Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-25523 | openmage/magento-lts | Magento's X-Original-Url header can expose admin url | medium | 5.3 | 0% |
| CVE-2026-3058 | seraphinite-accelerator (WordPress plugin) | The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.28. | medium | 4.3 | 0% |
| CVE-2026-84308 | phpseclib/phpseclib | phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery | medium | 6.3 | 0% |
| CVE-2024-47057 | mautic/core | Mautic allows user name enumeration due to response time difference on password reset form | medium | 5.3 | 0% |
| CVE-2026-25125 | october/rain | October Rain has Environment Variable Exfiltration via INI Parser Interpolation | medium | 4.9 | 0% |
| CVE-2025-0660 | concrete5/concrete5 | Concrete CMS affected by a stored XSS in Folder Function.The "Add Folder" functionality | medium | 0.0 | 0% |
| CVE-2026-43873 | wwbn/avideo | AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configure | high | 7.5 | 0% |
| CVE-2020-10236 | froxlor/froxlor | Froxlor Information Disclosure | medium | 6.1 | 0% |
| CVE-2024-1534 | woocommerce-jetpack (WordPress plugin) | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions | medium | 6.4 | 0% |
| CVE-2024-2751 | exclusive-addons-for-elementor (WordPress plugin) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘exad_infobox_animating_mask_st | medium | 6.4 | 0% |
| CVE-2026-59882 | guzzlehttp/psr7 | guzzlehttp/psr7: Host Confusion via Weak URI Host Validation | medium | 4.2 | 0% |
| CVE-2025-66307 | getgrav/grav | Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure | medium | 6.5 | 0% |
| CVE-2025-57757 | contao/contao, contao/core-bundle | Contao can disclose sensitive information in the news module | medium | 5.3 | 0% |
| CVE-2026-25597 | prestashop/prestashop | PrestaShop affected by time based enumeration in FO login form | medium | 5.3 | 0% |
| CVE-2026-49742 | typo3/cms-core, typo3/cms-filelist | TYPO3 CMS has Broken Access Control in its Media Module | high | 0.0 | 0% |
| CVE-2024-10321 | widgetkit-for-elementor (WordPress plugin) | The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, | medium | 4.3 | 0% |
| CVE-2024-2179 | concrete5/concrete5 | Concrete CMS Stored Cross-site Scripting vulnerability | low | 2.2 | 0% |
| CVE-2024-8494 | website-builder (WordPress plugin) | The Elementor Website Builder Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 4.3 | 0% |
| CVE-2024-9542 | sky-elementor-addons (WordPress plugin) | The Sky Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6. | medium | 4.3 | 0% |
| CVE-2026-80199 | kimai/kimai | Kimai: Username enumeration via timing on X-AUTH-USER | low | 3.7 | 0% |
| CVE-2026-90936 | froxlor/froxlor | Froxlor: Authenticated customers can read other customers' allowed sender aliases | medium | 4.3 | 0% |
| CVE-2024-4353 | concrete5/concrete5 | Concrete CMS vulnerable to Stored Cross-site Scripting | low | 3.1 | 0% |
| CVE-2025-23204 | api-platform/core | API Platform Core does not call GraphQl securityAfterResolver | medium | 4.4 | 0% |
| CVE-2025-1440 | advanced-iframe (WordPress plugin) | The Advanced iFrame plugin for WordPress is vulnerable to unauthorized excessive creation of options on the aip_map_url_callback() function | medium | 5.3 | 0% |
| CVE-2024-45612 | contao/core-bundle | Contao affected by insert tag injection via canonical URL | medium | 5.3 | 0% |
| CVE-2026-100909 | october/october | October CMS: Incomplete Scheme Validation in Image Resizer | low | 3.9 | 0% |
| CVE-2025-57756 | contao/contao, contao/core-bundle | Contao discloses sensitive information in the front end search index | medium | 5.3 | 0% |
| CVE-2024-6254 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.1. This | medium | 4.3 | 0% |
| CVE-2026-69088 | getgrav/grav | Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure | high | 8.1 | 0% |
| CVE-2026-32270 | craftcms/commerce | Craft Commerce has an unauthenticated information disclosure that can leak some customer order data on anonymous payments | low | 0.0 | 0% |
| CVE-2025-59018 | typo3/cms-workspaces | TYPO3 Workspaces Module Information Disclosure | high | 0.0 | 0% |
| CVE-2024-5439 | blocksy (WordPress theme) | The Blocksy theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the custom_url parameter in all versions up to, and incl | medium | 6.4 | 0% |
| CVE-2023-5551 | moodle/moodle | Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability | low | 3.3 | 0% |
| CVE-2025-9824 | mautic/core | Mautic Vulnerable to User Enumeration via Response Timing | medium | 5.9 | 0% |
| CVE-2026-33688 | wwbn/avideo | AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint | medium | 5.3 | 0% |
| CVE-2024-5533 | divi (WordPress theme) | The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.25.1 due to insufficient i | medium | 6.4 | 0% |
| CVE-2026-41670 | admidio/admidio | Admidio Sends SAML Response to Unvalidated Assertion Consumer Service URL from AuthnRequest | high | 8.2 | 0% |
| CVE-2025-68436 | craftcms/cms | Craft CMS vulnerable to potential information disclosure via unchecked asset relocation | medium | 0.0 | 0% |
| CVE-2026-44738 | getgrav/grav | Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray() | high | 7.7 | 0% |
| CVE-2026-2898 | funadmin/funadmin | funadmin: Deserialization Vulnerability in Backend Endpoint via AuthCloudService getMember Function | medium | 5.5 | 0% |
| CVE-2026-107843 | contao/core-bundle | Contao: The registration module re-sends activation mails | medium | 5.3 | 0% |
| CVE-2026-49288 | statamic/cms | Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources | medium | 4.3 | 0% |
| CVE-2025-62400 | moodle/moodle | Moodle exposed the names of hidden groups to users | medium | 4.3 | 0% |
| CVE-2026-33882 | statamic/cms | Statamic's Markdown preview endpoint exposes sensitive user data | medium | 6.5 | 0% |
| CVE-2026-27131 | putyourlightson/craft-sprig | Sprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playground | medium | 5.5 | 0% |
| CVE-2026-107842 | contao/core-bundle | Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled | medium | 5.3 | 0% |
| CVE-2026-32629 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor | medium | 0.0 | 0% |
| CVE-2026-41659 | admidio/admidio | Admidio Leaks Hidden Profile Field Values via Blind Search Oracle in Member Assignment | low | 2.7 | 0% |
| CVE-2026-47132 | thorsten/phpmyfaq | phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration | medium | 5.4 | 0% |
| CVE-2026-40908 | wwbn/avideo | WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php Exposes Developer Emails and Deployed Version | medium | 5.3 | 0% |