Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.04.1, updated 2026-11-03. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| GHSA-g5vj-wj9x-4jg9 | symbiote/silverstripe-multivaluefield | symbiote/silverstripe-multivaluefield Possible PHP Object Injection via Multi-Value Field Extension | medium | 6.1 | – |
| GHSA-g6f5-4w43-2x63 | socalnick/scn-social-auth | ScnSocialAuth Cross-site Scripting vulnerability in login redirect param | medium | 6.1 | – |
| GHSA-g7hw-jh4p-75wr | typo3/cms | TYPO3 Cross-Site Scripting in Filelist Module | medium | 6.1 | – |
| GHSA-gvpp-6jrj-5pqc | zendframework/zend-form | Zend-Form vulnerable to Cross-site Scripting | medium | 6.1 | – |
| GHSA-gwpm-pm6x-h7rj | zendframework/zendframework1 | ZendFramework Cross-site Scripting vector in `Zend_Filter_StripTags` | medium | 6.1 | – |
| GHSA-hg35-vqp3-fv39 | zendframework/zendframework1 | ZendFramework potential Cross-site Scripting vectors due to inconsistent encodings | medium | 6.1 | – |
| GHSA-hhvj-mcrx-3vcf | silverstripe/framework | silverstripe/framework has Cross-site Scripting vulnerability in page name | medium | 6.1 | – |
| GHSA-j543-vg33-g6vj | zendframework/zendframework1 | ZendFramework potential Cross-site Scripting vector in `Zend_Dojo_View_Helper_Editor` | medium | 6.1 | – |
| GHSA-j982-5jv7-v43r | silverstripe/framework | Silverstripe Form field validation message XSS vulnerability | medium | 6.1 | – |
| GHSA-jqp8-v74p-g8px | silverstripe/framework | Silverstripe XSS in Director::force_redirect() | medium | 6.1 | – |
| GHSA-jqr7-5h7r-ch8p | shopware/shopware | Shopware Non-Persistent XSS in the Frontend | medium | 6.1 | – |
| GHSA-m7hr-j867-3f34 | zendframework/zend-view | ZendFramework has potential Cross-site Scripting vector in multiple view helpers | medium | 6.1 | – |
| GHSA-m8v7-x398-pxrf | silverstripe/framework | Silverstripe XSS in CMS Edit Page | medium | 6.1 | – |
| GHSA-mpqj-f4v3-334h | silverstripe/framework | Silverstripe Cross-site scripting vulnerability in VersionedRequestFilter | medium | 6.1 | – |
| GHSA-mqf5-275h-gf6r | silverstripe/framework | Silverstripe framework is vulnerable to XSS in install.php | medium | 6.1 | – |
| GHSA-mxjf-hc9v-xgv2 | typo3/cms | ExtJS JavaScript framework used in TYPO3 vulnerable to Cross-site Scripting | medium | 6.1 | – |
| GHSA-pp7q-6j3f-74vj | silverstripe/framework | silverstripe/framework has Cross-site Scripting vulnerability in RedirectorPage | medium | 6.1 | – |
| GHSA-pp7v-wxx9-hm6r | thelia/backoffice-default-template | Thelia BackOffice default template vulnerable to Cross-site Scripting | medium | 6.1 | – |
| GHSA-r32j-mr8p-hfp8 | silverstripe/framework | Silverstripe XSS in TreeDropdownField and TreeMultiSelectField | medium | 6.1 | – |
| GHSA-r85g-7jpv-8xrx | silverstripe/framework | silverstripe/framework has Cross-site Scripting vulnerability in CMSSecurity BackURL | medium | 6.1 | – |
| GHSA-r97r-64vp-fghm | silverstripe/cms | Silverstripe XSS vulnerability via VirtualPage | medium | 6.1 | – |
| GHSA-v8m4-3w37-ghxx | typo3/cms | TYPO3 Cross-Site Scripting in Form Framework validation handling | medium | 6.1 | – |
| GHSA-vjwg-28gv-pm8h | pimcore/pimcore | Pimcore TinyMCE Bundle - tinymce CVE-2024-29203, CVE-2024-29881 | medium | 6.1 | – |
