Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-51992 | orchid/platform | Orchid Platform has Method Exposure Vulnerability in Modals | medium | 4.1 | 0% |
| CVE-2024-45612 | contao/core-bundle | Contao affected by insert tag injection via canonical URL | medium | 5.3 | 0% |
| CVE-2025-24374 | twig/twig | Twig security issue where escaping was missing when using null coalesce operator | medium | 4.3 | 0% |
| CVE-2026-41234 | froxlor/froxlor | Froxlor: BIND Zone File Injection via TXT Record Content | high | 7.6 | 0% |
| CVE-2026-41237 | froxlor/froxlor | Froxlor has an incomplete fix for CVE-2026-30932 | high | 0.0 | 0% |
| CVE-2024-55924 | typo3/cms-scheduler | TYPO3 Scheduler Module vulnerable to Cross-Site Request Forgery | high | 8.0 | 0% |
| CVE-2024-55893 | typo3/cms-belog | TYPO3 Cross-Site Request Forgery in Log Module | medium | 4.3 | 0% |
| CVE-2024-55894 | typo3/cms-beuser | TYPO3 Cross-Site Request Forgery in Backend User Module | medium | 4.3 | 0% |
| CVE-2026-6982 | showdoc/showdoc | ShowDoc has an Injection vulnerability | medium | 6.3 | 0% |
| CVE-2024-55945 | typo3/cms-lowlevel | TYPO3 DB Check Module vulnerable to Cross-Site Request Forgery | medium | 4.3 | 0% |
| CVE-2026-7688 | dolibarr/dolibarr | Dolibarr has an Injection issue | medium | 5.0 | 0% |
| CVE-2024-55920 | typo3/cms-dashboard | TYPO3 Cross-Site Request Forgery in Dashboard Module | medium | 4.3 | 0% |
| CVE-2024-55923 | typo3/cms-indexed-search | TYPO3 Indexed Search Module vulnerable to Cross-Site Request Forgery | medium | 4.3 | 0% |
| CVE-2024-55922 | typo3/cms-form | TYPO3 Form Framework Module vulnerable to Cross-Site Request Forgery | medium | 5.4 | 0% |
| CVE-2024-43428 | moodle/moodle | Moodle vulnerable to cache poisoning via injection into storage | high | 7.7 | 0% |
| GHSA-7336-ghhp-f2qj | shopware/shopware | Shopware Remote Code Execution Vulnerability | critical | 9.8 | – |
| GHSA-cc97-g92w-jm65 | typo3/cms-core | TYPO3 CMS Insecure Deserialization & Arbitrary Code Execution | critical | 9.8 | – |
| GHSA-q3g4-2vw9-xv27 | shopware/shopware | Shopware Remote Code Execution Vulnerability | critical | 9.8 | – |
| GHSA-x86x-qhf8-f37w | willdurand/js-translation-bundle | willdurand/js-translation-bundle potential path traversal attack and remote code injection | critical | 9.8 | – |
| GHSA-cxf7-m5g2-v594 | zendframework/zend-mail | Zend-Mail remote code execution in zend-mail via Sendmail adapter | high | 8.8 | – |
| GHSA-mqjc-x563-c9q8 | silverstripe/framework | silverstripe/framework CSV Excel Macro Injection | high | 8.0 | – |
| GHSA-jq87-2wxp-8349 | zendframework/zendframework | ZendFramework Route Parameter Injection Via Query String in `Zend\Mvc` | high | 7.5 | – |
| GHSA-vgxh-x8jv-hmff | silverstripe/framework | silverstripe/framework code execution vulnerability | high | 7.5 | – |
| GHSA-x7p5-p2c9-phvg | illuminate/database, laravel/framework | Unexpected database bindings | high | 7.2 | – |
| GHSA-7v7m-pcw5-h3cg | pusher/pusher-php-server | Pusher Service Channel Authentication Bypass | medium | 6.5 | – |
| GHSA-99r5-84gr-59f6 | leantime/leantime | Leantime has Host Header Injection Vulnerability | medium | 6.5 | – |
| GHSA-gff2-p6vm-3p8g | zendframework/zendframework | ZendFramework potential remote code execution in zend-mail via Sendmail adapter | medium | 6.5 | – |
| GHSA-g5vj-wj9x-4jg9 | symbiote/silverstripe-multivaluefield | symbiote/silverstripe-multivaluefield Possible PHP Object Injection via Multi-Value Field Extension | medium | 6.1 | – |
| GHSA-mg7h-9qfx-4r83 | zendframework/zendframework | ZendFramework Potential Proxy Injection Vulnerabilities | medium | 5.9 | – |
| GHSA-v858-922f-fj9v | simplesamlphp/simplesamlphp | SimpleSAMLphp Link Injection vulnerability | medium | 5.4 | – |
| GHSA-2r3v-q9x3-7g46 | simplesamlphp/simplesamlphp | Link injection in SimpleSAMLphp | low | 3.7 | – |
| GHSA-27qh-8cxx-2cr5 | aws/aws-sdk-php | AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters | high | 0.0 | – |
| GHSA-595p-g7xc-c333 | algolia/algoliasearch-magento-2 | Algolia Search & Discovery for Magento 2 Has Untrusted Data Handling | medium | 0.0 | – |
| GHSA-c2p2-hgjg-9r3f | islandora/crayfish | Crayfish Allows Remote Code Execution via hypercube X-Islandora-Args Header | critical | 0.0 | – |
| GHSA-f57v-q966-7fh6 | monolog/monolog | Monolog Header injection in NativeMailerHandler | low | 0.0 | – |
| GHSA-pjj4-jjgc-h3r8 | shopware/platform | Authenticated remote code execution | medium | 0.0 | – |