Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-43429 | moodle/moodle | Moodle has user information visibility control issues in gradebook reports | medium | 5.3 | 0% |
| CVE-2026-35449 | wwbn/avideo | AVideo: Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php | medium | 5.3 | 0% |
| CVE-2026-56384 | craftcms/cms | Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission | medium | 0.0 | 0% |
| CVE-2026-25523 | openmage/magento-lts | Magento's X-Original-Url header can expose admin url | medium | 5.3 | 0% |
| CVE-2026-3058 | seraphinite-accelerator (WordPress plugin) | The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.28. | medium | 4.3 | 0% |
| CVE-2026-25125 | october/rain | October Rain has Environment Variable Exfiltration via INI Parser Interpolation | medium | 4.9 | 0% |
| CVE-2025-57757 | contao/contao, contao/core-bundle | Contao can disclose sensitive information in the news module | medium | 5.3 | 0% |
| CVE-2026-49742 | typo3/cms-core, typo3/cms-filelist | TYPO3 CMS has Broken Access Control in its Media Module | high | 0.0 | 0% |
| CVE-2024-10321 | widgetkit-for-elementor (WordPress plugin) | The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, | medium | 4.3 | 0% |
| CVE-2024-8494 | website-builder (WordPress plugin) | The Elementor Website Builder Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 4.3 | 0% |
| CVE-2024-9542 | sky-elementor-addons (WordPress plugin) | The Sky Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6. | medium | 4.3 | 0% |
| CVE-2026-90936 | froxlor/froxlor | Froxlor: Authenticated customers can read other customers' allowed sender aliases | medium | 4.3 | 0% |
| CVE-2025-57756 | contao/contao, contao/core-bundle | Contao discloses sensitive information in the front end search index | medium | 5.3 | 0% |
| CVE-2026-69088 | getgrav/grav | Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure | high | 8.1 | 0% |
| CVE-2026-32270 | craftcms/commerce | Craft Commerce has an unauthenticated information disclosure that can leak some customer order data on anonymous payments | low | 0.0 | 0% |
| CVE-2025-59018 | typo3/cms-workspaces | TYPO3 Workspaces Module Information Disclosure | high | 0.0 | 0% |
| CVE-2023-5551 | moodle/moodle | Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability | low | 3.3 | 0% |
| CVE-2025-68436 | craftcms/cms | Craft CMS vulnerable to potential information disclosure via unchecked asset relocation | medium | 0.0 | 0% |
| CVE-2026-44738 | getgrav/grav | Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray() | high | 7.7 | 0% |
| CVE-2026-49288 | statamic/cms | Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources | medium | 4.3 | 0% |
| CVE-2025-62400 | moodle/moodle | Moodle exposed the names of hidden groups to users | medium | 4.3 | 0% |
| CVE-2026-33882 | statamic/cms | Statamic's Markdown preview endpoint exposes sensitive user data | medium | 6.5 | 0% |
| CVE-2026-27131 | putyourlightson/craft-sprig | Sprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playground | medium | 5.5 | 0% |
| CVE-2026-107842 | contao/core-bundle | Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled | medium | 5.3 | 0% |
| CVE-2026-41659 | admidio/admidio | Admidio Leaks Hidden Profile Field Values via Blind Search Oracle in Member Assignment | low | 2.7 | 0% |
| CVE-2026-47132 | thorsten/phpmyfaq | phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration | medium | 5.4 | 0% |
| CVE-2026-40908 | wwbn/avideo | WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php Exposes Developer Emails and Deployed Version | medium | 5.3 | 0% |
| CVE-2026-26067 | october/system | October CMS has Safe Mode Bypass via CSS Preprocessor Compilers | medium | 4.9 | 0% |
| CVE-2026-55824 | contao/contao, contao/core-bundle | Contao crawler leaks auth credentials to external hosts | low | 2.6 | 0% |
| CVE-2026-47351 | typo3/cms-backend, typo3/cms-core | TYPO3 CMS: Broken Access Control in Media Module | medium | 0.0 | 0% |
| CVE-2025-59019 | typo3/cms-backend, typo3/cms-recordlist | TYPO3 CSV download feature information disclosure | medium | 0.0 | 0% |
| CVE-2020-10237 | froxlor/froxlor | Froxlor Exposure of Sensitive Information to an Unauthorized Actor | medium | 5.5 | 0% |
| CVE-2026-33886 | statamic/cms | Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields | medium | 6.5 | 0% |
| CVE-2026-55651 | alextselegidis/easyappointments | Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure | high | 7.1 | 0% |
| CVE-2026-27892 | facturascripts/facturascripts | FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download | medium | 6.5 | 0% |
| CVE-2026-33161 | craftcms/cms | Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users | low | 0.0 | 0% |
| CVE-2026-47234 | admidio/admidio | Admidio writes session IDs and auto-login cookie values to application logs | medium | 4.4 | 0% |
| CVE-2026-4202 | ayacoo/redirect-tab | Broken Access Control in extension "Redirect Tab" (redirect_tab) | medium | 4.3 | 0% |
| CVE-2026-59883 | guzzlehttp/guzzle | Guzzle: Cookie Disclosure and Injection via IP-Address Domains | medium | 4.7 | 0% |
| CVE-2014-5245 | symfony/http-kernel, symfony/symfony | Symfony allows direct access of ESI URLs behind a trusted proxy | high | 7.5 | – |
| GHSA-97h7-mf38-g9mf | vrana/adminer | Adminer file disclosure vulnerability | high | 7.5 | – |
| GHSA-55qg-6c4m-mw6g | silverstripe/framework | silverstripe/framework's URL parameters `isDev` and `isTest` unguarded | medium | 6.5 | – |
| GHSA-r287-hc8j-w56h | typo3/cms | TYPO3 Information Disclosure Vulnerability Exploitable by Editors | medium | 6.5 | – |
| GHSA-r3pr-fh25-wrfc | silverstripe/framework | silverstripe/framework's install.php script discloses sensitive data by pre-populating DB credential forms | medium | 6.5 | – |
| GHSA-wwgf-3xp7-cxj4 | gos/web-socket-bundle | Potentially sensitive data exposure in Symfony Web Socket Bundle | medium | 5.9 | – |
| GHSA-2fhr-8r8r-qp56 | zendframework/zendframework | ZendFramework Information Disclosure and Insufficient Entropy vulnerability | medium | 5.3 | – |
| GHSA-6487-3qvg-8px9 | typo3/cms | TYPO3 Information Disclosure in Install Tool | medium | 5.3 | – |
| GHSA-66c2-7g4p-wx4p | typo3/cms-core | TYPO3 Information Disclosure in Install Tool | medium | 5.3 | – |
| GHSA-7mc6-x925-7qvx | microsoft/microsoft-graph-beta | Test code in published microsoft-graph-beta package exposes phpinfo() | medium | 5.3 | – |
| GHSA-crr3-h4m8-7f56 | silverstripe/framework | silverstripe/framework vulnerable to member disclosure in login form | medium | 5.3 | – |