Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2016-20054 | khodakhah/nodcms | Nodcms contains a cross-site request forgery vulnerability | medium | 4.3 | 0% |
| CVE-2026-27964 | facturascripts/facturascripts | FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation | low | 3.9 | 0% |
| CVE-2026-8340 | concrete5/concrete5 | Concrete CMS is vulnerable to CSRF via Backend\File::approveVersion | low | 0.0 | 0% |
| CVE-2026-3211 | drupal/theme_rule | This module allows site builders to create so-called "theme\_rule" config entities. These theme rules can render pages w | unknown | 0.0 | 0% |
| CVE-2026-96374 | drupal/project_browser | The Project Browser module enables you to apply recipes and enable modules from the web user interface. The module does | unknown | 0.0 | 0% |
| CVE-2026-55745 | cotonti/cotonti | Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) module | medium | 5.4 | 0% |
| GHSA-27qr-636m-wxg2 | codeigniter/framework | codeigniter/framework SQL injection in ODBC database driver | critical | 10.0 | – |
| GHSA-97m3-52wr-xvv2 | phenx/php-svg-lib | Dompdf's usage of vulnerable version of phenx/php-svg-lib leads to restriction bypass and potential RCE | critical | 10.0 | – |
| GHSA-f25v-x6vr-962g | pheditor/pheditor | Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password | critical | 10.0 | – |
| GHSA-m58q-qq5h-mgqq | islandora/islandora | Islandora 2.0 before 2.4.1 could allow any user to upload content into a repository | critical | 10.0 | – |
| CVE-2026-45262 | facturascripts/facturascripts | FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn` | critical | 9.9 | – |
| CVE-2026-77526 | facturascripts/facturascripts | FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE | critical | 9.9 | – |
| GHSA-67wg-6j7r-mqh8 | typo3/cms | Arbitrary Code Execution in TYPO3 CMS | critical | 9.9 | – |
| GHSA-qm5c-m76r-2hfr | laravel/framework | Laravel RCE vulnerability in "cookie" session driver | critical | 9.9 | – |
| CVE-2019-9081 | laravel/framework | Laravel Framework Deserialization Vulnerability | critical | 9.8 | – |
| CVE-2022-50807 | concrete5/concrete5 | Concrete5 CMS contains an XPath injection vulnerability | critical | 9.8 | – |
| GHSA-2x36-qhx3-7m5f | zendframework/zendframework1 | ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select | critical | 9.8 | – |
| GHSA-6fqw-j3vm-7f66 | zendframework/zendframework1 | Zendframework1 Potential SQL injection in ORDER and GROUP functions | critical | 9.8 | – |
| GHSA-7336-ghhp-f2qj | shopware/shopware | Shopware Remote Code Execution Vulnerability | critical | 9.8 | – |
| GHSA-7g7c-qhf3-x59p | propel/propel1 | propel/propel1 SQL injection possible with limit() on MySQL | critical | 9.8 | – |
| GHSA-7vw7-qx38-37vr | propel/propel | Propel2 SQL injection possible with limit() on MySQL | critical | 9.8 | – |
| GHSA-83jv-4prm-34g7 | shopware/shopware | Shopware Remote Code Execution Vulnerability | critical | 9.8 | – |
| GHSA-8x2v-pcg7-94f4 | zendframework/zend-json | Zend-JSON vulnerable to XXE/XEE attacks | critical | 9.8 | – |
| GHSA-cc97-g92w-jm65 | typo3/cms-core | TYPO3 CMS Insecure Deserialization & Arbitrary Code Execution | critical | 9.8 | – |
| GHSA-f4fj-q6m4-cc52 | zendframework/zend-xmlrpc | ZendFramework vulnerable to XXE/XEE attacks | critical | 9.8 | – |
