Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| GHSA-7v3x-h7r2-34jv | pterodactyl/panel | Insufficient Session Expiration in Pterodactyl API | medium | 6.0 | – |
| GHSA-8xv9-qcr9-ww9j | shopware/core, shopware/platform | Authenticated XML External Entity Processing | medium | 5.6 | – |
| GHSA-5r8w-66hq-rc39 | silverstripe/framework | silverstripe/framework's pre-existing alc_enc cookies log users in if remember me is disabled | low | 3.1 | – |
| CVE-2015-3542 | phpoffice/phpexcel | PHPExcel XXE Vulnerability | high | 0.0 | – |
| GHSA-2jqj-5qv2-xvcg | ezsystems/ezplatform-richtext | ezsystems/ezplatform-richtext allows access to external entities in XML | high | 0.0 | – |
| GHSA-cj3w-g42v-wcj6 | ibexa/fieldtype-richtext | ibexa/fieldtype-richtext allows access to external entities in XML | high | 0.0 | – |
| GHSA-hr7j-63v7-vj7g | pterodactyl/panel | Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change | high | 0.0 | – |