Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-41243 | baserproject/basercms | OS Command Injection Vulnerability and Potential Zip Slip Vulnerability in baserCMS | critical | 9.1 | 2% |
| CVE-2026-30880 | baserproject/basercms | baserCMS has OS command injection vulnerability in installer | critical | 0.0 | 2% |
| CVE-2021-24312 | wp-super-cache (WordPress plugin) | The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the set | high | 7.2 | 2% |
| CVE-2025-69212 | devcode-it/openstamanager | OpenSTAManager has an OS Command Injection in P7M File Processing | critical | 0.0 | 2% |
| CVE-2013-5958 | symfony/polyfill, symfony/polyfill-php55, symfony/security +1 more | Symfony Denial of Service Via Long Password Hashing | medium | 0.0 | 2% |
| CVE-2024-2662 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to command injection in all versio | high | 7.2 | 2% |
| CVE-2026-40261 | composer/composer | Composer has a command injection via malicious perforce reference | high | 8.8 | 2% |
| CVE-2020-10235 | froxlor/froxlor | Froxlor arbitrary code execution via the database configuration options | high | 8.8 | 2% |
| CVE-2026-53932 | wnx/laravel-backup-restore | laravel-backup-restore has an OS Command Injection during database restore | high | 8.0 | 2% |
| CVE-2024-39401 | magento/community-edition, magento/project-community-edition | Magento OS Command ('OS Command Injection') vulnerability | high | 8.4 | 2% |
| CVE-2024-39402 | magento/community-edition, magento/project-community-edition | Magento OS Command ('OS Command Injection') vulnerability | high | 8.4 | 2% |
| CVE-2026-41247 | studio-42/elfinder | elFinder: Command injection in resize background color parameter when using ImageMagick CLI | critical | 9.8 | 2% |
| CVE-2026-30877 | baserproject/basercms | baserCMS Update Functionality Vulnerable to OS Command Injection | critical | 9.1 | 2% |
| CVE-2025-54418 | codeigniter4/framework | CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability | critical | 9.8 | 2% |
| CVE-2018-0569 | baserproject/basercms | OS Command Injection in baserCMS | high | 8.8 | 1% |
| CVE-2023-51450 | baserproject/basercms | baserCMS OS command injection vulnerability in Installer | medium | 5.6 | 1% |
| CVE-2026-24788 | billz/raspap-webgui | RaspAP raspap-webgui contains an OS Command Injection vulnerability | high | 8.8 | 1% |
| CVE-2020-28925 | bolt/bolt | OS Command injection in Bolt | medium | 5.3 | 1% |
| CVE-2026-67434 | squizlabs/php_codesniffer | PHP_CodeSniffer gitblame report command injection via crafted filename | high | 0.0 | 1% |
| CVE-2026-40176 | composer/composer | Composer has a command injection via malicious perforce repository | high | 7.8 | 1% |
| CVE-2024-9461 | boldgrid-backup (WordPress plugin) | The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in | high | 7.2 | 1% |
| CVE-2026-26279 | froxlor/froxlor | Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection | critical | 9.1 | 1% |
| CVE-2026-23500 | dolibarr/dolibarr | Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration | critical | 9.1 | 1% |
| CVE-2025-2257 | boldgrid-backup (WordPress plugin) | The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in | high | 7.2 | 1% |
| CVE-2026-84190 | librenms/librenms | LibreNMS Vulnerable to Remote Code Execution via AboutController | medium | 0.0 | 1% |
| CVE-2026-40187 | egroupware/egroupware | EGroupware has Authenticated RCE via Malicious eTemplate Upload | high | 0.0 | 1% |
| CVE-2026-54182 | backpack/crud | Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth) | high | 8.1 | 1% |
| CVE-2023-34620 | laktak/hjson | hjson stack exhaustion vulnerability | high | 7.5 | 1% |
| CVE-2025-31692 | drupal/ai | The AI Automators module (a submodule of AI) enables you to create different automated tasks that fills out field data u | medium | 0.0 | 1% |
| CVE-2025-48204 | nitsan/ns-backup | The Backup Plus extension for TYPO3 (ns_backup) allows command injections | medium | 0.0 | 1% |
| CVE-2025-31693 | drupal/ai | The AI Automators module (a submodule of AI) enables you to create different automated tasks that fills out a field data | medium | 6.6 | 1% |
| CVE-2026-54540 | pheditor/pheditor | Pheditor has an authenticated terminal command whitelist bypass | high | 8.8 | 1% |
| CVE-2026-28507 | idno/known | Idno Vulnerable to Remote Code Execution via Chained Import File Write and Template Path Traversal | high | 0.0 | 1% |
| CVE-2019-19325 | silverstripe/framework | Reflected XSS in SilverStripe | medium | 6.1 | 1% |
| CVE-2025-52994 | james-heinrich/phpthumb | phpThumb is vulnerable to Command Injection through its gif_outputAsJpeg function | medium | 4.9 | 1% |
| CVE-2026-55578 | pheditor/pheditor | Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection | high | 8.8 | 1% |
| CVE-2026-33648 | wwbn/avideo | AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path | high | 8.8 | 1% |
| CVE-2026-33183 | saloonphp/saloon | Saloon has a Fixture Name Path Traversal Vulnerability | medium | 0.0 | 1% |
| CVE-2026-31019 | dolibarr/dolibarr | Dolibarr user with permission to edit PHP content can bypass filtering to restrict dangerous PHP functions | high | 8.8 | 1% |
| CVE-2026-84361 | composer/composer | Composer arbitrary command execution via a malicious package's Perforce source URL | high | 0.0 | 1% |
| CVE-2026-108359 | phpoffice/phpspreadsheet | PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS) | high | 0.0 | 0% |
| CVE-2024-9820 | two-factor-login-telegram (WordPress plugin) | The WP 2FA with Telegram plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 3.0. This | medium | 6.5 | 0% |
| CVE-2024-10896 | logo-slider (WordPress plugin) | The Logo Slider WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo and Slider settings, which could allow high pri | medium | 5.4 | 0% |
| CVE-2026-41064 | wwbn/avideo | WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection | critical | 9.3 | 0% |
| CVE-2026-33319 | wwbn/avideo | AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command | medium | 5.9 | 0% |
| CVE-2026-45578 | wwbn/avideo | AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL | high | 8.8 | 0% |
| CVE-2026-105829 | league/commonmark | league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal | medium | 6.1 | 0% |
| CVE-2026-49260 | pontedilana/php-weasyprint | php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/sna | high | 8.2 | 0% |
| CVE-2026-46643 | knplabs/knp-snappy | Snappy: Binary path is never shell-escaped due to an inverted is_executable check | high | 0.0 | 0% |
| CVE-2026-59948 | composer/composer | Composer: Arbitrary file write outside vendor via malicious transitive package name | high | 7.0 | 0% |