| GHSA-vpr3-cw3h-prw8 | simplesamlphp/simplesamlphp | SimpleSAMLphp Reflected Cross-site Scripting vulnerability | medium | 6.1 | – |
| GHSA-vq4j-qcx7-ppc6 | thelia/thelia | Thelia Cross-site Scripting vulnerability in BackOffice | medium | 6.1 | – |
| GHSA-vvm3-rv48-j3g5 | zendframework/zendframework1 | Zendframework Potential XSS or HTML Injection vector in Zend_Json | medium | 6.1 | – |
| GHSA-wg8h-gxf4-g4gh | typo3/cms-core | TYPO3 Cross-Site Scripting in Online Media Asset Rendering | medium | 6.1 | – |
| GHSA-xgmx-j3hv-jh9x | typo3/cms | TYPO3 Cross-Site Scripting in Link Handling | medium | 6.1 | – |
| CVE-2025-30083 | codingms/additional-tca | Additional TCA Allows Cross-Site Scripting (XSS) | medium | 5.5 | – |
| GHSA-2rcw-9hrm-8q7q | typo3/cms | TYPO3 Cross-Site Scripting in Frontend User Login | medium | 5.4 | – |
| GHSA-52cw-pvq9-9m5v | silverstripe/framework | Silverstripe uses TinyMCE which allows svg files linked in object tags | medium | 5.4 | – |
| GHSA-7q33-hxwj-7p8v | typo3/cms | TYPO3 Cross-Site Scripting in Backend Modal Component | medium | 5.4 | – |
| GHSA-8m6j-p5jv-v69w | typo3/cms | TYPO3 Cross-Site Scripting in Online Media Asset Rendering | medium | 5.4 | – |
| GHSA-gc5h-6jx9-q2qh | ezsystems/ezplatform-admin-ui | eZ Platform Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget | medium | 5.4 | – |
| GHSA-gp6m-fq6h-cjcx | openmage/magento-lts | Magento LTS vulnerable to stored XSS in admin file form | medium | 5.4 | – |
| GHSA-qrfh-cc86-vc8c | leantime/leantime | Leantime has HTML injection through firstname and lastname fields | medium | 5.4 | – |
| GHSA-r9vp-fp72-xgf7 | silverstripe/framework | silverstripe/framework's `Member.Name` is not escaped | medium | 5.4 | – |
| GHSA-v4qr-8h2v-qpjx | typo3/cms | Cross-Site Scripting in TYPO3 CMS Backend | medium | 5.4 | – |
| GHSA-wp8j-c736-c5r3 | typo3/cms | TYPO3 Cross-Site Scripting Vulnerability Exploitable by Editors | medium | 5.4 | – |
| GHSA-2wwr-9x6f-88gp | easycorp/easyadmin-bundle | EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components | medium | 5.3 | – |
| GHSA-vfgc-c76h-mwh4 | drupal/core | Drupal core Cross-Site Scripting (XSS) vulnerabilities | medium | 5.3 | – |
| CVE-2022-3788 | tobiasbg/tablepress | TablePress Plugin vulnerable to Cross-site Scripting | medium | 4.8 | – |
| GHSA-2xpm-cmvw-3jcc | pimcore/pimcore | Reflected XSS in Application Logger module | medium | 4.8 | – |
| GHSA-297g-xg4h-7w4c | illuminate/view | Laravel Cross-site Scripting vulnerability in blade templating | medium | 4.7 | – |
| GHSA-hq4p-5mpr-jj9m | silverstripe/framework | Silverstripe XSS in dev/build returnURL Parameter | medium | 4.7 | – |
| GHSA-m8fw-p3cr-6jqc | typo3/cms-rte-ckeditor | Cross-Site Scripting in CKEditor4 WordCount Plugin | medium | 4.7 | – |
| GHSA-q9j3-4ghj-6h57 | codeigniter/framework | Inadequate XSS Prevention in CodeIgniter/Framework Security Library | medium | 4.7 | – |
| GHSA-5wx6-xwxf-q8qj | typo3/cms | Cross-Site Scripting in TYPO3 Backend | medium | 4.6 | – |
| GHSA-86r8-4g3w-7xjp | typo3/cms | Cross-Site Scripting in TYPO3 Backend | medium | 4.6 | – |
| GHSA-qf65-hph9-453r | drupal/drupal | Drupal Cross-Site Scripting (XSS) affecting CKEditor Third-party library | medium | 4.6 | – |