Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| GHSA-qg7m-mwxm-j3h7 | zendframework/zend-developer-tools | Zend-developer-tools information disclosure vulnerability | medium | 5.3 | – |
| GHSA-55pp-293f-3365 | silverstripe/userforms | silverstripe/userforms file upload exposure on UserForms module | medium | 4.3 | – |
| GHSA-wvvp-jwf5-qcpc | typo3/cms-core | TYPO3 Information Disclosure in Page Tree | medium | 4.3 | – |
| GHSA-f5pp-pmq8-gp46 | passbolt/passbolt_api | Passbolt Api Retrieval of HTTP-only cookies | low | 3.7 | – |
| CVE-2021-30492 | zendesk/zendesk_api_client_php | Lack of Input Validation in zendesk_api_client_php for Zendesk Subdomain | critical | 0.0 | – |
| CVE-2023-32302 | silverstripe/framework | Silverstripe Framework: Members with no password can be created and bypass custom login forms | low | 0.0 | – |
| CVE-2026-52883 | mantisbt/mantisbt | MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs | medium | 0.0 | – |
| GHSA-2237-5r9w-vm8j | opensource-workshop/connect-cms | Connect-CMS information that is restricted to viewing is visible | high | 0.0 | – |
| GHSA-27qh-8cxx-2cr5 | aws/aws-sdk-php | AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters | high | 0.0 | – |
| GHSA-2frx-j9hj-6c65 | lexik/jwt-authentication-bundle | User enumeration in authentication mechanisms | low | 0.0 | – |
| GHSA-2rh5-jvgx-pgw3 | ezsystems/ezplatform | Any storage file can be downloaded from p.sh if full server path is known | high | 0.0 | – |
| GHSA-2x4v-g8cx-jxrq | ibexa/core | Login timing attack in ibexa/core | critical | 0.0 | – |
| GHSA-342c-vcff-2ff2 | ezsystems/ezplatform-kernel | Login timing attack in ezsystems/ezplatform-kernel | critical | 0.0 | – |
| GHSA-3g43-xfrw-pv5m | ezsystems/repository-forms | eZ Platform User data disclosure | high | 0.0 | – |
| GHSA-44pg-c29v-hp6r | laravel/framework | Laravel Guard bypass in Eloquent models | medium | 0.0 | – |
| GHSA-5739-39v2-5754 | web-token/jwt-framework, web-token/jwt-library | RSA1_5 (RSAES-PKCS1-v1_5) decryption lacks implicit rejection, exposing a Bleichenbacher/Marvin padding oracle | medium | 0.0 | – |
| GHSA-78vr-q6cf-c7p6 | craftcms/commerce | Craft Commerce: Partial Payment Amount Without Lower Bound Validation | medium | 0.0 | – |
| GHSA-7crc-r3wg-cfgf | ezsystems/ezplatform-solr-search-engine | Json response for search reveals Solr credentials | critical | 0.0 | – |
| GHSA-7fjp-g4m7-fx23 | pwweb/laravel-core | User (Encrypted) Password Field Being Serialised | low | 0.0 | – |
| GHSA-7vwg-39h8-8qp8 | ezsystems/ezplatform-rest | /user/sessions endpoint allows detecting valid accounts | high | 0.0 | – |
| GHSA-9vxv-wpv4-f52p | shopware/shopware | Information leakage in Error Handler | medium | 0.0 | – |
| GHSA-9wwx-c723-vm8x | ezsystems/ezpublish-kernel | eZ Platform REST API returns list of all SiteAccesses | medium | 0.0 | – |
| GHSA-cc2j-92jq-wgjg | ezsystems/ezpublish-legacy | eZ Publish Information disclosure in backend content tree menu | high | 0.0 | – |
| GHSA-cc2w-ghc5-m5qr | illuminate/database | Laravel Risk of mass-assignment vulnerabilities | medium | 0.0 | – |
| GHSA-cq6h-w3mc-57f4 | shopware/core, shopware/platform | Information exposure via query strings in URL | low | 0.0 | – |
| GHSA-f43j-8hq4-2xj9 | silverstripe/framework | silverstripe/framework uploaded PHP script execution in assets | medium | 0.0 | – |
| GHSA-g2qj-pmxm-9f8f | symfony/security-http, symfony/symfony | User enumeration in authentication mechanisms | low | 0.0 | – |
| GHSA-gq4g-fpc9-vjfq | web-auth/webauthn-lib | Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protectio | low | 0.0 | – |
| GHSA-gqcf-83rq-gpfr | ibexa/post-install | Any storage file can be downloaded from p.sh if full server path is known | high | 0.0 | – |
| GHSA-hvgw-gg3p-295j | klaviyo/magento2-extension | Read private customer data reclaiming carts in Klaviyo Magento | medium | 0.0 | – |
| GHSA-j7f5-gfqm-pcx3 | pterodactyl/panel | Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system | medium | 0.0 | – |
| GHSA-jjx7-8462-w4m4 | drupal/drupal | Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution | critical | 0.0 | – |
| GHSA-mqq7-wxx5-mp8h | prestashop/ps_checkout | ps_checkout allows unauthorized method invocation through unvalidated parameter | low | 0.0 | – |
| GHSA-mvf6-3f2g-xfxf | endroid/qr-code-bundle | endroid/qr-code-bundle File Disclosure via logo_path query parameter | medium | 0.0 | – |
| GHSA-q3x8-6898-23g3 | ibexa/user | ibexa/user login enumerates user accounts | medium | 0.0 | – |
| GHSA-q683-8468-r6h6 | web-auth/webauthn-symfony-bundle | WebauthnAuthenticator leaks sensitive HTTP headers through INFO-level logs | medium | 0.0 | – |
| GHSA-qwvp-268g-jjm8 | livewire/livewire | Data Leakage Vulnerability in livewire/livewire | medium | 0.0 | – |
| GHSA-rj3w-99gc-8j58 | laravel/framework | Laravel Risk of mass-assignment vulnerabilities | medium | 0.0 | – |
| GHSA-v6xp-ccvx-w52m | ibexa/solr | Json response for search reveals Solr credentials | critical | 0.0 | – |
| GHSA-wrpf-2x8h-82gr | typo3/cms | Typo3 Arbitrary File Disclosure in Form Component | medium | 0.0 | – |
| GHSA-xfqg-p48g-hh94 | ezsystems/ezpublish-kernel | Login timing attack in ezsystems/ezpublish-kernel | critical | 0.0 | – |