Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.2, updated 2026-10-30. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| GHSA-jmmp-vh96-78rm | zendframework/zend-feed | Zend-Feed URL Rewrite vulnerability | high | 7.5 | – |
| GHSA-wjg9-v8cf-f5q2 | silverstripe/graphql | silverstripe/graphql Cross-Site Request Forgery vulnerability | high | 7.3 | – |
| GHSA-65v7-wg35-2qpm | sylius/resource-bundle | Sylius Resource Bundle Cross-Site Request Forgery vulnerability | medium | 6.5 | – |
| GHSA-6wqp-7g94-f69j | sensiolabs/connect | sensiolabs/connect has a Cross-Site Request Forgery Vulnerability | medium | 6.1 | – |
| GHSA-p2ch-c2c3-4xm5 | winter/wn-backend-module | Winter: CSRF through AJAX handler names reachable as backend page actions | medium | 6.1 | – |
| GHSA-vj2j-6g3w-4662 | silverstripe/framework | Silverstripe Missing CSRF protection in login form | medium | 5.4 | – |
| GHSA-w8fq-xgvh-cxc2 | silverstripe/forum | Silverstripe Forum Module CSRF Vulnerability | medium | 5.3 | – |
| GHSA-fh7r-58q4-6387 | zendframework/zendframework | Zendframework URL Rewrite vulnerability | medium | 4.7 | – |
| GHSA-fq4p-86hh-42v9 | zendframework/zend-diactoros | Zend-Diactoros URL Rewrite vulnerability | medium | 4.7 | – |
| GHSA-2hpc-mf4q-j885 | silverstripe/framework | Silverstripe CSRF vulnerability in GridFieldAddExistingAutocompleter | medium | 4.3 | – |
| GHSA-5pm7-cp8f-p2c2 | wallabag/wallabag | wallabag/wallabag Has Multiple Cross-Site Request Forgery (CSRF) Vulnerabilities | medium | 4.3 | – |
| GHSA-45qm-j4m9-whv9 | ezsystems/ezplatform | eZ Platform CSRF token in login form is disabled by default | high | 0.0 | – |
| GHSA-829q-v5g8-hhxc | cakephp/cakephp | CakePHP has incorrect Cross-Site Request Forgery validation | medium | 0.0 | – |
| GHSA-92xh-6x7v-4rmq | leantime/leantime | Leantime allows Cross-Site Request Forgery (CSRF) | medium | 0.0 | – |