Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-35181 | wwbn/avideo | AVideo: CSRF on Player Skin Configuration via admin/playerUpdate.json.php | medium | 4.3 | 0% |
| CVE-2025-10930 | drupal/currency | This module allows you to use different currencies on your website and do currency conversion. The module doesn't suffi | medium | 6.5 | 0% |
| CVE-2026-47232 | admidio/admidio | Admidio PKCS#12 private key export action lacks CSRF protection | medium | 4.3 | 0% |
| CVE-2026-8428 | concrete5/concrete5 | Concrete CMS is Vulnerable to Cross-Site Request Forgery | high | 0.0 | 0% |
| CVE-2026-8411 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete | low | 0.0 | 0% |
| CVE-2026-8412 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache | low | 0.0 | 0% |
| CVE-2026-8413 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design | low | 0.0 | 0% |
| CVE-2026-8414 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate | low | 0.0 | 0% |
| CVE-2026-8415 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder | low | 0.0 | 0% |
| CVE-2026-8416 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id) | low | 0.0 | 0% |
| CVE-2026-8427 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id) | low | 0.0 | 0% |
| CVE-2026-8432 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star() | low | 0.0 | 0% |
| CVE-2026-8433 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan() | low | 0.0 | 0% |
| CVE-2026-8434 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple() | low | 0.0 | 0% |
| CVE-2026-34382 | admidio/admidio | Admidio has Missing CSRF Protections on Custom List Deletion in mylist_function.php | medium | 4.6 | 0% |
| CVE-2026-8417 | concrete5/concrete5 | Concrete does not validate a CSRF token before processing requests to `/dashboard/extend/update/do_update/<pkgHandle>` | high | 0.0 | 0% |
| CVE-2026-8140 | concrete5/concrete5 | Concrete CMS is Vulnerable to Cross-Site Request Forgery | high | 0.0 | 0% |
| CVE-2026-41663 | admidio/admidio | Admidio has CSRF on Admin Preferences that Triggers Unauthorized Backup, .htaccess Write, and Email Send | low | 3.5 | 0% |
| CVE-2026-7882 | concrete5/concrete5 | Concrete CMS is vulnerable to unauthorized file deletion | low | 0.0 | 0% |
| CVE-2026-40928 | wwbn/avideo | WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset | medium | 5.4 | 0% |
| CVE-2026-107848 | contao/core-bundle | Contao: Cross-site request forgery in custom backend actions | low | 3.5 | 0% |
| CVE-2026-8435 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion() | low | 0.0 | 0% |
| CVE-2026-40929 | wwbn/avideo | WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creato | medium | 5.4 | 0% |
| CVE-2026-45610 | wwbn/avideo | AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA | medium | 5.7 | 0% |
| CVE-2016-20054 | khodakhah/nodcms | Nodcms contains a cross-site request forgery vulnerability | medium | 4.3 | 0% |
| CVE-2026-8340 | concrete5/concrete5 | Concrete CMS is vulnerable to CSRF via Backend\File::approveVersion | low | 0.0 | 0% |
| CVE-2026-55745 | cotonti/cotonti | Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) module | medium | 5.4 | 0% |
| GHSA-346h-749j-r28w | mdanter/ecc | PHPECC vulnerable to multiple cryptographic side-channel attacks | critical | 9.1 | – |
| GHSA-6v7p-5qcq-268c | zendframework/zend-navigation | Zend-Navigation vulnerable to Cross-site Scripting | high | 7.5 | – |
| GHSA-cg8w-5jrc-675g | zendframework/zend-http | Zend-HTTP URL Rewrite vulnerability | high | 7.5 | – |
| GHSA-jmmp-vh96-78rm | zendframework/zend-feed | Zend-Feed URL Rewrite vulnerability | high | 7.5 | – |
| GHSA-wjg9-v8cf-f5q2 | silverstripe/graphql | silverstripe/graphql Cross-Site Request Forgery vulnerability | high | 7.3 | – |
| GHSA-65v7-wg35-2qpm | sylius/resource-bundle | Sylius Resource Bundle Cross-Site Request Forgery vulnerability | medium | 6.5 | – |
| GHSA-6wqp-7g94-f69j | sensiolabs/connect | sensiolabs/connect has a Cross-Site Request Forgery Vulnerability | medium | 6.1 | – |
| GHSA-p2ch-c2c3-4xm5 | winter/wn-backend-module | Winter: CSRF through AJAX handler names reachable as backend page actions | medium | 6.1 | – |
| GHSA-vj2j-6g3w-4662 | silverstripe/framework | Silverstripe Missing CSRF protection in login form | medium | 5.4 | – |
| GHSA-w8fq-xgvh-cxc2 | silverstripe/forum | Silverstripe Forum Module CSRF Vulnerability | medium | 5.3 | – |
| GHSA-fh7r-58q4-6387 | zendframework/zendframework | Zendframework URL Rewrite vulnerability | medium | 4.7 | – |
| GHSA-fq4p-86hh-42v9 | zendframework/zend-diactoros | Zend-Diactoros URL Rewrite vulnerability | medium | 4.7 | – |
| GHSA-2hpc-mf4q-j885 | silverstripe/framework | Silverstripe CSRF vulnerability in GridFieldAddExistingAutocompleter | medium | 4.3 | – |
| GHSA-5pm7-cp8f-p2c2 | wallabag/wallabag | wallabag/wallabag Has Multiple Cross-Site Request Forgery (CSRF) Vulnerabilities | medium | 4.3 | – |
| GHSA-45qm-j4m9-whv9 | ezsystems/ezplatform | eZ Platform CSRF token in login form is disabled by default | high | 0.0 | – |
| GHSA-6vvh-pxr4-25r7 | web-token/jwt-experimental, web-token/jwt-framework, web-token/jwt-library | PHP JWT Framework: Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on decry | medium | 0.0 | – |
| GHSA-829q-v5g8-hhxc | cakephp/cakephp | CakePHP has incorrect Cross-Site Request Forgery validation | medium | 0.0 | – |
| GHSA-92xh-6x7v-4rmq | leantime/leantime | Leantime allows Cross-Site Request Forgery (CSRF) | medium | 0.0 | – |