Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-48820 | cakephp/cakephp | CakePHP: View::element() is missing a path containment check | medium | 0.0 | 0% |
| CVE-2026-26067 | october/system | October CMS has Safe Mode Bypass via CSS Preprocessor Compilers | medium | 4.9 | 0% |
| CVE-2026-42549 | flightphp/core | Flight has path traversal in `make:controller` CLI that creates arbitrary directories outside project root | medium | 4.4 | 0% |
| CVE-2026-72783 | craftcms/cms | Craft CMS: Incorrect path validation could potentially lead to path traversal | low | 0.0 | 0% |
| CVE-2026-55878 | symfony/ux-toolkit | symfony/ux-toolkit: Path Traversal Allows Arbitrary File Write and Read via Crafted Recipe Manifest | high | 7.8 | 0% |
| CVE-2026-59946 | composer/composer | Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files | medium | 6.1 | 0% |
| CVE-2026-59948 | composer/composer | Composer: Arbitrary file write outside vendor via malicious transitive package name | high | 7.0 | 0% |
| GHSA-hgjx-r89m-m7v4 | facturascripts/facturascripts | FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE | critical | 9.9 | – |
| GHSA-x86x-qhf8-f37w | willdurand/js-translation-bundle | willdurand/js-translation-bundle potential path traversal attack and remote code injection | critical | 9.8 | – |
| CVE-2026-76913 | notrinos/notrinos-erp | NotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM employee "Documents" (doc_file) | high | 8.8 | – |
| GHSA-x428-565f-8xj2 | typo3/cms-core | TYPO3 Arbitrary Code Execution and Cross-Site Scripting in Backend API | high | 8.8 | – |
| CVE-2026-54065 | nukeviet/nukeviet | NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function | high | 8.7 | – |
| CVE-2026-45693 | facturascripts/facturascripts | FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads Private MyFiles Documents | high | 7.5 | – |
| GHSA-hx3m-959f-v849 | zendframework/zendframework1 | ZendFramework local file inclusion vector in `Zend_View::setScriptPath()` and `render()` | high | 7.5 | – |
| GHSA-2wwr-9x6f-88gp | easycorp/easyadmin-bundle | EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components | medium | 5.3 | – |
| GHSA-7cvr-xhm5-x998 | twig/twig | Twig Path Traversal vulnerability in the filesystem loader | medium | 5.3 | – |
| GHSA-6wh5-mw9h-5c3w | shopware/core, shopware/platform | Shopware vulnerable to path traversal via Plugin upload | low | 2.7 | – |