Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-2441 | vikbooking-hotel-booking-engine-\&-pms (WordPress plugin) | The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 allows direct access to menus, allowing an authenticated user with s | high | 8.1 | 1% |
| CVE-2019-25149 | gallery-images-ape (WordPress plugin) | The Gallery Images Ape plugin for WordPress is vulnerable to Arbitrary Plugin Deactivation in versions up to, and including, 2.0.6. This all | high | 7.6 | 1% |
| CVE-2024-13694 | smart-wishlist-for-more-convert (WordPress plugin) | The WooCommerce Wishlist (High customization, fast setup,Free Elementor Wishlist, most features) plugin for WordPress is vulnerable to Insec | high | 7.5 | 1% |
| CVE-2024-45128 | magento/community-edition | Magento Open Source Improper Authorization vulnerability | medium | 5.4 | 1% |
| CVE-2025-27188 | magento/community-edition | Magento Improper Authorization vulnerability | medium | 4.3 | 1% |
| CVE-2025-54378 | elmsln/haxcms | HAX CMS API Lacks Authorization Checks | high | 8.3 | 1% |
| CVE-2022-40208 | moodle/moodle | Moodle may allow students to bypass sequential navigation during a quiz attempt | medium | 4.3 | 1% |
| CVE-2026-54178 | backpack/crud | Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk | high | 8.1 | 1% |
| CVE-2023-0914 | pixelfed/pixelfed | Pixelfed may allow unauthorized actor to view private posts | medium | 5.3 | 1% |
| CVE-2023-0583 | vk-blocks (WordPress plugin) | The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_vk_blocks_options' function in versions up t | medium | 4.3 | 1% |
| CVE-2023-3574 | pimcore/customer-management-framework-bundle | Pimcore Customer Management Framework vulnerable to Improper Authorization in Rules Controller | medium | 6.5 | 1% |
| CVE-2025-43585 | magento/community-edition, magento/project-community-edition | Magento Improper Authorization leading to security feature bypass | high | 8.2 | 1% |
| CVE-2023-1463 | nilsteampassnet/teampass | Improper Authorization in nilsteampassnet/teampass | medium | 5.4 | 1% |
| CVE-2020-36714 | brizy (WordPress plugin) | The Brizy plugin for WordPress is vulnerable to authorization bypass due to a incorrect capability check on the is_administrator() function | high | 7.4 | 1% |
| CVE-2023-1910 | getwid (WordPress plugin) | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability chec | medium | 4.3 | 1% |
| CVE-2023-0584 | vk-blocks (WordPress plugin) | The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_options' function in versions up to, and inc | medium | 4.3 | 1% |
| CVE-2023-3957 | navz-photo-gallery (WordPress plugin) | The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient restriction on th | medium | 4.3 | 1% |
| CVE-2024-9235 | mapster-wp-maps (WordPress plugin) | The Mapster WP Maps plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to an | high | 8.8 | 0% |
| CVE-2023-0734 | wallabag/wallabag | Wallabag Improper Authorization vulnerability | medium | 5.3 | 0% |
| CVE-2023-6878 | slick-social-share-buttons (WordPress plugin) | The Slick Social Share Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on | high | 8.8 | 0% |
| CVE-2026-39389 | ci4-cms-erp/ci4ms | CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files | medium | 6.7 | 0% |
| CVE-2021-4344 | frontend-file-manager-plugin (WordPress plugin) | The Frontend File Manager plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 18.2. This is due to | medium | 6.4 | 0% |
| CVE-2026-52822 | kimai/kimai | Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation | medium | 0.0 | 0% |
| CVE-2026-42609 | getgrav/grav | Grav Vulnerable to Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic | high | 8.1 | 0% |
| CVE-2026-72786 | craftcms/cms | Craft CMS: Arbitrary user password reset leading to administrator account takeover | high | 0.0 | 0% |
| CVE-2023-6496 | manage-notification-emails (WordPress plugin) | The Manage Notification E-mails plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.8.5 via | medium | 5.3 | 0% |
| CVE-2024-39404 | magento/community-edition, magento/project-community-edition | Magento Improper Authorization vulnerability | medium | 4.3 | 0% |
| CVE-2024-45131 | magento/community-edition | Magento Open Source Improper Authorization vulnerability | medium | 5.4 | 0% |
| CVE-2026-52825 | kimai/kimai | Kimai has Improper Authorization in Team Member and Team Activity Assignment APIs Which Allows Expansion of Team Scope Beyond Authorized Vis | medium | 0.0 | 0% |
| CVE-2024-39411 | magento/community-edition, magento/project-community-edition | Magento Improper Authorization leads to security feature bypass | medium | 4.3 | 0% |
| CVE-2024-39413 | magento/community-edition, magento/project-community-edition | Magento Improper Authorization vulnerability | medium | 4.3 | 0% |
| CVE-2024-39415 | magento/community-edition, magento/project-community-edition | Magento Improper Authorization Leading to Security feature bypass | medium | 4.3 | 0% |
| CVE-2024-39417 | magento/community-edition, magento/project-community-edition | Magento Improper Authorization leads to Security feature bypass | medium | 4.3 | 0% |
| CVE-2026-56828 | shopper/framework | Shopper: privilege escalation via improper Livewire admin component authorization | high | 8.8 | 0% |
| CVE-2026-35445 | winter/wn-backend-module | Winter: Authenticated backend users can bypass Users controller permission checks | high | 0.0 | 0% |
| CVE-2024-39405 | magento/community-edition, magento/project-community-edition | Magento Improper Authorization vulnerability | medium | 4.3 | 0% |
| CVE-2024-39407 | magento/community-edition, magento/project-community-edition | Magento Improper Authorization vulnerability | medium | 4.3 | 0% |
| CVE-2024-39412 | magento/community-edition | Magento Open Source Improper Authorization vulnerability | medium | 4.3 | 0% |
| CVE-2024-39419 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control Leads to Privilege escalation | medium | 4.3 | 0% |
| CVE-2026-52826 | kimai/kimai | Kimai: Improper Authorization in Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation | medium | 0.0 | 0% |
| CVE-2026-28685 | kimai/kimai | Kimai's API invoice endpoint missing customer-level access control (IDOR) | medium | 6.5 | 0% |
| CVE-2024-39416 | magento/community-edition, magento/project-community-edition | Magento Improper Authorization leads to Security feature bypass | medium | 4.3 | 0% |
| CVE-2024-45691 | moodle/moodle | Moodle Lesson activity password bypass through PHP loose comparison | medium | 5.4 | 0% |
| CVE-2024-39418 | magento/community-edition, magento/project-community-edition | Magento Improper Authorization vulnerability | medium | 5.4 | 0% |
| CVE-2024-13821 | booking (WordPress plugin) | The WP Booking Calendar plugin for WordPress is vulnerable to Unauthenticated Post-Confirmation Booking Manipulation in all versions up to, | medium | 5.3 | 0% |
| CVE-2024-7624 | zephyr-project-manager (WordPress plugin) | The Zephyr Project Manager plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 3.3.101. | high | 8.1 | 0% |
| CVE-2024-5053 | fluentform (WordPress plugin) | The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized | medium | 4.2 | 0% |
| CVE-2021-4335 | fancy-product-designer (WordPress plugin) | The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized access to data and modification of plugin settings due to a mi | medium | 6.3 | 0% |
| CVE-2024-45689 | moodle/moodle | Moodle allows users to retrieve information they did not have permission to access | medium | 6.5 | 0% |
| CVE-2026-30878 | baserproject/basercms | baserCMS has Mail Form Acceptance Bypass via Public API | medium | 5.3 | 0% |