Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-33541 | miraheze/ts-portal | TSPortal's Uncontrolled User Creation via Validation Side Effects Leads to Potential Denial of Service | medium | 6.5 | 0% |
| CVE-2026-45802 | setasign/fpdi | FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service | medium | 0.0 | 0% |
| CVE-2025-69198 | pterodactyl/panel | Pterodactyl improperly locks resources allowing raced queries to create more resources than alloted | medium | 6.5 | 0% |
| CVE-2026-44167 | phpseclib/phpseclib | phpseclib has a CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID() | high | 7.5 | 0% |
| GHSA-xg43-5579-qw6v | adawolfa/isdoc | adawolfa/isdoc: Uncontrolled resource consumption (decompression bomb) when reading untrusted ISDOCX or PDF files | medium | 6.5 | – |
| GHSA-8grv-jq2g-cfhw | amphp/http-server | amphp/http-server affected by HTTP/2 DDoS vulnerability | medium | 5.3 | – |
| GHSA-g43w-98wp-m694 | silverstripe/framework | SilverStripe framework XML Quadratic Blowup Attack | medium | 5.3 | – |
| GHSA-w98g-5fmx-wm4x | pocketmine/raklib | pocketmine/raklib reliable-ordered queue size is unlimited, allowing a session to hog server memory | medium | 5.3 | – |
| GHSA-3prj-6hqw-cm82 | web-token/jwt-framework, web-token/jwt-library | PHP JWT Library: PBES2-HS*+A*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of service | high | 0.0 | – |
| GHSA-p68v-frgx-4rjp | shopware/core, shopware/platform | Denial of Service via Cache Flooding | low | 0.0 | – |
| GHSA-pmxp-7224-h794 | typo3/cms | Denial of Service (DoS) attack possibility in TYPO3 component Indexed Search | medium | 0.0 | – |