Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24198 | wpdatatables (WordPress plugin) | The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control. A low privilege authenticated us | high | 8.1 | 1% |
| CVE-2016-2159 | moodle/moodle | Moodle External function mod_assign_save_submission does not check due dates | medium | 4.3 | 1% |
| CVE-2022-35689 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Improper Access Control | medium | 5.3 | 1% |
| CVE-2011-4279 | moodle/moodle | Moodle does not use the forceloginforprofiles setting for course-profiles access control | medium | 0.0 | 1% |
| CVE-2020-13675 | drupal/core, drupal/graphql | Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all | critical | 9.8 | 1% |
| CVE-2026-31843 | goodoneuz/pay-uz | goodoneuz/pay-uz: the /payment/api/editable/update endpoint overwrites existing PHP payment hook files | critical | 9.8 | 1% |
| CVE-2019-12470 | mediawiki/core | Wikimedia MediaWik exposed suppressed log in RevisionDelete page | medium | 6.5 | 1% |
| CVE-2019-12469 | mediawiki/core | MediaWiki Incorrect Access Control vulnerability | medium | 6.5 | 1% |
| CVE-2016-3165 | drupal/core, drupal/drupal | Drupal Form API ignores access restrictions on submit buttons | high | 7.5 | 1% |
| CVE-2015-9337 | profile-builder (WordPress plugin) | The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX. | high | 7.5 | 1% |
| CVE-2019-12472 | mediawiki/core | MediaWiki Incorrect Access Control vulnerability | high | 7.5 | 1% |
| CVE-2020-25629 | moodle/moodle | Moodle incorrect access control | high | 8.8 | 1% |
| CVE-2017-6930 | drupal/core, drupal/drupal | Drupal access bypass vulnerability | high | 8.1 | 1% |
| CVE-2016-3729 | moodle/moodle | Moodle Improper Access Control | medium | 6.5 | 1% |
| CVE-2019-12467 | mediawiki/core | MediaWiki Incorrect Access Control vulnerability | medium | 5.3 | 1% |
| CVE-2021-24197 | wpdatatables (WordPress plugin) | The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control. A low privilege authenticated us | high | 8.1 | 1% |
| CVE-2020-13677 | drupal/core | Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which ma | high | 7.5 | 1% |
| CVE-2022-0203 | bytefury/crater | Missing Authorization in Crater Invoice | medium | 5.3 | 1% |
| CVE-2021-4361 | jobsearch-wp-job-board (WordPress plugin) | The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_job | high | 8.8 | 1% |
| CVE-2016-8642 | moodle/moodle | Moodle Unauthenticated Access | medium | 5.3 | 1% |
| CVE-2022-0580 | librenms/librenms | Improper Access Control in librenms | high | 7.1 | 1% |
| CVE-2020-36700 | kingcomposer (WordPress plugin) | The Page Builder: KingComposer plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.9.3. This is d | high | 8.8 | 1% |
| CVE-2026-42569 | nabeel/phpvms | phpVMS has an /importer authorization bypass causing full database wipe | critical | 9.4 | 1% |
| CVE-2010-1616 | moodle/moodle | Moodle is vulnerable to unauthorized new accounts creation | medium | 0.0 | 1% |
| CVE-2012-6432 | symfony/symfony | Symfony Access Control Vulnerability | medium | 0.0 | 1% |
| CVE-2016-3733 | moodle/moodle | Moodle Improper Access Control | medium | 4.3 | 1% |
| CVE-2024-11868 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includ | medium | 5.3 | 1% |
| CVE-2021-4360 | controlled-admin-access (WordPress plugin) | The Controlled Admin Access plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.5 by not proper | critical | 9.9 | 1% |
| CVE-2017-8383 | craftcms/cms | Craft CMS Unauthorized View | medium | 5.3 | 1% |
| CVE-2009-1264 | sjbr/sr-feuser-register | Frontend User Registration extension for TYPO3 does not properly verify access rights | high | 0.0 | 1% |
| CVE-2024-34107 | magento/community-edition | Magento Open Source Improper Access Control vulnerability | medium | 5.3 | 1% |
| CVE-2021-24238 | findeo (WordPress plugin), realteo (WordPress plugin) | The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not ensure that the requested property to be deleted belong to the | medium | 6.5 | 1% |
| CVE-2021-24359 | the-plus-addons-for-elementor (WordPress plugin) | The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.11 did not properly check that a user requesting a password reset was | medium | 5.3 | 1% |
| CVE-2021-3992 | kevinpapst/kimai2 | kimai2 is vulnerable to Improper Access Control | medium | 6.5 | 1% |
| CVE-2021-39333 | hashthemes-demo-importer (WordPress plugin) | The Hashthemes Demo Importer Plugin <= 1.1.1 for WordPress contained several AJAX functions which relied on a nonce which was visible to all | high | 8.1 | 1% |
| CVE-2008-3226 | joomla/joomla-platform | Joomla! allows attackers to access cached pages | medium | 0.0 | 1% |
| CVE-2023-0994 | francoisjacquet/rosariosis | RosarioSIS Improper Access Control vulnerability | high | 7.5 | 1% |
| CVE-2021-24845 | improved-include-page (WordPress plugin) | The Improved Include Page WordPress plugin through 1.2 allows passing shortcode attributes with post_type & post_status which can be used to | medium | 6.5 | 1% |
| CVE-2019-1000011 | api-platform/core | Incorrect Access Control vulnerability in api-platform/core | medium | 6.5 | 1% |
| CVE-2013-7081 | typo3/cms-core | TYPO3 Improper Access Control vulnerability | medium | 0.0 | 1% |
| CVE-2021-24318 | listeo (WordPress plugin) | The Listeo WordPress theme before 1.6.11 did not ensure that the Post/Page and Booking to delete belong to the user making the request, allo | medium | 6.5 | 1% |
| CVE-2013-4320 | typo3/cms-core | TYPO3 Improper Access Management in the File Abstraction Layer | medium | 0.0 | 1% |
| CVE-2020-36721 | activello (WordPress plugin), affluent (WordPress plugin), allegiant (WordPress plugin) +12 more | The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. | medium | 6.5 | 1% |
| CVE-2023-23923 | moodle/moodle | Moodle Improper Access Control vulnerability | high | 8.2 | 1% |
| CVE-2023-22250 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Improper Access Control | medium | 5.3 | 1% |
| CVE-2022-4703 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_reset_previous_import' AJAX action | medium | 4.3 | 1% |
| CVE-2021-25956 | dolibarr/dolibarr | Dolibarr vulnerable to Improper Authentication and Improper Access Control | high | 7.2 | 1% |
| CVE-2021-4026 | ssddanbrown/bookstack | bookstack is vulnerable to Improper Access Control | medium | 4.3 | 1% |
| CVE-2025-24411 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control vulnerability | high | 8.1 | 1% |
| CVE-2018-20028 | contao/contao | Contao Information Disclosure via Access Control Flaws | medium | 6.5 | 1% |