Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-7890 | concrete5/concrete5 | Concrete CMS's RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation | low | 0.0 | 0% |
| CVE-2026-55742 | cotonti/cotonti | Cotonti: Cross-Site Request Forgery in the administration rights handler | critical | 9.6 | 0% |
| CVE-2026-45660 | statamic/cms | Statamic CMS: Server-Side Request Forgery via Glide | medium | 5.4 | 0% |
| CVE-2024-13261 | drupal/acquia_dam | Acquia DAM provides a connection to a third-party asset management system, allowing for images to be managed, linked to, | unknown | 0.0 | 0% |
| CVE-2026-107308 | drupal/country | The module Country provides a dedicated field type for Drupal core's official country list. The module does not suffici | unknown | 0.0 | 0% |
| CVE-2026-8139 | concrete5/concrete5 | Concrete CMS is vulnerable to Stored XSS via external-link page cvName | low | 0.0 | 0% |
| CVE-2026-63000 | redaxo/source | REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates | medium | 6.4 | 0% |
| CVE-2024-13682 | wallet-system-for-woocommerce (WordPress plugin) | The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable | medium | 4.3 | 0% |
| CVE-2025-67472 | online-booking-\&-scheduling-calendar (WordPress plugin) | Cross-Site Request Forgery (CSRF) vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vc | medium | 4.3 | 0% |
| CVE-2026-0895 | cpsit/typo3-mailqueue | mailqueue TYPO3 extension affected by Insecure Deserialization in QueueableFileTransport | medium | 0.0 | 0% |
| CVE-2026-107252 | drupal/mathjax | This module integrates the MathJax library into your Drupal site. MathJax is the modern JavaScript-based LaTeX rendering | unknown | 0.0 | 0% |
| CVE-2026-118574 | drupal/s3fs | S3 File System (s3fs) provides an additional file system to your Drupal site that stores files in Amazon's Simple Storag | unknown | 0.0 | 0% |
| CVE-2026-72702 | getgrav/grav | Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match | low | 0.0 | 0% |
| CVE-2026-8353 | concrete5/concrete5 | Concrete CMS is vulnerable to Stored XSS via page name in the Atomik theme | low | 0.0 | 0% |
| CVE-2026-55744 | cotonti/cotonti | Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) module | high | 8.1 | 0% |
| CVE-2025-45769 | firebase/php-jwt | php-jwt contains weak encryption | medium | 6.5 | 0% |
| CVE-2026-55568 | guzzlehttp/guzzle | guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext | medium | 5.9 | 0% |
| CVE-2025-2797 | woffice (WordPress plugin) | The Woffice Core plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.4.21. This is due | medium | 5.4 | 0% |
| CVE-2026-33887 | statamic/cms | Statamic allows unauthorized content access through missing authorization in its revision controllers | medium | 5.4 | 0% |
| CVE-2026-9557 | mautic/core | Mautic Focus component Vulnerable to SSRF | medium | 6.4 | 0% |
| CVE-2025-5924 | wp-push-notification-firebase (WordPress plugin) | The WP Firebase Push Notification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2 | medium | 4.3 | 0% |
| CVE-2026-10721 | concrete5/concrete5 | Concrete CMS: PHP Object Injection via unserialize() calls | high | 0.0 | 0% |
| CVE-2026-7689 | dolibarr/dolibarr | Dolibarr has Insufficient Verification of Data Authenticity | low | 3.7 | 0% |
| CVE-2026-118553 | drupal/ai | The AI module includes a submodule, AI Automator. This submodule allows you to automatically fill out fields using AI, b | unknown | 0.0 | 0% |
| CVE-2026-29179 | october/system | October CMS: Editor Sub-Permission Bypass for Asset and Blueprint File Operations | low | 3.3 | 0% |
| CVE-2026-27937 | october/system | October CMS: Reflected XSS via DataTable Form Widget | low | 3.1 | 0% |
| CVE-2026-118573 | drupal/oauth2_token_manager | This module lets you manage system-wide OAuth2 access and refresh tokens for Box, Quip, and Slack integrations through D | unknown | 0.0 | 0% |
| CVE-2024-13512 | wonder-fontawesome (WordPress plugin) | The Wonder FontAwesome plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8. This is d | medium | 6.1 | 0% |
| CVE-2024-13521 | mailup-auto-subscribtion (WordPress plugin) | The MailUp Auto Subscription plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. T | medium | 6.1 | 0% |
| CVE-2025-11154 | idonate (WordPress plugin) | The IDonate WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action handler, allowing unauthe | medium | 5.4 | 0% |
| CVE-2025-13981 | drupal/ai | This modules provides the ability to chat with an AI Agent using a large-language model (LLM) provider for different pur | unknown | 0.0 | 0% |
| CVE-2026-114543 | drupal/simple_user_management | This module lets non-administrators approve, deactivate and delete users, limited by the roles they can delegate through | unknown | 0.0 | 0% |
| CVE-2026-15080 | drupal/lingotek | The Lingotek Ray Enterprise Translation module provides multilingual site management. The module fails to protect sever | unknown | 0.0 | 0% |
| CVE-2026-8409 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete | low | 0.0 | 0% |
| CVE-2026-8410 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete | low | 0.0 | 0% |
| CVE-2026-59946 | composer/composer | Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files | medium | 6.1 | 0% |
| CVE-2025-15611 | popup-box (WordPress plugin) | The Popup Box WordPress plugin before 5.5.0 does not properly validate nonces in the add_or_edit_popupbox() function before saving popup da | medium | 5.4 | 0% |
| CVE-2026-43877 | wwbn/avideo | AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Authenticated Users' Profile Photos with Arbitrary Content | medium | 5.4 | 0% |
| CVE-2024-49762 | pterodactyl/panel | Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled | medium | 4.6 | 0% |
| CVE-2024-13293 | drupal/postfile | The module creates an endpoint on the site at /postfile/upload that accepts a POST request for uploading a single file i | unknown | 0.0 | 0% |
| CVE-2025-67719 | ibexa/user | Ibexa User Bundle is missing password change validation | critical | 0.0 | 0% |
| CVE-2026-2348 | drupal/quickedit | This module allows content to be edited in-place. The module doesn't sufficiently sanitize certain image-related values | unknown | 0.0 | 0% |
| CVE-2026-3212 | drupal/tagify | This module integrates the Tagify JavaScript library to enhance taxonomy entity reference widgets. The module does not | unknown | 0.0 | 0% |
| CVE-2026-87947 | drupal/miniorange_saml | This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate throu | unknown | 0.0 | 0% |
| CVE-2026-35181 | wwbn/avideo | AVideo: CSRF on Player Skin Configuration via admin/playerUpdate.json.php | medium | 4.3 | 0% |
| CVE-2026-118568 | drupal/cms_content_sync | This module enables you to share and reuse content across websites. The module did not sufficiently encrypt the passwor | unknown | 0.0 | 0% |
| CVE-2026-8245 | concrete5/concrete5 | Concrete CMS is Vulnerable to Reflected XSS in Legacy Pagination | medium | 0.0 | 0% |
| CVE-2026-87944 | drupal/miniorange_saml | This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate throu | unknown | 0.0 | 0% |
| CVE-2026-59948 | composer/composer | Composer: Arbitrary file write outside vendor via malicious transitive package name | high | 7.0 | 0% |
| CVE-2026-32816 | admidio/admidio | Admidio is Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions | medium | 5.7 | 0% |