Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-47941 | typo3/cms-backend | The TYPO3 CMS Backend has Broken Authentication in Backend MFA | high | 7.2 | 0% |
| CVE-2021-4373 | better-search (WordPress plugin) | The Better Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.2. This makes it po | high | 8.8 | 0% |
| CVE-2024-10311 | external-database-based-actions (WordPress plugin) | The External Database Based Actions plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.1. This | high | 7.5 | 0% |
| CVE-2024-13771 | civi (WordPress plugin) | The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up | critical | 9.8 | 0% |
| CVE-2024-13446 | workreap (WordPress plugin) | The Workreap plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.2.5. Th | critical | 9.8 | 0% |
| CVE-2024-10284 | ce21-suite (WordPress plugin) | The CE21 Suite plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.2.0. This is due to hardcoded | critical | 9.8 | 0% |
| CVE-2024-6635 | woocommerce-social-login (WordPress plugin) | The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.3. This is | high | 7.3 | 0% |
| CVE-2025-31694 | drupal/tfa | This module enables you to allow and/or require users to use a second authentication method in addition to password auth | high | 8.1 | 0% |
| CVE-2024-9658 | school-management-system (WordPress plugin) | The School Management System for Wordpress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions u | high | 8.8 | 0% |
| CVE-2025-12466 | drupal/simple_oauth | This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with a | high | 7.5 | 0% |
| CVE-2025-67507 | filament/filament | Filament multi-factor authentication (app) recovery codes can be used multiple times | high | 8.1 | 0% |
| CVE-2026-63493 | snipe/snipe-it | Snipe-IT: 2FA bypass via the API token flow | high | 0.0 | 0% |
| CVE-2024-13772 | civi (WordPress plugin) | The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up | medium | 5.6 | 0% |
| CVE-2026-34372 | sulu/sulu | Sulu checks fix permissions for subentities endpoints | medium | 0.0 | 0% |
| CVE-2025-12760 | drupal/email_tfa | The Email TFA module provides additional email-based two-factor authentication for Drupal logins. In certain scenarios, | medium | 5.4 | 0% |
| CVE-2025-24856 | causal/oidc | TYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc) | medium | 4.2 | 0% |