Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-31821 | sylius/sylius | Sylius is Missing Authorization in API v2 Add Item Endpoint | medium | 0.0 | 0% |
| CVE-2026-42051 | getkirby/cms | Kirby CMS's system API endpoint leaks installed version and license data to authenticated users | medium | 0.0 | 0% |
| CVE-2026-116890 | mediawiki/semantic-media-wiki | Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks | high | 7.3 | 0% |
| CVE-2024-2395 | bulgarisation-for-woocommerce (WordPress plugin) | The Bulgarisation for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0 | high | 7.3 | 0% |
| CVE-2026-1217 | yoast/duplicate-post | Yoast Duplicate Post has an Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite | medium | 5.4 | 0% |
| CVE-2026-52839 | alextselegidis/easyappointments | Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass | low | 3.3 | 0% |
| CVE-2026-40098 | openmage/magento-lts | OpenMage LTS: Cross-user wishlist import leads to private option & file disclosure | medium | 5.4 | 0% |
| CVE-2026-33884 | statamic/cms | Statamic's live preview token bypasses content protection for unrelated entries | medium | 4.3 | 0% |
| CVE-2026-4202 | ayacoo/redirect-tab | Broken Access Control in extension "Redirect Tab" (redirect_tab) | medium | 4.3 | 0% |
| CVE-2026-33887 | statamic/cms | Statamic allows unauthorized content access through missing authorization in its revision controllers | medium | 5.4 | 0% |
| CVE-2026-29179 | october/system | October CMS: Editor Sub-Permission Bypass for Asset and Blueprint File Operations | low | 3.3 | 0% |
| GHSA-h4hf-v6w5-897x | poweradmin/poweradmin | Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account | high | 8.8 | – |
| GHSA-fm29-4mq3-phg6 | winter/wn-backend-module | Winter: ImportExportController AJAX handlers bypass granular import/export permission gate | high | 8.3 | – |
| GHSA-3mm9-2p44-rw39 | silverstripe/cms | Silverstripe SiteTree Creation Permission Vulnerability | high | 7.5 | – |
| GHSA-7hh9-gp72-wh7h | auth0/login | Auth0 Laravel SDK has Improper Audience Validation via Auth0-PHP SDK dependency | medium | 6.8 | – |
| GHSA-f3r2-88mq-9v4g | auth0/symfony | Auth0 Symfony SDK has Improper Audience Validation via Auth0-PHP SDK | medium | 6.8 | – |
| GHSA-vvg7-8rmq-92g7 | auth0/wordpress | Auth0 WordPress has Improper Audience Validation via Auth0-PHP SDK Dependency | medium | 6.8 | – |
| GHSA-mhf7-xp6r-6qrc | livewire/livewire | Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order | medium | 6.5 | – |
| GHSA-cvpc-hccg-wmw4 | verbb/formie | Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration | medium | 6.3 | – |
| GHSA-ppm4-r2vc-pg74 | simplesamlphp/simplesamlphp | SimpleSAMLphp Information Disclosure vulnerability | medium | 5.9 | – |
| GHSA-rv8r-8mh5-5376 | typo3/cms-core | TYPO3 Information Disclosure in Backend User Interface | medium | 5.4 | – |
| GHSA-m895-2hj3-8cg9 | shopware/core, shopware/platform | Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually | medium | 5.3 | – |
| GHSA-52cx-hpc5-cxwc | silverstripe/framework | silverstripe/framework missing ACL on reports | medium | 4.3 | – |
| GHSA-g776-759r-pf6x | typo3/cms-core | TYPO3 Broken Access Control in Import Module | medium | 4.3 | – |
| GHSA-r2vg-hvjm-fg38 | shopware/core, shopware/platform | Shopware Customer Orders can be canceled, even if refunds are disabled | medium | 4.3 | – |
| GHSA-h4fw-6r7f-w494 | web-auth/webauthn-framework | Webauthn has a User Verification Downgrade via Default-Open ClientOverridePolicy | low | 2.1 | – |
| CVE-2023-32302 | silverstripe/framework | Silverstripe Framework: Members with no password can be created and bypass custom login forms | low | 0.0 | – |
| CVE-2026-49280 | mantisbt/mantisbt | MantisBT: REST API unauthorized Issue status change | medium | 0.0 | – |
| GHSA-3hfj-qcvj-4hx8 | leantime/leantime | Leantime has Missing Authorization Check for Host Parameter | low | 0.0 | – |
| GHSA-5q58-x5h2-v5rx | shopware/core, shopware/platform | Authenticated Privilege Escalation | low | 0.0 | – |
| GHSA-5q8v-j673-m5v4 | grumpydictator/firefly-iii | Firefly III user API endpoints expose all users' information to any authenticated user (IDOR) | medium | 0.0 | – |
| GHSA-7vfx-4246-jcfh | solidinvoice/solidinvoice | SolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API tokens and notification transport settings | high | 0.0 | – |
| GHSA-jvg4-9rc2-wvcr | shopware/platform | Generation of fake documents via public GET-call | low | 0.0 | – |