Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2014-3945 | typo3/cms | TYPO3 vulnerable to authentication bypass via leveraging knowledge of password hash | critical | 0.0 | 2% |
| CVE-2017-8827 | genix/cms | GeniXCMS Arbitrary User Password Reset Vulnerability | critical | 9.1 | 2% |
| CVE-2016-10983 | ghost (WordPress plugin) | The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data. | medium | 6.5 | 2% |
| CVE-2022-43504 | WordPress core | Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email addr | medium | 5.3 | 1% |
| CVE-2022-28666 | custom-product-tabs-for-woocommerce (WordPress plugin) | Broken Access Control vulnerability in YIKES Inc. Custom Product Tabs for WooCommerce plugin <= 1.7.7 at WordPress leading to &yikes-the-con | medium | 5.3 | 1% |
| CVE-2019-11018 | zoujingli/thinkadmin | ThinkAdmin Administrator cookies still working after password change | critical | 9.8 | 1% |
| CVE-2021-41745 | showdoc/showdoc | Showdoc File Upload Vulnerability | critical | 9.8 | 1% |
| CVE-2021-32693 | symfony/security-http, symfony/symfony | Authentication granted to all firewalls instead of just one | medium | 6.8 | 1% |
| CVE-2019-16250 | ocean-extra (WordPress plugin) | includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a C | high | 7.5 | 1% |
| CVE-2024-27923 | getgrav/grav | Remote Code Execution by uploading a phar file using frontmatter | high | 8.8 | 1% |
| CVE-2016-0796 | mb.miniaudioplayer (WordPress plugin) | WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and | high | 7.5 | 1% |
| CVE-2022-34149 | wp-oauth-server (WordPress plugin) | Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin <= 3.0.4 at WordPress. | critical | 9.8 | 1% |
| CVE-2020-36176 | better-wp-security (WordPress plugin) | The iThemes Security (formerly Better WP Security) plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an exis | high | 7.5 | 1% |
| CVE-2014-3944 | typo3/cms | TYPO3 Improper Session Invalidation | medium | 0.0 | 1% |
| CVE-2023-2499 | custom-registration-form-builder-with-submission-manager (WordPress plugin) | The RegistrationMagic plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.2.1.0. This is due to | critical | 9.8 | 1% |
| CVE-2012-5471 | moodle/moodle | Moodle Allows Unauthenticated Dropbox Access | medium | 0.0 | 1% |
| CVE-2019-10643 | contao/contao, contao/core-bundle | Contao Does Not Expire Tokens Correctly | critical | 9.8 | 1% |
| CVE-2019-19982 | email-subscribers-\&-newsletters (WordPress plugin) | The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to | medium | 5.3 | 1% |
| CVE-2022-29858 | silverstripe/assets | Unpublished, protected files can be published via shortcode | medium | 4.3 | 1% |
| CVE-2022-1801 | very-simple-contact-form (WordPress plugin) | The Very Simple Contact Form WordPress plugin before 11.6 exposes the solution to the captcha in the rendered contact form, both as hidden i | high | 7.5 | 1% |
| CVE-2019-10911 | symfony/security, symfony/security-http, symfony/symfony | Improper authentication in Symfony | high | 7.5 | 1% |
| CVE-2022-2133 | oauth-single-sign-on (WordPress plugin) | The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attac | medium | 5.3 | 1% |
| CVE-2019-8108 | magento/community-edition, magento/product-community-edition | Magento Broken authentication and session managememt | medium | 6.5 | 1% |
| CVE-2020-26136 | silverstripe/graphql | Authentication bypass in SilverStripe GraphQL | medium | 6.5 | 1% |
| CVE-2022-34839 | oauth2-server (WordPress plugin) | Authentication Bypass vulnerability in CodexShaper's WP OAuth2 Server plugin <= 1.0.1 at WordPress. | medium | 5.9 | 1% |
| CVE-2012-3387 | moodle/moodle | Moodle Authentication Bypass in File Upload | medium | 0.0 | 1% |
| CVE-2017-1000489 | mautic/core | Disabled users able to log in with third party SSO plugin | high | 8.1 | 1% |
| CVE-2021-24359 | the-plus-addons-for-elementor (WordPress plugin) | The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.11 did not properly check that a user requesting a password reset was | medium | 5.3 | 1% |
| CVE-2019-14880 | moodle/moodle | Moodle Oauth 2 Insufficiently Protects Against Compromise | critical | 9.1 | 1% |
| CVE-2021-41126 | october/october, october/system | Deleted Admin Can Sign In to Admin Interface | high | 7.2 | 1% |
| CVE-2012-0797 | moodle/moodle | Moodle Users Can Bypass Deleted Status | medium | 0.0 | 1% |
| CVE-2015-6926 | oxid-esales/oxideshop-ce | OXID eShop user impersonation vulnerability | high | 7.5 | 1% |
| CVE-2020-23355 | codiad/codiad | Codiad Vulnerable to PHP Magic Hash Vulnerability | high | 7.5 | 1% |
| CVE-2023-2297 | profile-builder (WordPress plugin) | The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions | critical | 9.8 | 1% |
| CVE-2023-2027 | zm-ajax-login-register (WordPress plugin) | The ZM Ajax Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.2. This is du | critical | 9.8 | 1% |
| CVE-2023-0311 | thorsten/phpmyfaq | phpMyFAQ Improper Authentication vulnerability | critical | 9.8 | 1% |
| CVE-2022-36106 | typo3/cms, typo3/cms-core | TYPO3 CMS missing check for expiration time of password reset token for backend users | medium | 5.4 | 1% |
| CVE-2021-25956 | dolibarr/dolibarr | Dolibarr vulnerable to Improper Authentication and Improper Access Control | high | 7.2 | 1% |
| CVE-2018-11579 | banner-management-for-woocommerce (WordPress plugin) | class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has an Unauthenticated Se | medium | 5.3 | 1% |
| CVE-2022-3173 | snipe/snipe-it | Snipe-IT vulnerable to Improper Authentication | medium | 4.3 | 1% |
| CVE-2022-46170 | codeigniter4/framework | CodeIgniter4 Potential Session Handlers Vulnerability | high | 8.6 | 1% |
| CVE-2024-34103 | magento/community-edition | Magento Open Source Improper Authentication vulnerability | high | 8.1 | 1% |
| CVE-2021-29487 | october/system | October CMS auth bypass and account takeover | high | 7.4 | 1% |
| CVE-2021-40693 | moodle/moodle | Moodle type juggling vulnerability | medium | 6.5 | 1% |
| CVE-2026-114509 | laravel/framework | Laravel TokenGuard authentication bypass through non-string API credentials | critical | 0.0 | 1% |
| CVE-2022-35726 | yotuwp-easy-youtube-embed (WordPress plugin) | Broken Authentication vulnerability in yotuwp Video Gallery plugin <= 1.3.4.5 at WordPress. | medium | 4.3 | 1% |
| CVE-2022-24748 | shopware/core | Incorrect Authentication in shopware | medium | 6.8 | 1% |
| CVE-2023-28473 | concrete5/concrete5 | Concrete CMS (previously concrete5) is vulnerable to possible auth bypass in the jobs section | critical | 9.8 | 1% |
| CVE-2022-23807 | phpmyadmin/phpmyadmin | Improper Authentication in phpmyadmin | medium | 4.3 | 1% |
| CVE-2022-36296 | activedemand (WordPress plugin) | Broken Authentication vulnerability in JumpDEMAND Inc. ActiveDEMAND plugin <= 0.2.27 at WordPress allows unauthenticated post update/create/ | medium | 6.5 | 1% |