Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| GHSA-8h4m-r4wm-xj7r | typo3/cms | TYPO3 Arbitrary Code Execution via File List Module | high | 8.8 | – |
| GHSA-f9hr-7cfq-mjg2 | typo3/cms-core | TYPO3 Arbitrary Code Execution via File List Module | high | 8.8 | – |
| GHSA-vcg6-8fxc-x5cq | silverstripe/framework | silverstripe/framework allows upload of dangerous file types | high | 8.8 | – |
| GHSA-gxxh-8vcj-w2mh | mckenziearts/livewire-markdown-editor | livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handler | high | 7.1 | – |
| GHSA-7gwj-7fhm-vw4w | drupal/core | Drupal core unrestricted file upload | medium | 6.6 | – |
| GHSA-9jxr-mwpp-w643 | httpsoft/http-message | Improper header validation in httpsoft/http-message | medium | 5.3 | – |
| GHSA-wjfc-pgfp-pv9c | nyholm/psr7 | Improper Input Validation in nyholm/psr7 | medium | 5.3 | – |
| GHSA-7jp2-5h22-m432 | auth0/symfony | Auth0 Symfony SDK Does Not Properly Handle File Types in Bulk User Import | low | 3.3 | – |
| GHSA-hjfh-5jmm-xr24 | auth0/login | laravel-auth0 SDK Does Not Properly Handle File Types in Bulk User Import | low | 3.3 | – |
| GHSA-58xv-7h9r-mx3c | drupal/drupal | Drupal Malicious file upload with filenames stating with dot | medium | 0.0 | – |
| GHSA-9j39-4686-m3c4 | ibexa/core | Ibexa Kernel's files with blacklisted extensions can be still saved to drafts | medium | 0.0 | – |
| GHSA-mwvh-p3hx-x4gg | ezsystems/ezplatform-kernel | Ibexa Kernel's files with blacklisted extensions can be still saved to drafts | medium | 0.0 | – |