Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-47343 | typo3/cms-core | TYPO3 CMS: Destructive Actions on File Mount Folders | high | 0.0 | 0% |
| CVE-2026-47349 | typo3/cms-core, typo3/cms-recycler | TYPO3 CMS has Broken Access Control in the Recycler Module | medium | 0.0 | 0% |
| CVE-2026-47350 | typo3/cms-core | TYPO3 CMS has Broken Access Control in its DataHandler | medium | 0.0 | 0% |
| CVE-2026-47351 | typo3/cms-backend, typo3/cms-core | TYPO3 CMS: Broken Access Control in Media Module | medium | 0.0 | 0% |
| CVE-2026-47352 | typo3/cms-backend, typo3/cms-core | TYPO3 CMS has Broken Access Control in Backend API | medium | 0.0 | 0% |
| CVE-2026-42174 | getkirby/cms | Kirby CMS doesn't gate user avatar creation, replacement and deletion with user update permissions | medium | 0.0 | 0% |
| CVE-2024-13775 | woocommerce-support-ticket-system (WordPress plugin) | The WooCommerce Support Ticket System plugin for WordPress is vulnerable to unauthorized access and loss of data due to missing capability c | medium | 5.4 | 0% |
| CVE-2026-32818 | admidio/admidio | Admidio is Missing Authorization on Forum Topic and Post Deletion | medium | 6.5 | 0% |
| CVE-2024-5331 | breakdance (WordPress plugin) | The Breakdance plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, and including, 1.7.2. This makes it | medium | 4.3 | 0% |
| CVE-2023-4059 | profile-builder (WordPress plugin) | The Profile Builder WordPress plugin before 3.9.8 lacks authorisation and CSRF in its page creation function which allows unauthenticated us | medium | 4.3 | 0% |
| CVE-2025-8944 | oceanwp (WordPress plugin) | The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request hand | medium | 4.3 | 0% |
| CVE-2026-33177 | statamic/cms | Statamic is missing authorization check on taxonomy term creation via fieldtype | medium | 4.3 | 0% |
| CVE-2026-42069 | getkirby/cms | Kirby CMS's read access to site, user and role information is not gated by permissions | high | 0.0 | 0% |
| CVE-2025-14457 | drag-and-drop-multiple-file-upload-contact-form-7 (WordPress plugin) | The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a m | low | 3.7 | 0% |
| CVE-2025-9294 | quiz-master-next (WordPress plugin) | The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized loss of data due to a missi | medium | 4.3 | 0% |
| CVE-2026-7879 | concrete5/concrete5 | Concrete CMS has an unauthorized file access issue | medium | 0.0 | 0% |
| CVE-2024-0516 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to unauthorized post metadata update due to a missing capability | medium | 5.3 | 0% |
| CVE-2026-47742 | shopper/framework | Shopper: Missing authorization on Product admin Livewire sub-form components | medium | 6.5 | 0% |
| CVE-2026-47745 | shopper/framework | Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables | medium | 6.5 | 0% |
| CVE-2024-44020 | wp-free-ssl (WordPress plugin) | Missing Authorization vulnerability in prasadkirpekar WP Free SSL – Free SSL Certificate for WordPress and force HTTPS wp-free-ssl.This issu | medium | 4.3 | 0% |
| CVE-2026-33161 | craftcms/cms | Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users | low | 0.0 | 0% |
| CVE-2026-46365 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ's Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags | medium | 5.4 | 0% |
| CVE-2024-11916 | wpextended (WordPress plugin) | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due t | high | 7.4 | 0% |
| CVE-2026-35179 | wwbn/avideo | AVideo: Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php | medium | 5.3 | 0% |
| CVE-2025-3527 | eventon (WordPress plugin) | The EventON Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'assets/lib | medium | 6.4 | 0% |
| CVE-2026-53634 | code16/sharp | Sharp Missing Authorization Check in Quick Creation Command Endpoints | medium | 4.3 | 0% |
| CVE-2026-100855 | azuracast/azuracast | AzuraCast has Missing Permissions Check on Media File Download, Allowing Cross-Station Data Exfiltration | medium | 6.5 | 0% |
| CVE-2025-12022 | elex-helpdesk-customer-support-ticket-system (WordPress plugin) | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a mis | medium | 4.3 | 0% |
| CVE-2025-12023 | elex-helpdesk-customer-support-ticket-system (WordPress plugin) | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a mis | medium | 4.3 | 0% |
| CVE-2025-12085 | elex-helpdesk-customer-support-ticket-system (WordPress plugin) | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a mis | medium | 4.3 | 0% |
| CVE-2025-12169 | wsdesk (WordPress plugin) | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a mis | medium | 4.3 | 0% |
| CVE-2026-8238 | concrete5/concrete5 | Concrete CMS is vulnerable to IDOR | medium | 0.0 | 0% |
| CVE-2024-13419 | april (WordPress plugin), auteur (WordPress plugin), benaa (WordPress plugin) +1 more | Multiple plugins and/or themes for WordPress using Smart Framework are vulnerable to Stored Cross-Site Scripting due to a missing capability | medium | 6.4 | 0% |
| CVE-2026-100854 | azuracast/azuracast | AzuraCast's Missing RequireInternalConnection on Liquidsoap API Allows Low-Privilege Metadata Injection and Broadcast Disruption | medium | 6.3 | 0% |
| CVE-2026-8239 | concrete5/concrete5 | Concrete CMS is vulnerable to IDOR | medium | 0.0 | 0% |
| CVE-2026-107850 | contao/core-bundle | Contao: Improper access control in the preview links module | medium | 4.3 | 0% |
| CVE-2026-31821 | sylius/sylius | Sylius is Missing Authorization in API v2 Add Item Endpoint | medium | 0.0 | 0% |
| CVE-2026-42051 | getkirby/cms | Kirby CMS's system API endpoint leaks installed version and license data to authenticated users | medium | 0.0 | 0% |
| CVE-2026-116890 | mediawiki/semantic-media-wiki | Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks | high | 7.3 | 0% |
| CVE-2024-2395 | bulgarisation-for-woocommerce (WordPress plugin) | The Bulgarisation for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0 | high | 7.3 | 0% |
| CVE-2026-1217 | yoast/duplicate-post | Yoast Duplicate Post has an Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite | medium | 5.4 | 0% |
| CVE-2026-52839 | alextselegidis/easyappointments | Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass | low | 3.3 | 0% |
| CVE-2026-40098 | openmage/magento-lts | OpenMage LTS: Cross-user wishlist import leads to private option & file disclosure | medium | 5.4 | 0% |
| CVE-2026-4202 | ayacoo/redirect-tab | Broken Access Control in extension "Redirect Tab" (redirect_tab) | medium | 4.3 | 0% |
| CVE-2026-33887 | statamic/cms | Statamic allows unauthorized content access through missing authorization in its revision controllers | medium | 5.4 | 0% |
| GHSA-h4hf-v6w5-897x | poweradmin/poweradmin | Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account | high | 8.8 | – |
| GHSA-fm29-4mq3-phg6 | winter/wn-backend-module | Winter: ImportExportController AJAX handlers bypass granular import/export permission gate | high | 8.3 | – |
| GHSA-cvpc-hccg-wmw4 | verbb/formie | Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration | medium | 6.3 | – |
| GHSA-ppm4-r2vc-pg74 | simplesamlphp/simplesamlphp | SimpleSAMLphp Information Disclosure vulnerability | medium | 5.9 | – |
| GHSA-rv8r-8mh5-5376 | typo3/cms-core | TYPO3 Information Disclosure in Backend User Interface | medium | 5.4 | – |