Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-63179 | winter/wn-backend-module | Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets | medium | 4.9 | 1% |
| CVE-2026-33293 | wwbn/avideo | AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter | high | 8.1 | 1% |
| CVE-2024-11219 | otter-blocks (WordPress plugin) | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Path Traversal in all ver | medium | 5.3 | 1% |
| CVE-2026-62996 | smarty/smarty | Smarty Security stream restriction bypass through stream: resource | medium | 0.0 | 1% |
| CVE-2025-13377 | tenweb-speed-optimizer (WordPress plugin) | The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to arbitrary folder deletion | critical | 9.6 | 1% |
| CVE-2026-25525 | openmage/magento-lts | OpenMage LTS has a Path Traversal Filter Bypass in Dataflow Module | medium | 4.9 | 1% |
| CVE-2026-33681 | wwbn/avideo | AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name | high | 7.2 | 1% |
| CVE-2024-10672 | multiple-pages-generator-by-porthas (WordPress plugin) | The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validat | low | 2.7 | 0% |
| CVE-2026-79773 | winter/wn-system-module | Winter: Local File Inclusion through =include directives in JavaScript asset compilation | medium | 4.9 | 0% |
| CVE-2026-56394 | craftcms/cms | Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read | low | 0.0 | 0% |
| CVE-2024-2210 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.1 via | medium | 6.4 | 0% |
| CVE-2025-66302 | getgrav/grav | Grav vulnerable to Path Traversal allowing server files backup | medium | 6.8 | 0% |
| CVE-2021-44111 | s-cart/s-cart | Path Traversal in S-Cart | medium | 4.4 | 0% |
| CVE-2026-41887 | flarum/core | Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577) | medium | 4.9 | 0% |
| CVE-2026-59944 | composer/composer | Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path | medium | 6.1 | 0% |
| CVE-2026-41058 | wwbn/avideo | WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal | high | 8.1 | 0% |
| CVE-2026-45731 | wwbn/avideo | AVideo: Authenticated Arbitrary File Read in view/update.php | medium | 4.9 | 0% |
| CVE-2025-1022 | spatie/browsershot | Browsershot Path Traversal | high | 8.2 | 0% |
| CVE-2025-1322 | wp-recall (WordPress plugin) | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Information Exposure in all versions up to, and | medium | 4.3 | 0% |
| CVE-2025-4419 | hot-random-image (WordPress plugin) | The Hot Random Image plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.9.2 via the 'path' paramet | medium | 4.3 | 0% |
| CVE-2026-69089 | getgrav/grav | Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images | high | 0.0 | 0% |
| CVE-2023-6120 | usc-e-shop (WordPress plugin) | The Welcart e-Commerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.6 via the upload_ | medium | 4.1 | 0% |
| CVE-2026-46337 | wwbn/avideo | AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php` | medium | 5.3 | 0% |
| CVE-2025-66300 | getgrav/grav | Grav is vulnerable to Arbitrary File Read | high | 8.5 | 0% |
| CVE-2026-55554 | dompdf/dompdf | Dompdf: Chroot Validation Bypass | low | 0.0 | 0% |
| CVE-2026-56722 | dompdf/dompdf | Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI | medium | 0.0 | 0% |
| CVE-2024-38275 | moodle/moodle | Moodle HTTP authorization header is preserved between "emulated redirects" | high | 7.5 | 0% |
| CVE-2024-41373 | icecoder/icecoder | ICEcoder Path Traversal vulnerability | medium | 6.3 | 0% |
| CVE-2026-33238 | wwbn/avideo | AVideo has a Path Traversal in listFiles.json.php Enables Server Filesystem Enumeration | medium | 4.3 | 0% |
| CVE-2026-74907 | getgrav/grav | Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`) | medium | 5.9 | 0% |
| CVE-2024-45604 | contao/core-bundle | Contao affected by directory traversal in the file selector widget | medium | 4.3 | 0% |
| CVE-2025-8151 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.9.1 | medium | 4.3 | 0% |
| CVE-2026-46491 | simplesamlphp/simplesamlphp-module-casserver | SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion | high | 8.6 | 0% |
| CVE-2026-39369 | wwbn/avideo | WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs | high | 7.6 | 0% |
| CVE-2026-46724 | tpwd/ke_search | TYPO3 ke_search path traversal due to lack of normalization on config directory from file indexer | medium | 0.0 | 0% |
| CVE-2026-57961 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has Potential Authenticated Path Traversal in PDF Export | medium | 4.9 | 0% |
| CVE-2026-72697 | getgrav/grav | Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content | medium | 6.5 | 0% |
| CVE-2023-51651 | aws/aws-sdk-php | Potential URI resolution path traversal in the AWS SDK for PHP | medium | 6.0 | 0% |
| CVE-2026-41656 | admidio/admidio | Admidio has Path Traversal via Unvalidated `name` Parameter in Document Add Mode that Enables Arbitrary Server File Read | medium | 4.5 | 0% |
| CVE-2026-33171 | statamic/cms | Statamic has a path traversal in file dictionary fieldtype | medium | 4.3 | 0% |
| CVE-2026-49738 | typo3/cms-core | TYPO3 CMS has Broken Access Control in its File Abstraction Layer | low | 0.0 | 0% |
| CVE-2025-58769 | auth0/auth0-php | auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import | low | 3.3 | 0% |
| CVE-2026-33493 | wwbn/avideo | AVideo has a Path Traversal in import.json.php Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter | high | 7.1 | 0% |
| CVE-2026-49742 | typo3/cms-core, typo3/cms-filelist | TYPO3 CMS has Broken Access Control in its Media Module | high | 0.0 | 0% |
| CVE-2026-107844 | contao/core-bundle | Contao: Path traversal in the images controller | medium | 5.3 | 0% |
| CVE-2026-41655 | admidio/admidio | Admidio has Path Traversal in ECard Preview that Allows Reading Arbitrary Server Files Including Database Credentials | medium | 6.5 | 0% |
| CVE-2026-32262 | craftcms/cms | Craft CMS has a Path Traversal Vulnerability in AssetsController | medium | 0.0 | 0% |
| CVE-2026-55825 | contao/contao, contao/core-bundle | Contao: Possible path traversal in job download URIs | low | 3.1 | 0% |
| CVE-2026-44298 | kimai/kimai | Kimai has an arbitrary file read in its invoice PDF renderer (admin) | medium | 4.1 | 0% |
| CVE-2026-45008 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: Path Traversal in Client::deleteClientFolder enables arbitrary directory deletion by non-super-admin admins | medium | 6.5 | 0% |