive_Tar | high | 7.5 | 71% |
| CVE-2024-28000 KEV | litespeed-cache (WordPress plugin) | Unauthenticated privilege escalation to administrator via weak hash in the crawler | critical | 9.8 | 68% |
| CVE-2020-13671 KEV | drupal/core, drupal/drupal | *Update November 18: Documented longer list of dangerous file extensions* Drupal core does not properly sanitize certai | high | 8.8 | 36% |
| CVE-2025-23209 KEV | craftcms/cms | Craft CMS has a potential RCE with a compromised security key | high | 8.0 | 22% |
| CVE-2026-63030 KEV | WordPress core | WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the | critical | 9.8 | 11% |
| CVE-2026-60137 KEV | WordPress core | WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query | medium | 5.9 | 5% |
| CVE-2025-35939 KEV | craftcms/cms | Craft CMS stores arbitrary content provided by unauthenticated users in session files | medium | 5.3 | 1% |
| CVE-2020-11022 | athlon1600/youtube-downloader, components/jquery, maximebf/debugbar | Potential XSS vulnerability in jQuery | medium | 6.9 | 99% |
| CVE-2022-39986 | billz/raspap-webgui | RaspAP Command Injection vulnerability | critical | 9.8 | 99% |
| CVE-2022-24637 | open-web-analytics/open-web-analytics | Improper Privilege Management in Open Web Analytics | critical | 9.8 | 99% |
| CVE-2018-12613 | phpmyadmin/phpmyadmin | phpMyAdmin Improper Authentication | high | 8.8 | 98% |
| CVE-2023-6553 | backup-backup (WordPress plugin) | The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includ | critical | 9.8 | 98% |
| CVE-2022-21661 | WordPress core | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitizatio | high | 8.0 | 98% |
| CVE-2016-10045 | phpmailer/phpmailer | Remote code execution in PHPMailer | critical | 9.8 | 98% |
| CVE-2023-0315 | froxlor/froxlor | Froxlor vulnerable to Command Injection | high | 8.8 | 98% |
| CVE-2019-9194 | studio-42/elfinder | elFinder command injection vulnerability in the PHP connector | critical | 9.8 | 97% |
| CVE-2020-11530 | chop-slider (WordPress plugin) | A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin. The vulnerability is introduced in the id GET parameter | critical | 9.8 | 95% |
| CVE-2020-24186 | wpdiscuz (WordPress plugin) | A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated u | critical | 10.0 | 95% |
| CVE-2020-14092 | payment-form-for-paypal-pro (WordPress plugin) | The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection. | critical | 9.8 | 95% |
| CVE-2022-3562 | librenms/librenms | Cross-site Scripting in librenms/librenms | medium | 5.4 | 94% |
| CVE-2023-41892 | craftcms/cms | Craft CMS Remote Code Execution vulnerability | critical | 10.0 | 94% |
| CVE-2024-8856 | wp-time-capsule (WordPress plugin) | The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation i | critical | 9.8 | 94% |