Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.3, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-12463 | librenms/librenms | Improper Encoding or Escaping of Output and Injection in LibreNMS | high | 8.8 | 1% |
| CVE-2021-32649 | october/system | October/System authenticated file write leads to remote code execution | high | 8.8 | 1% |
| CVE-2022-23064 | snipe/snipe-it | snipe-IT vulnerable to host header injection | high | 8.8 | 1% |
| CVE-2020-15244 | openmage/magento-lts | RCE via PHP Object injection via SOAP Requests | high | 8.0 | 1% |
| CVE-2023-5340 | five-star-restaurant-menu (WordPress plugin) | The Five Star Restaurant Menu and Food Ordering WordPress plugin before 2.4.11 unserializes user input via an AJAX action available to unaut | critical | 9.8 | 1% |
| CVE-2019-25150 | email-templates (WordPress plugin) | The Email Templates plugin for WordPress is vulnerable to HTML Injection in versions up to, and including, 1.3. This makes it possible for a | high | 8.8 | 1% |
| CVE-2020-10960 | mediawiki/core | MediaWiki makeCollapsible allows applying event handler to any CSS selector | medium | 5.3 | 1% |
| CVE-2021-43852 | oro/platform | Client-Side JavaScript Prototype Pollution in oro/platform | medium | 5.3 | 1% |
| CVE-2023-36260 | craftcms/cms | Craft CMS Feed-Me | high | 7.5 | 1% |
| CVE-2013-4144 | swfupload (WordPress plugin) | There is an object injection vulnerability in swfupload plugin for wordpress. | critical | 9.8 | 1% |
| CVE-2022-25337 | ezsystems/ezpublish-kernel | Code injection in ezsystems/ezpublish-kernel | critical | 9.8 | 1% |
| CVE-2016-5013 | moodle/moodle | Moodle Does Not Escape Characters In Email Headers | medium | 5.4 | 1% |
| CVE-2020-11056 | barrelstrength/sprout-base-email, barrelstrength/sprout-forms | Potential Code Injection in Sprout Forms | high | 7.4 | 1% |
| CVE-2015-3154 | zendframework/zend-http, zendframework/zendframework, zendframework/zendframework1 +1 more | Zenario CMS vulnerable to CRLF injection | medium | 6.1 | 1% |
| CVE-2024-1773 | pdf-invoices-and-packing-slips-for-woocommerce (WordPress plugin) | The PDF Invoices and Packing Slips For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and inc | high | 8.8 | 1% |
| CVE-2024-23830 | mantisbt/mantisbt | MantisBT Host Header Injection vulnerability | high | 8.3 | 1% |
| CVE-2023-37473 | zenstruck/collection | zenstruck/collection passing callable string to EntityRepository::find() and query() | high | 8.5 | 1% |
| CVE-2014-10386 | wp-live-chat-support (WordPress plugin) | The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections. | medium | 6.1 | 1% |
| CVE-2014-10391 | wp-support-plus-responsive-ticket-system (WordPress plugin) | The wp-support-plus-responsive-ticket-system plugin before 4.1 for WordPress has JavaScript injection. | medium | 6.1 | 1% |
| CVE-2014-10394 | rich-counter (WordPress plugin) | The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header. | medium | 6.1 | 1% |
| CVE-2017-18049 | silverstripe/framework | SilverStripe CSV Excel Macro Injection | medium | 5.5 | 1% |
| CVE-2024-23648 | pimcore/admin-ui-classic-bundle | Host header injection in the password reset | high | 8.8 | 1% |
| CVE-2020-25768 | contao/contao, contao/core-bundle | Contao Insert tag injection in forms | medium | 5.3 | 1% |
| CVE-2019-7889 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition Injection Vulnerability | medium | 6.5 | 1% |
| CVE-2026-54159 | prestashop/ps_facetedsearch | prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE | critical | 10.0 | 1% |
| CVE-2026-47767 | symfony/runtime, symfony/symfony | SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch | medium | 0.0 | 1% |
| CVE-2021-36913 | wpcf7-redirect (WordPress plugin) | Unauthenticated Options Change and Content Injection vulnerability in Qube One Redirection for Contact Form 7 plugin <= 2.4.0 at WordPress a | high | 7.5 | 1% |
| CVE-2017-20187 | floriangaerber/magnesium | Magnesium-PHP Injection vulnerability | low | 3.5 | 1% |
| CVE-2024-25625 | pimcore/admin-ui-classic-bundle | Pimcore Host Header Injection in user invitation link | high | 8.1 | 1% |
| CVE-2024-40137 | dolibarr/dolibarr | Dolibarr ERP CRM vulnerable to remote code execution (RCE) | medium | 5.5 | 1% |
| CVE-2021-4227 | ark-wysiwyg-comment-editor (WordPress plugin) | The ark-commenteditor WordPress plugin through 2.15.6 does not properly sanitise or encode the comments when in Source editor, allowing atta | medium | 5.3 | 1% |
| CVE-2022-38796 | feehi/cms | Feehi CMS host header injection vulnerability | medium | 6.1 | 1% |
| CVE-2023-46468 | juzaweb/cms | juzawebCMS Injection vulnerability | high | 7.8 | 1% |
| CVE-2024-29643 | croogo/croogo | croogo Host header injection | medium | 0.0 | 1% |
| CVE-2024-28234 | contao/comments-bundle | Contao: Insufficient BBCode sanitizer | medium | 4.3 | 1% |
| CVE-2026-30932 | froxlor/froxlor | Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API | high | 8.8 | 1% |
| CVE-2023-4157 | omeka/omeka-s | omeka/omeka-s Improper Input Validation vulnerability | medium | 5.2 | 1% |
| CVE-2024-1128 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to HTML Injection in all versions up to, and includi | medium | 5.4 | 1% |
| CVE-2025-27794 | flarum/core, flarum/framework | Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite | medium | 6.8 | 1% |
| CVE-2024-28191 | contao/core-bundle | Contao: Unencoded insert tags in the frontend | low | 3.1 | 0% |
| CVE-2022-4864 | froxlor/froxlor | Froxlor vulnerable to Argument Injection | medium | 5.4 | 0% |
| CVE-2024-53860 | spencer14420/sp-php-email-handler | SPEmailHandler-PHP has Potential Abuse for Sending Arbitrary Emails | high | 8.6 | 0% |
| CVE-2025-67746 | composer/composer | Composer is vulnerable to ANSI sequence injection | low | 0.0 | 0% |
| CVE-2026-54543 | froxlor/froxlor | Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields | medium | 5.4 | 0% |
| CVE-2026-2469 | directorytree/imapengine | ImapEngine affected by command injection via the ID command parameters | high | 7.6 | 0% |
| CVE-2023-6164 | mainwp (WordPress plugin) | The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to CSS Injection via the ‘new | low | 2.2 | 0% |
| CVE-2026-54329 | snipe/snipe-it | Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection | high | 8.5 | 0% |
| CVE-2024-55921 | typo3/cms-extensionmanager | TYPO3 Extension Manager Module vulnerable to Cross-Site Request Forgery | high | 7.5 | 0% |
| CVE-2026-55374 | jleehr/canto-saas-api | canto-saas-api: Authenticated API requests can be redirected via unencoded path variables | medium | 4.8 | 0% |
| CVE-2021-27908 | mautic/core | Mautic vulnerable to secret data exfiltration via symfony parameters | medium | 5.8 | 0% |