Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.3, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-0580 | librenms/librenms | Improper Access Control in librenms | high | 7.1 | 1% |
| CVE-2021-34647 | ninja-forms (WordPress plugin) | The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/i | medium | 6.5 | 1% |
| CVE-2021-32716 | shopware/platform, shopware/core | Exposure of Sensitive Information to an Unauthorized Actor | medium | 4.4 | 1% |
| CVE-2021-20283 | moodle/moodle | Missing permission check in Moodle | medium | 4.3 | 1% |
| CVE-2016-10996 | optinmonster (WordPress plugin) | The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak. | medium | 5.3 | 1% |
| CVE-2020-24941 | laravel/framework | Improper Input Validation in Laravel | high | 7.5 | 1% |
| CVE-2021-3992 | kevinpapst/kimai2 | kimai2 is vulnerable to Improper Access Control | medium | 6.5 | 1% |
| CVE-2021-24757 | stylish-price-list (WordPress plugin) | The Stylish Price List WordPress plugin before 6.9.0 does not perform capability checks in its spl_upload_ser_img AJAX action (available to | medium | 5.3 | 1% |
| CVE-2021-24872 | get-custom-field-values (WordPress plugin) | The Get Custom Field Values WordPress plugin before 4.0 allows users with a role as low as Contributor to access other posts metadata withou | medium | 6.5 | 1% |
| CVE-2023-22248 | magento/community-edition, magento/project-community-edition | Magento Open Source affected by Improper Input Validation | high | 7.5 | 1% |
| CVE-2022-0731 | dolibarr/dolibarr | Improper Authorization in dolibarr/dolibarr | medium | 6.5 | 1% |
| CVE-2021-37517 | dolibarr/dolibarr | Access Control vulnerability in Dolibarr | high | 7.5 | 1% |
| CVE-2021-24379 | comments-like-dislike (WordPress plugin) | The Comments Like Dislike WordPress plugin before 1.1.4 allows users to like/dislike posted comments, however does not prevent them from rep | medium | 5.3 | 1% |
| CVE-2023-38209 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Incorrect Authorization | medium | 6.5 | 1% |
| CVE-2019-19984 | email-subscribers-\&-newsletters (WordPress plugin) | The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with edit_post capabilities to manage plug | medium | 6.3 | 1% |
| CVE-2021-24851 | insert-pages (WordPress plugin) | The Insert Pages WordPress plugin before 3.7.0 allows users with a role as low as Contributor to access content and metadata from arbitrary | medium | 4.3 | 1% |
| CVE-2021-24244 | wpbakery-page-builder-clipboard (WordPress plugin) | An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.8 did not have capability che | medium | 6.5 | 1% |
| CVE-2020-25781 | mantisbt/mantisbt | MantisBT unauthorized users able to access private files | medium | 4.3 | 1% |
| CVE-2023-3459 | users-customers-import-export-for-wp-woocommerce (WordPress plugin) | The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit | high | 7.2 | 1% |
| CVE-2021-4026 | ssddanbrown/bookstack | bookstack is vulnerable to Improper Access Control | medium | 4.3 | 1% |
| CVE-2023-38488 | getkirby/cms | Field injection in the KirbyData text storage handler | high | 7.1 | 1% |
| CVE-2019-3848 | moodle/moodle | Moodle Logged in users could view all calendar events | medium | 4.3 | 1% |
| CVE-2020-29605 | mantisbt/mantisbt | MantisBT Incorrect Authorization in bug_actiongroup_page.php | medium | 0.0 | 1% |
| CVE-2021-24788 | batch-cat (WordPress plugin) | The Batch Cat WordPress plugin through 0.3 defines 3 custom AJAX actions, which both require authentication but are available for all roles. | medium | 6.5 | 1% |
| CVE-2023-38218 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Incorrect Authorization | high | 8.8 | 1% |
| CVE-2021-24742 | logo-slider-and-showcase (WordPress plugin) | The Logo Slider and Showcase WordPress plugin before 1.3.37 allows Editor users to update the plugin's settings via the rtWLSSettings AJAX a | medium | 6.5 | 1% |
