Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| GHSA-8x2v-pcg7-94f4 | zendframework/zend-json | Zend-JSON vulnerable to XXE/XEE attacks | critical | 9.8 | – |
| GHSA-f4fj-q6m4-cc52 | zendframework/zend-xmlrpc | ZendFramework vulnerable to XXE/XEE attacks | critical | 9.8 | – |
| GHSA-mhpx-3rv8-wrjm | zendframework/zendframework1 | ZendFramework potential XML eXternal Entity injection vectors | critical | 9.8 | – |
| GHSA-qc7w-4567-84wv | zendframework/zendframework | Zendframework vulnerable to XXE/XEE attacks | critical | 9.8 | – |
| GHSA-w8gf-g2vq-j2f4 | amphp/http-client | amphp/http-client Denial of Service via HTTP/2 CONTINUATION Frames | high | 8.2 | – |
| GHSA-2jx7-xg83-j2m7 | zendframework/zendframework1 | Zendframework Denial of Service vector via XEE injection | high | 7.5 | – |
| GHSA-4vf2-qfg3-7598 | symfony/validator | symfony/validator XML Entity Expansion vulnerability | high | 7.5 | – |
| GHSA-f75p-x5vm-83qp | symfony/translation | symfony/translation XML Entity Expansion vulnerability | high | 7.5 | – |
| GHSA-g585-crjf-vhwq | typo3/cms | TYPO3 Denial of Service in Frontend Record Registration | high | 7.5 | – |
| GHSA-hjx5-v9xg-7h25 | typo3/cms-core | TYPO3 Denial of Service in Frontend Record Registration | high | 7.5 | – |
| GHSA-q2gc-gg3x-7942 | symfony/symfony | Symfony XML Entity Expansion security vulnerability | high | 7.5 | – |
| GHSA-f3wf-q4fj-3gxf | typo3/cms | TYPO3 Denial of Service in Online Media Asset Handling | medium | 6.5 | – |
| GHSA-29m4-mx89-3mjg | typo3/cms-core | TYPO3 Denial of Service in Online Media Asset Handling | medium | 5.3 | – |
| GHSA-g43w-98wp-m694 | silverstripe/framework | SilverStripe framework XML Quadratic Blowup Attack | medium | 5.3 | – |
| GHSA-3prj-6hqw-cm82 | web-token/jwt-framework, web-token/jwt-library | PHP JWT Library: PBES2-HS*+A*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of service | high | 0.0 | – |
| GHSA-58q2-9x27-h2jm | solspace/craft-freeform | solspace/craft-freeform Has a DoS Vulnerability | low | 0.0 | – |