Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| GHSA-52cx-hpc5-cxwc | silverstripe/framework | silverstripe/framework missing ACL on reports | medium | 4.3 | – |
| GHSA-r2vg-hvjm-fg38 | shopware/core, shopware/platform | Shopware Customer Orders can be canceled, even if refunds are disabled | medium | 4.3 | – |
| CVE-2023-32302 | silverstripe/framework | Silverstripe Framework: Members with no password can be created and bypass custom login forms | low | 0.0 | – |
| CVE-2026-49280 | mantisbt/mantisbt | MantisBT: REST API unauthorized Issue status change | medium | 0.0 | – |
| GHSA-3hfj-qcvj-4hx8 | leantime/leantime | Leantime has Missing Authorization Check for Host Parameter | low | 0.0 | – |
| GHSA-7vfx-4246-jcfh | solidinvoice/solidinvoice | SolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API tokens and notification transport settings | high | 0.0 | – |
| GHSA-jvg4-9rc2-wvcr | shopware/platform | Generation of fake documents via public GET-call | low | 0.0 | – |