| CVE-2021-24770 | stylish-price-list (WordPress plugin) | The Stylish Price List WordPress plugin before 6.9.1 does not perform capability checks in its spl_upload_ser_img AJAX action (available to | medium | 6.5 | 1% |
| CVE-2020-15513 | mittwald/typo3_forum | Incorrect access control in typo3_forum | medium | 5.3 | 1% |
| CVE-2021-4352 | jobsearch-wp-job-board (WordPress plugin) | The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the save_locsetti | medium | 5.3 | 1% |
| CVE-2024-34106 | magento/community-edition | Magento Open Source Incorrect Authorization vulnerability | medium | 5.3 | 1% |
| CVE-2022-35692 | magento/community-edition, magento/project-community-edition | Magento Open Source has Improper Access Control vulnerability | medium | 5.3 | 1% |
| CVE-2021-24279 | redirection-for-contact-form-7 (WordPress plugin) | In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, low level users, such as subscribers, could use the import_from_debug A | medium | 6.5 | 1% |
| CVE-2021-24783 | post-expirator (WordPress plugin) | The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow users with a role as low | medium | 6.5 | 1% |
| CVE-2021-28567 | magento/community-edition, magento/project-community-edition | Magento Improper Authorization vulnerability in the customers module | medium | 5.0 | 1% |
| CVE-2020-25025 | localizationteam/l10nmgr | Incorrect Authorization in TYPO3 extension | medium | 4.3 | 1% |
| CVE-2023-0940 | profilegrid (WordPress plugin) | The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authoriz | high | 8.8 | 1% |
| CVE-2021-28661 | silverstripe/graphql | SilverStripe GraphQL Server permission checker not inherited by query subclass. | medium | 4.3 | 1% |
| CVE-2021-24819 | page\/post-content-shortcode (WordPress plugin) | The Page/Post Content Shortcode WordPress plugin through 1.0 does not have proper authorisation in place, allowing users with a role as low | medium | 4.3 | 1% |
| CVE-2020-13676 | drupal/core | The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclo | medium | 6.5 | 1% |
| CVE-2023-0328 | wpcode (WordPress plugin) | The WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions, only checking the nonce. | medium | 4.3 | 1% |
| CVE-2022-0825 | amelia (WordPress plugin) | The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update oth | medium | 5.4 | 1% |
| CVE-2021-24824 | custom-content-shortcode (WordPress plugin) | The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as lo | medium | 4.3 | 1% |
| CVE-2021-24733 | wp-post-page-clone (WordPress plugin) | The WP Post Page Clone WordPress plugin before 1.2 allows users with a role as low as Contributor to clone and view other users' draft and p | medium | 4.3 | 1% |
| CVE-2020-36710 | wps-hide-login (WordPress plugin) | The WPS Hide Login plugin for WordPress is vulnerable to login page disclosure even when the settings of the plugin are set to hide the logi | medium | 5.3 | 1% |
| CVE-2021-24905 | advanced-cf7-db (WordPress plugin) | The Advanced Contact form 7 DB WordPress plugin before 1.8.7 does not have authorisation nor CSRF checks in the acf7_db_edit_scr_file_delete | high | 8.0 | 1% |
| CVE-2020-25026 | derhansen/sf_event_mgt | Information Disclosure in TYPO3 extension sf_event_mgt | medium | 4.3 | 1% |
| CVE-2022-25270 | drupal/core | The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the " | medium | 6.5 | 1% |
| CVE-2023-0814 | profile-builder (WordPress plugin) | The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the | medium | 6.5 | 1% |
| CVE-2021-40616 | thinkcmf/thinkcmf | Incorrect Authorization in thinkcmf | medium | 6.5 | 1% |
| CVE-2022-24748 | shopware/core | Incorrect Authentication in shopware | medium | 6.8 | 1% |