| GHSA-j68w-pg49-f6vx | symfony/serializer | Symfony XML decoding attack vector through external entities | critical | 9.8 | – |
| GHSA-mhpx-3rv8-wrjm | zendframework/zendframework1 | ZendFramework potential XML eXternal Entity injection vectors | critical | 9.8 | – |
| GHSA-mmcv-fvq8-r9x3 | symfony/symfony | Symfony XML decoding attack vector through external entities | critical | 9.8 | – |
| GHSA-q3g4-2vw9-xv27 | shopware/shopware | Shopware Remote Code Execution Vulnerability | critical | 9.8 | – |
| GHSA-q3jm-v27q-jfww | titon/framework | titon/framework vulnerable to Remote Code Execution via Chosen-Ciphertext Attack | critical | 9.8 | – |
| GHSA-qc7w-4567-84wv | zendframework/zendframework | Zendframework vulnerable to XXE/XEE attacks | critical | 9.8 | – |
| GHSA-qf36-fx9f-232x | zendframework/zendframework1 | ZendFramework potential SQL Injection Vector When Using PDO_MySql | critical | 9.8 | – |
| GHSA-v3mr-gp7j-pw5w | terminal42/contao-tablelookupwizard | Possible SQL injection in tablelookupwizard Contao Extension | critical | 9.8 | – |
| GHSA-v42g-7q2x-cw32 | zendframework/zendframework1 | Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite) | critical | 9.8 | – |
| GHSA-x86x-qhf8-f37w | willdurand/js-translation-bundle | willdurand/js-translation-bundle potential path traversal attack and remote code injection | critical | 9.8 | – |
| GHSA-gr3r-crp5-qrrm | intercom/intercom-php | Compromised tag of intercom-php published via GitHub | critical | 9.3 | – |
| GHSA-2f4r-34m4-3w8q | auth0/wordpress | Auth0 Wordpress plugin Vulnerable to Brute Force Authentication Tags of CookieStore Sessions | critical | 9.1 | – |
| GHSA-346h-749j-r28w | mdanter/ecc | PHPECC vulnerable to multiple cryptographic side-channel attacks | critical | 9.1 | – |
| GHSA-8v6m-7f5v-hhx6 | silverstripe/framework | Silverstripe Brute force bypass on default admin | critical | 9.1 | – |
| GHSA-9fwj-9mjf-rhj3 | auth0/login | laravel-auth0 SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions | critical | 9.1 | – |
| GHSA-9wg9-93h9-j8ch | auth0/symfony | Auth0 Symfony SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions | critical | 9.1 | – |
| GHSA-gwfx-p7mr-f92v | typo3/cms | Missing Access Check in TYPO3 CMS | critical | 9.0 | – |
| GHSA-wxxw-5gq6-j2g5 | contao/core | contao/core Insufficient input validation allows for code injection and remote execution | critical | 9.0 | – |
| GHSA-2m5g-8xpw-42vp | cartalyst/sentry | OpenCFP Framework (Sentry) Account takeover via null password reset codes | high | 8.9 | – |
| CVE-2021-47853 | phppgadmin/phppgadmin | phpPgAdmin contains a remote command execution vulnerability | high | 8.8 | – |
| CVE-2026-76913 | notrinos/notrinos-erp | NotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM employee "Documents" (doc_file) | high | 8.8 | – |
| GHSA-265q-222x-52m6 | silverstripe/framework | silverstripe/framework has potential SQL Injection vulnerability in PostgreSQL database connector | high | 8.8 | – |
| GHSA-49xw-hw94-fmv2 | dolibarr/dolibarr | Dolibarr has Remote Code Execution Vulnerability (Bypass) | high | 8.8 | – |
| GHSA-4r76-xr68-w7m7 | typo3/cms | TYPO3 may allow editors to change, create, or delete metadata of files not within their file mounts | high | 8.8 | – |
| GHSA-7qwg-fcpw-xg5g | typo3/cms | Privilege Escalation & SQL Injection in TYPO3 CMS | high | 8.8 | – |