Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.3, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-32476 | moodle/moodle | Moodle denial-of-service risk in the draft files area | high | 7.5 | 1% |
| CVE-2021-41559 | silverstripe/framework | Quadratic blowup in Convert::xml2array() | medium | 6.5 | 1% |
| CVE-2023-28104 | silverstripe/graphql | DDOS attack on graphql endpoints | high | 7.5 | 1% |
| CVE-2024-35241 | composer/composer | Composer has a command injection via malicious git branch name | high | 8.8 | 1% |
| CVE-2020-5299 | october/backend | Potential CSV Injection vector in OctoberCMS | medium | 4.0 | 1% |
| CVE-2023-4797 | newsletters (WordPress plugin) | The Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended to SQL queries and | high | 7.2 | 1% |
| CVE-2024-25978 | moodle/moodle | Uncontrolled Resource Consumption in moodle | high | 7.5 | 1% |
| CVE-2026-59942 | dompdf/dompdf | Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps | medium | 0.0 | 1% |
| CVE-2019-8126 | magento/community-edition, magento/product-community-edition | Information disclosure through processing of external XML entities | medium | 4.9 | 1% |
| CVE-2026-84190 | librenms/librenms | LibreNMS Vulnerable to Remote Code Execution via AboutController | medium | 0.0 | 1% |
| CVE-2019-8123 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition Insufficient Logging | medium | 5.3 | 1% |
| CVE-2024-41637 | billz/raspap-webgui | RaspAP allows an attacker to escalate privileges | critical | 9.9 | 1% |
| CVE-2024-32871 | pimcore/pimcore | Flooding Server with Thumbnail files | high | 7.5 | 1% |
| CVE-2024-24752 | bref/bref | Bref's Uploaded Files Not Deleted in Event-Driven Functions | medium | 6.5 | 1% |
| CVE-2026-45304 | symfony/symfony, symfony/yaml | Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs") | low | 0.0 | 1% |
| CVE-2023-2666 | froxlor/froxlor | Froxlor vulnerable to Allocation of Resources Without Limits or Throttling | medium | 6.5 | 1% |
| CVE-2022-43695 | concrete5/concrete5 | Concrete CMS Cross-site Scripting vulnerability | medium | 4.8 | 1% |
| CVE-2026-86200 | pocketmine/pocketmine-mp | PocketMine-MP has LogDoS by many junk properties in client data JWT in LoginPacket | medium | 0.0 | 1% |
| CVE-2026-45133 | symfony/symfony, symfony/yaml | Symfony hardened the parser when handling untrusted input | low | 0.0 | 1% |
| CVE-2026-33483 | wwbn/avideo | AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php | high | 7.5 | 1% |
| CVE-2026-53965 | mcp/sdk | MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter | high | 0.0 | 1% |
| CVE-2023-46745 | librenms/librenms | LibreNMS vulnerable to rate limiting bypass on login page | medium | 5.3 | 1% |
| CVE-2025-68456 | craftcms/cms | Unauthenticated Craft CMS users can trigger a database backup | high | 0.0 | 1% |
| CVE-2026-49209 | symfony/ux-live-component | symfony/ux-live-component: Denial of service via unbounded batch action requests | low | 0.0 | 1% |
| CVE-2025-71418 | pocketmine/pocketmine-mp | PocketMine-MP allows malicious client data to waste server resources due to lack of limits for explode() | medium | 5.3 | 1% |
| CVE-2026-46629 | twig/intl-extra | twig/intl-extra: Unbounded formatter memoisation in keyed on template-controlled arguments | low | 0.0 | 1% |
| CVE-2026-107379 | enshrined/svg-sanitize | enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash | medium | 6.5 | 1% |
| CVE-2026-53653 | getgrav/grav | Grav: Unauthenticated denial of service via unbounded image derivative dimensions | high | 0.0 | 1% |
| CVE-2026-26047 | moodle/moodle | Moodle TeX formula editor is vulnerable to DoS through lack of execution time limits | medium | 6.5 | 1% |
| CVE-2026-61609 | pterodactyl/panel | Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS) | high | 7.5 | 0% |
| CVE-2026-108358 | phpoffice/phpspreadsheet | PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service | high | 0.0 | 0% |
| CVE-2025-71417 | pocketmine/pocketmine-mp | PocketMine-MP `ResourcePackDataInfoPacket` amplification vulnerability due to lack of resource pack sequence status checking | high | 0.0 | 0% |
| CVE-2026-86204 | pocketmine/pocketmine-mp | PocketMine-MP: JSON decoding of unlimited size large arrays/objects in ModalFormResponse Handling | high | 0.0 | 0% |
| CVE-2024-8983 | custom-twitter-feeds (WordPress plugin) | Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | 0% |
| CVE-2024-51736 | symfony/process, symfony/symfony | Symfony vulnerable to command execution hijack on Windows with Process class | high | 8.4 | 0% |
| CVE-2026-104827 | react/http | react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS | high | 7.5 | 0% |
| CVE-2026-67353 | guzzlehttp/guzzle | Guzzle: Unbounded response cookies risk denial of service | medium | 5.3 | 0% |
| CVE-2025-46556 | mantisbt/mantisbt | MantisBT Vulnerable to Denial-of-Service (DoS) via Excessive Note Length | medium | 6.5 | 0% |
| CVE-2026-49870 | snipe/snipe-it | Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor` | medium | 5.9 | 0% |
| CVE-2025-65657 | feehi/cms | FeehiCMS Has a Remote Code Execution via Unrestricted File Upload in Ad Management | medium | 6.5 | 0% |
| CVE-2026-40863 | phpoffice/phpspreadsheet | PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader | high | 7.5 | 0% |
| CVE-2026-40902 | phpoffice/phpspreadsheet | PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions | high | 7.5 | 0% |
| CVE-2026-108357 | phpoffice/phpspreadsheet | PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service | high | 0.0 | 0% |
| CVE-2025-54869 | setasign/fpdi | FPDI allows Memory Exhaustion (OOM) in PDF Parser which leads to Denial of Service | medium | 0.0 | 0% |
| CVE-2025-48448 | drupal/admin_audit_trail | The Admin Audit Trail module tracks logs of specific events that you'd like to review. When the submodule Admin Audit Tr | high | 7.5 | 0% |
| CVE-2026-33541 | miraheze/ts-portal | TSPortal's Uncontrolled User Creation via Validation Side Effects Leads to Potential Denial of Service | medium | 6.5 | 0% |
| CVE-2026-30662 | concrete5/concrete5 | ConcreteCMS is vulnerable to Denial of Service During Bulk Downloads | medium | 6.5 | 0% |
| CVE-2026-107843 | contao/core-bundle | Contao: The registration module re-sends activation mails | medium | 5.3 | 0% |
| CVE-2026-45802 | setasign/fpdi | FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service | medium | 0.0 | 0% |
| CVE-2026-35202 | pterodactyl/panel | Pterodactyl has a database resource limit bypass via race condition in Client API | low | 0.0 | 0% |