Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-23695 | cockpit-hq/cockpit | Cockpit CMS: Stored cross-site scripting vulnerability in the Set field type's Display template option | medium | 5.4 | 0% |
| CVE-2026-31313 | feehi/cms | Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the creation/editing module | medium | 5.4 | 0% |
| CVE-2026-47229 | admidio/admidio | Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation | medium | 5.4 | 0% |
| CVE-2025-5938 | digital-marketing-agency-templates-for-elementor (WordPress plugin) | The Digital Marketing and Agency Templates Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all vers | medium | 5.3 | 0% |
| CVE-2025-5936 | vr-calendar-sync (WordPress plugin) | The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.7. This is due to | medium | 4.3 | 0% |
| CVE-2026-34383 | admidio/admidio | Admidio has CSRF and Form Validation Bypass in Inventory Item Save via `imported` Parameter | medium | 4.3 | 0% |
| CVE-2026-3532 | drupal/openid_connect | This module enables you to use an external OpenID Connect login provider to authenticate and log in users on your site. | unknown | 0.0 | 0% |
| CVE-2024-36119 | statamic/cms | Password confirmation stored in plain text via registration form in statamic/cms | low | 1.8 | 0% |
| CVE-2026-45619 | wwbn/avideo | AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD p | medium | 6.5 | 0% |
| CVE-2026-45580 | wwbn/avideo | AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute | medium | 5.4 | 0% |
| CVE-2025-10930 | drupal/currency | This module allows you to use different currencies on your website and do currency conversion. The module doesn't suffi | medium | 6.5 | 0% |
| CVE-2026-41057 | wwbn/avideo | WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated API Responses | high | 7.1 | 0% |
| CVE-2026-47232 | admidio/admidio | Admidio PKCS#12 private key export action lacks CSRF protection | medium | 4.3 | 0% |
| CVE-2026-8428 | concrete5/concrete5 | Concrete CMS is Vulnerable to Cross-Site Request Forgery | high | 0.0 | 0% |
| CVE-2026-8411 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete | low | 0.0 | 0% |
| CVE-2026-8412 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache | low | 0.0 | 0% |
| CVE-2026-8413 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design | low | 0.0 | 0% |
| CVE-2026-8414 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate | low | 0.0 | 0% |
| CVE-2026-8415 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder | low | 0.0 | 0% |
| CVE-2026-8416 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id) | low | 0.0 | 0% |
| CVE-2026-8427 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id) | low | 0.0 | 0% |
| CVE-2026-8432 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star() | low | 0.0 | 0% |
| CVE-2026-8433 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan() | low | 0.0 | 0% |
| CVE-2026-8434 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple() | low | 0.0 | 0% |
| CVE-2025-64711 | privatebin/privatebin | PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for users | low | 3.9 | 0% |
| CVE-2026-118570 | drupal/fasttoggle | This module enables you to quickly toggle the publication status, promotion and stickiness of nodes, and the publication | unknown | 0.0 | 0% |
| CVE-2026-34382 | admidio/admidio | Admidio has Missing CSRF Protections on Custom List Deletion in mylist_function.php | medium | 4.6 | 0% |
| CVE-2026-118560 | drupal/commerce_stripe | This module enables you to use the Stripe Connect API to quickly configure your Drupal Commerce store to take payments v | unknown | 0.0 | 0% |
| CVE-2024-47056 | mautic/core | Mautic does not shield .env files from web traffic | medium | 5.1 | 0% |
| CVE-2026-118559 | drupal/commerce_stripe | This module enables you to take payments via multiple Stripe APIs. The module doesn't sufficiently verify the cryptogra | unknown | 0.0 | 0% |
| CVE-2026-13243 | drupal/salesforce | The Salesforce Suite of modules integrates Drupal with Salesforce. The Salesforce module does not properly validate the | unknown | 0.0 | 0% |
| CVE-2026-8203 | concrete5/concrete5 | Concrete CMS has Stored XSS through its height parameter | high | 0.0 | 0% |
| CVE-2026-8417 | concrete5/concrete5 | Concrete does not validate a CSRF token before processing requests to `/dashboard/extend/update/do_update/<pkgHandle>` | high | 0.0 | 0% |
| CVE-2026-107262 | drupal/advanced_filesystem | Advanced File System turns Drupal's file storage into a manageable, observable and maintainable subsystem. The Advanced | unknown | 0.0 | 0% |
| CVE-2026-59947 | composer/composer | Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure) | medium | 4.7 | 0% |
| CVE-2026-47696 | wwbn/avideo | WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint | medium | 4.3 | 0% |
| CVE-2026-118558 | drupal/commerce_stripe | This module enables you to use the Stripe Connect API to quickly configure your Drupal Commerce store to take payments v | unknown | 0.0 | 0% |
| CVE-2026-8140 | concrete5/concrete5 | Concrete CMS is Vulnerable to Cross-Site Request Forgery | high | 0.0 | 0% |
| CVE-2026-41663 | admidio/admidio | Admidio has CSRF on Admin Preferences that Triggers Unauthorized Backup, .htaccess Write, and Email Send | low | 3.5 | 0% |
| CVE-2026-96375 | drupal/cloud | The Cloud module enables users to manage cloud infrastructure through Drupal. The Kubernetes and VMware integrations do | unknown | 0.0 | 0% |
| CVE-2026-7882 | concrete5/concrete5 | Concrete CMS is vulnerable to unauthorized file deletion | low | 0.0 | 0% |
| CVE-2026-96388 | drupal/tawk_to | This module provides integration of the tawk.to live chat for Drupal sites. The module does not sufficiently validate c | unknown | 0.0 | 0% |
| CVE-2026-40928 | wwbn/avideo | WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset | medium | 5.4 | 0% |
| CVE-2026-107848 | contao/core-bundle | Contao: Cross-site request forgery in custom backend actions | low | 3.5 | 0% |
| CVE-2026-8435 | concrete5/concrete5 | Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion() | low | 0.0 | 0% |
| CVE-2026-114541 | drupal/frontend_editing | This module enables editors to edit content, including paragraphs, directly on the rendered page. The module doesn't su | unknown | 0.0 | 0% |
| CVE-2026-40929 | wwbn/avideo | WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creato | medium | 5.4 | 0% |
| CVE-2026-119193 | phpunit/phpunit | PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling | medium | 0.0 | 0% |
| CVE-2026-4393 | drupal/autologout | This module provides a site administrator the ability to log users out after a specified time of inactivity. The module | unknown | 0.0 | 0% |
| CVE-2026-45610 | wwbn/avideo | AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA | medium | 5.7 | 0% |