PHP vulnerability advisories

Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.

19,303CVEs

8,638Composer advisories

12,328WordPress advisories

35Actively exploited (KEV) →

CVE	Package	Title	Severity	CVSS	EPSS
CVE-2021-47853	phppgadmin/phppgadmin	phpPgAdmin contains a remote command execution vulnerability	high	8.8	–
GHSA-g3hq-hphg-8fhh	pheditor/pheditor	Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixe	high	8.8	–
GHSA-w8gf-g2vq-j2f4	amphp/http-client	amphp/http-client Denial of Service via HTTP/2 CONTINUATION Frames	high	8.2	–
GHSA-cv5c-2qv5-w2m2	passbolt/passbolt_api	Passbolt Api Remote code execution	high	8.1	–
GHSA-26hp-cgjj-m2j3	fuel/core	fuel/core ImageMagick driver does not escape all shell arguments.	high	0.0	–

Severity and CVSS come from the upstream advisory (OSV.dev, NVD, FriendsOfPHP); KEV marks CVEs on CISA's Known Exploited Vulnerabilities list; EPSS is FIRST's 30-day exploitation probability. Rows sort exploitation-first: KEV, then EPSS, then CVSS.