Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| GHSA-f624-8hfq-5fh3 | typo3/cms | TYPO3 Information Disclosure of Installed Extensions | medium | 5.3 | – |
| GHSA-g84q-cq55-xwgp | silverstripe/framework | silverstripe/framework member disclosure in login form | medium | 5.3 | – |
| GHSA-p2h4-7fp3-cmh8 | typo3/cms-core | TYPO3 Disclosure of Information about Installed Extensions | medium | 5.3 | – |
| GHSA-pqfv-97hj-g97g | typo3/cms | TYPO3 Frontend vulnerable to Unauthenticated Path Disclosure | medium | 5.3 | – |
| GHSA-qg7m-mwxm-j3h7 | zendframework/zend-developer-tools | Zend-developer-tools information disclosure vulnerability | medium | 5.3 | – |
| GHSA-55pp-293f-3365 | silverstripe/userforms | silverstripe/userforms file upload exposure on UserForms module | medium | 4.3 | – |
| GHSA-wvvp-jwf5-qcpc | typo3/cms-core | TYPO3 Information Disclosure in Page Tree | medium | 4.3 | – |
| GHSA-2237-5r9w-vm8j | opensource-workshop/connect-cms | Connect-CMS information that is restricted to viewing is visible | high | 0.0 | – |
| GHSA-2frx-j9hj-6c65 | lexik/jwt-authentication-bundle | User enumeration in authentication mechanisms | low | 0.0 | – |
| GHSA-2rh5-jvgx-pgw3 | ezsystems/ezplatform | Any storage file can be downloaded from p.sh if full server path is known | high | 0.0 | – |
| GHSA-3g43-xfrw-pv5m | ezsystems/repository-forms | eZ Platform User data disclosure | high | 0.0 | – |
| GHSA-7crc-r3wg-cfgf | ezsystems/ezplatform-solr-search-engine | Json response for search reveals Solr credentials | critical | 0.0 | – |
| GHSA-7fjp-g4m7-fx23 | pwweb/laravel-core | User (Encrypted) Password Field Being Serialised | low | 0.0 | – |
| GHSA-9wwx-c723-vm8x | ezsystems/ezpublish-kernel | eZ Platform REST API returns list of all SiteAccesses | medium | 0.0 | – |
| GHSA-cc2j-92jq-wgjg | ezsystems/ezpublish-legacy | eZ Publish Information disclosure in backend content tree menu | high | 0.0 | – |
| GHSA-cq6h-w3mc-57f4 | shopware/core, shopware/platform | Information exposure via query strings in URL | low | 0.0 | – |
| GHSA-g2qj-pmxm-9f8f | symfony/security-http, symfony/symfony | User enumeration in authentication mechanisms | low | 0.0 | – |
| GHSA-gqcf-83rq-gpfr | ibexa/post-install | Any storage file can be downloaded from p.sh if full server path is known | high | 0.0 | – |
| GHSA-hvgw-gg3p-295j | klaviyo/magento2-extension | Read private customer data reclaiming carts in Klaviyo Magento | medium | 0.0 | – |
| GHSA-mvf6-3f2g-xfxf | endroid/qr-code-bundle | endroid/qr-code-bundle File Disclosure via logo_path query parameter | medium | 0.0 | – |
| GHSA-q683-8468-r6h6 | web-auth/webauthn-symfony-bundle | WebauthnAuthenticator leaks sensitive HTTP headers through INFO-level logs | medium | 0.0 | – |
| GHSA-qwvp-268g-jjm8 | livewire/livewire | Data Leakage Vulnerability in livewire/livewire | medium | 0.0 | – |
| GHSA-v6xp-ccvx-w52m | ibexa/solr | Json response for search reveals Solr credentials | critical | 0.0 | – |
| GHSA-wrpf-2x8h-82gr | typo3/cms | Typo3 Arbitrary File Disclosure in Form Component | medium | 0.0 | – |