Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-21652 | shopware/shopware | Insufficient Session Expiration in shopware | low | 3.5 | 1% |
| CVE-2023-38489 | getkirby/cms | Insufficient Session Expiration after a password change | high | 7.3 | 1% |
| CVE-2022-24895 | symfony/security-bundle, symfony/symfony | Symfony vulnerable to Session Fixation of CSRF tokens | medium | 6.3 | 1% |
| CVE-2023-22732 | shopware/core, shopware/platform | Shopware has Insufficient Session Expiration in Administration | low | 3.7 | 1% |
| CVE-2024-47873 | phpoffice/phpexcel, phpoffice/phpspreadsheet | XmlScanner bypass leads to XXE | high | 7.5 | 1% |
| CVE-2024-48917 | phpoffice/phpexcel, phpoffice/phpspreadsheet | XXE in PHPSpreadsheet's XLSX reader | high | 7.5 | 1% |
| CVE-2022-43689 | concrete5/concrete5 | Concrete CMS vulnerable to XML External Entity | medium | 5.3 | 1% |
| CVE-2022-4070 | librenms/librenms | Insufficient Session Expiration in librenms/librenms | critical | 9.8 | 1% |
| CVE-2020-26229 | typo3/cms, typo3/cms-core | XML External Entity in Dashboard Widget | low | 3.7 | 1% |
| CVE-2024-45048 | phpoffice/phpexcel, phpoffice/phpspreadsheet | XXE in PHPSpreadsheet encoding is returned | high | 8.8 | 1% |
| CVE-2023-4190 | admidio/admidio | Admidio Insufficient Session Expiration vulnerability | medium | 6.5 | 1% |
| CVE-2023-28472 | concrete5/concrete5 | Concrete CMS missing secure cookie parameters | medium | 5.3 | 1% |
| CVE-2023-5865 | thorsten/phpmyfaq | Insufficient Session Expiration in thorsten/phpmyfaq | high | 7.6 | 1% |
| CVE-2026-45071 | symfony/dom-crawler, symfony/symfony | Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true | low | 0.0 | 1% |
| CVE-2026-62992 | smarty/smarty | Smarty: Symlink path traversal out of trusted directories | medium | 0.0 | 1% |
| CVE-2026-34570 | ci4-cms-erp/ci4ms | CI4MS: Account Deletion Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw) | high | 8.8 | 1% |
| CVE-2026-34572 | ci4-cms-erp/ci4ms | CI4MS: Account Deactivation Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw) | high | 8.8 | 1% |
| CVE-2024-30262 | contao/core-bundle | Contao: Remember-me tokens will not be cleared after a password change | medium | 5.9 | 0% |
| CVE-2024-31447 | shopware/core, shopware/platform | Shopware Improper Session Handling in store-api account logout | medium | 5.3 | 0% |
| CVE-2025-48882 | phpoffice/math | PHPOffice Math allows XXE when processing an XML file in the MathML format | high | 0.0 | 0% |
| CVE-2022-24744 | shopware/core, shopware/platform | Shopware user session is not logged out if the password is reset via password recovery | low | 2.6 | 0% |
| CVE-2026-108358 | phpoffice/phpspreadsheet | PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service | high | 0.0 | 0% |
| CVE-2022-47406 | derhansen/fe_change_pwd, typo3/cms | TYPO3 vulnerable to Insufficient Session Expiration | critical | 9.8 | 0% |
| CVE-2025-47778 | sulu/sulu | Sulu vulnerable to XXE in SVG File upload Inspector | medium | 0.0 | 0% |
| CVE-2022-4409 | thorsten/phpmyfaq | phpMyFAQ has insecure HTTP cookies | high | 7.5 | 0% |
| CVE-2023-1788 | grumpydictator/firefly-iii | Firefly III insufficiently expires sessions | medium | 4.2 | 0% |
| CVE-2024-52806 | simplesamlphp/saml2, simplesamlphp/saml2-legacy | SimpleSAMLphp SAML2 has an XXE in parsing SAML messages | high | 8.3 | 0% |
| CVE-2022-23502 | typo3/cms, typo3/cms-core | TYPO3 CMS vulnerable to Insufficient Session Expiration after Password Reset | medium | 5.4 | 0% |
| CVE-2026-108357 | phpoffice/phpspreadsheet | PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service | high | 0.0 | 0% |
| CVE-2020-23136 | microweber/microweber | Microweber Insufficient Session Expiry | medium | 5.5 | 0% |
| CVE-2026-56701 | getgrav/grav | Grav is Vulnerable to XXE via SVG Upload | medium | 6.5 | 0% |
| CVE-2026-46722 | tpwd/ke_search | TYPO3 ke_search XML External Entity Injection | medium | 0.0 | 0% |
| CVE-2025-57756 | contao/contao, contao/core-bundle | Contao discloses sensitive information in the front end search index | medium | 5.3 | 0% |
| CVE-2023-5866 | thorsten/phpmyfaq | Sensitive cookie in HTTPS session without 'Secure' attribute in thorsten/phpmyfaq | medium | 6.3 | 0% |
| CVE-2026-41891 | ci4-cms-erp/ci4ms | CI4MS has a Deactivated User Session Bypass (active=0) | medium | 0.0 | 0% |
| CVE-2026-34362 | wwbn/avideo | AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket() | medium | 5.4 | 0% |
| CVE-2025-68954 | pterodactyl/panel | Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced | high | 0.0 | 0% |
| CVE-2024-31556 | reportico-web/reportico | Reportico Web fails to invalidate cookies upon logout | medium | 6.5 | 0% |
| CVE-2024-52305 | unopim/unopim | UnoPim Stored XSS : Cookie hijacking through Create User function | high | 7.3 | 0% |
| GHSA-8x2v-pcg7-94f4 | zendframework/zend-json | Zend-JSON vulnerable to XXE/XEE attacks | critical | 9.8 | – |
| GHSA-f4fj-q6m4-cc52 | zendframework/zend-xmlrpc | ZendFramework vulnerable to XXE/XEE attacks | critical | 9.8 | – |
| GHSA-j68w-pg49-f6vx | symfony/serializer | Symfony XML decoding attack vector through external entities | critical | 9.8 | – |
| GHSA-mhpx-3rv8-wrjm | zendframework/zendframework1 | ZendFramework potential XML eXternal Entity injection vectors | critical | 9.8 | – |
| GHSA-qc7w-4567-84wv | zendframework/zendframework | Zendframework vulnerable to XXE/XEE attacks | critical | 9.8 | – |
| GHSA-229x-22xc-2f2w | zendframework/zendframework1 | Zendframework Local file disclosure via XXE injection in Zend_XmlRpc | high | 8.6 | – |
| GHSA-4j9x-g4x8-vcmf | zendframework/zendframework1 | ZendFramework potential XML eXternal Entity injection vectors | high | 7.5 | – |
| GHSA-c636-cg5r-2498 | symfony/dependency-injection | Symfony XML Entity Expansion security vulnerability | high | 7.5 | – |
| GHSA-rcm4-jv5g-wccm | zfr/zfr-oauth2-server-module | zfr authentication adapter did not verify validity of tokens | high | 7.5 | – |
| GHSA-rjpm-qmq7-q85w | symfony/routing | Symfony XXE security vulnerability | high | 7.5 | – |
| GHSA-534c-hcr7-67jg | kimai/kimai | Kimai has an XXE Leading to Local File Read | medium | 6.5 | – |