Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-26067 | october/system | October CMS has Safe Mode Bypass via CSS Preprocessor Compilers | medium | 4.9 | 0% |
| CVE-2026-55824 | contao/contao, contao/core-bundle | Contao crawler leaks auth credentials to external hosts | low | 2.6 | 0% |
| CVE-2026-47351 | typo3/cms-backend, typo3/cms-core | TYPO3 CMS: Broken Access Control in Media Module | medium | 0.0 | 0% |
| CVE-2025-59016 | typo3/cms-core | TYPO3 CMS exposes sensitive information in an error message | medium | 0.0 | 0% |
| CVE-2025-59019 | typo3/cms-backend, typo3/cms-recordlist | TYPO3 CSV download feature information disclosure | medium | 0.0 | 0% |
| CVE-2020-10237 | froxlor/froxlor | Froxlor Exposure of Sensitive Information to an Unauthorized Actor | medium | 5.5 | 0% |
| CVE-2026-6626 | cockpit-hq/cockpit | Cockpit has NoSQL Injection Through Content Aggregation Pipelines | medium | 6.3 | 0% |
| CVE-2026-33886 | statamic/cms | Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields | medium | 6.5 | 0% |
| CVE-2026-31888 | shopware/core, shopware/platform | Shopware has user enumeration via distinct error codes on Store API login endpoint | medium | 5.3 | 0% |
| CVE-2026-55651 | alextselegidis/easyappointments | Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure | high | 7.1 | 0% |
| CVE-2026-27892 | facturascripts/facturascripts | FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download | medium | 6.5 | 0% |
| CVE-2026-7317 | getgrav/grav | Grav has Insecure Deserialization in File Cache | medium | 5.0 | 0% |
| CVE-2026-48011 | shopware/core, shopware/platform | Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames | low | 3.7 | 0% |
| CVE-2026-53723 | guzzlehttp/guzzle-services | guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA Terminator | medium | 5.8 | 0% |
| CVE-2026-33161 | craftcms/cms | Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users | low | 0.0 | 0% |
| CVE-2026-72701 | getgrav/grav | Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection | low | 3.7 | 0% |
| CVE-2026-44306 | statamic/cms | Statamic CMS vulnerable to email enumeration via forgot password endpoint | medium | 5.3 | 0% |
| CVE-2025-58759 | datahihi1/tiny-env | TinyEnv: Inline comments not stripped properly in .env values | medium | 5.1 | 0% |
| CVE-2026-48998 | guzzlehttp/psr7 | guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation | medium | 5.3 | 0% |
| CVE-2026-45620 | wwbn/avideo | AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration sibling that survives `d9cdc7024 | medium | 5.3 | 0% |
| CVE-2026-49214 | guzzlehttp/psr7 | guzzlehttp/psr7 has CRLF Injection via URI Host Component | medium | 5.3 | 0% |
| CVE-2026-54736 | phalcon/cphalcon | Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel) | high | 0.0 | 0% |
| CVE-2026-47234 | admidio/admidio | Admidio writes session IDs and auto-login cookie values to application logs | medium | 4.4 | 0% |
| CVE-2026-4202 | ayacoo/redirect-tab | Broken Access Control in extension "Redirect Tab" (redirect_tab) | medium | 4.3 | 0% |
| CVE-2026-59883 | guzzlehttp/guzzle | Guzzle: Cookie Disclosure and Injection via IP-Address Domains | medium | 4.7 | 0% |
| CVE-2025-55155 | mantisbt/mantisbt | MantisBT lacks verification when changing a user's email address | medium | 5.4 | 0% |
| CVE-2026-34383 | admidio/admidio | Admidio has CSRF and Form Validation Bypass in Inventory Item Save via `imported` Parameter | medium | 4.3 | 0% |
| GHSA-346h-749j-r28w | mdanter/ecc | PHPECC vulnerable to multiple cryptographic side-channel attacks | critical | 9.1 | – |
| GHSA-45xg-4w5x-j429 | typo3/cms | TYPO3 Arbitrary Shell Execution in Swiftmailer library | high | 8.1 | – |
| CVE-2014-5245 | symfony/http-kernel, symfony/symfony | Symfony allows direct access of ESI URLs behind a trusted proxy | high | 7.5 | – |
| GHSA-97h7-mf38-g9mf | vrana/adminer | Adminer file disclosure vulnerability | high | 7.5 | – |
| GHSA-cwgq-83w5-8jfq | silverstripe/framework | silverstripe/framework has possible denial of service attack vector when flushing | high | 7.5 | – |
| GHSA-55qg-6c4m-mw6g | silverstripe/framework | silverstripe/framework's URL parameters `isDev` and `isTest` unguarded | medium | 6.5 | – |
| GHSA-jqr8-q455-xx45 | typo3/cms | TYPO3 Brute Force Protection Bypass in backend login | medium | 6.5 | – |
| GHSA-m2hh-2m46-x6j5 | silverstripe/framework | silverstripe/framework may disclose database credentials during connection failure | medium | 6.5 | – |
| GHSA-r287-hc8j-w56h | typo3/cms | TYPO3 Information Disclosure Vulnerability Exploitable by Editors | medium | 6.5 | – |
| GHSA-r3pr-fh25-wrfc | silverstripe/framework | silverstripe/framework's install.php script discloses sensitive data by pre-populating DB credential forms | medium | 6.5 | – |
| GHSA-wwgf-3xp7-cxj4 | gos/web-socket-bundle | Potentially sensitive data exposure in Symfony Web Socket Bundle | medium | 5.9 | – |
| CVE-2014-6061 | symfony/http-foundation, symfony/symfony | Symfony has a security issue when parsing the Authorization header | medium | 5.3 | – |
| CVE-2015-2309 | symfony/http-foundation, symfony/symfony | Symfony has unsafe methods in the Request class | medium | 5.3 | – |
| GHSA-256q-hx8w-xcqx | silverstripe/framework | Silverstripe Framework user enumeration via timing attack on login and password reset forms | medium | 5.3 | – |
| GHSA-2fhr-8r8r-qp56 | zendframework/zendframework | ZendFramework Information Disclosure and Insufficient Entropy vulnerability | medium | 5.3 | – |
| GHSA-6487-3qvg-8px9 | typo3/cms | TYPO3 Information Disclosure in Install Tool | medium | 5.3 | – |
| GHSA-66c2-7g4p-wx4p | typo3/cms-core | TYPO3 Information Disclosure in Install Tool | medium | 5.3 | – |
| GHSA-7mc6-x925-7qvx | microsoft/microsoft-graph-beta | Test code in published microsoft-graph-beta package exposes phpinfo() | medium | 5.3 | – |
| GHSA-crr3-h4m8-7f56 | silverstripe/framework | silverstripe/framework vulnerable to member disclosure in login form | medium | 5.3 | – |
| GHSA-f624-8hfq-5fh3 | typo3/cms | TYPO3 Information Disclosure of Installed Extensions | medium | 5.3 | – |
| GHSA-g84q-cq55-xwgp | silverstripe/framework | silverstripe/framework member disclosure in login form | medium | 5.3 | – |
| GHSA-p2h4-7fp3-cmh8 | typo3/cms-core | TYPO3 Disclosure of Information about Installed Extensions | medium | 5.3 | – |
| GHSA-pqfv-97hj-g97g | typo3/cms | TYPO3 Frontend vulnerable to Unauthenticated Path Disclosure | medium | 5.3 | – |