Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| GHSA-8h4m-r4wm-xj7r | typo3/cms | TYPO3 Arbitrary Code Execution via File List Module | high | 8.8 | – |
| GHSA-9v82-vcjx-m76j | shopware/core, shopware/shopware | Shopware: Reflective Cross Site-Scripting (XSS) in CMS components | high | 8.8 | – |
| GHSA-cxf7-m5g2-v594 | zendframework/zend-mail | Zend-Mail remote code execution in zend-mail via Sendmail adapter | high | 8.8 | – |
| GHSA-f9hr-7cfq-mjg2 | typo3/cms-core | TYPO3 Arbitrary Code Execution via File List Module | high | 8.8 | – |
| GHSA-g3hq-hphg-8fhh | pheditor/pheditor | Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixe | high | 8.8 | – |
| GHSA-h4hf-v6w5-897x | poweradmin/poweradmin | Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account | high | 8.8 | – |
| GHSA-hq76-662x-7mw4 | pimcore/admin-ui-classic-bundle, pimcore/data-importer, pimcore/pimcore | Pimcore includes vulnerable PHPOffice/PhpSpreadsheet | high | 8.8 | – |
| GHSA-vcg6-8fxc-x5cq | silverstripe/framework | silverstripe/framework allows upload of dangerous file types | high | 8.8 | – |
| GHSA-x2f4-8wxf-w3vf | zendframework/zendframework | ZendFramework SQL injection due to execution of platform-specific SQL containing interpolations | high | 8.8 | – |
| GHSA-x428-565f-8xj2 | typo3/cms-core | TYPO3 Arbitrary Code Execution and Cross-Site Scripting in Backend API | high | 8.8 | – |
| GHSA-xc69-p8fc-m6m5 | silverstripe/subsites | silverstripe/subsites Unsafe SQL Query Construction (Safe Data Source) | high | 8.8 | – |
| GHSA-xx4r-5265-48j6 | silverstripe/framework | silverstripe/framework SQL injection in full text search | high | 8.8 | – |
| CVE-2026-49259 | nukeviet/nukeviet | NukeViet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | high | 8.7 | – |
| CVE-2026-54064 | nukeviet/nukeviet | NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module | high | 8.7 | – |
| CVE-2026-54065 | nukeviet/nukeviet | NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function | high | 8.7 | – |
| GHSA-229x-22xc-2f2w | zendframework/zendframework1 | Zendframework Local file disclosure via XXE injection in Zend_XmlRpc | high | 8.6 | – |
| GHSA-fm29-4mq3-phg6 | winter/wn-backend-module | Winter: ImportExportController AJAX handlers bypass granular import/export permission gate | high | 8.3 | – |
| CVE-2026-48118 | nukeviet/nukeviet | NukeViet: Unauthenticated Reflected XSS in Comment Module | high | 8.2 | – |
| CVE-2026-96631 | adminneo-org/adminneo | AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers | high | 8.2 | – |
| GHSA-82vp-jr39-4j2j | typo3/cms-core | TYPO3 Security Misconfiguration in Frontend Session Handling | high | 8.2 | – |
| GHSA-c85w-x26q-ch87 | getformwork/formwork | Formwork improperly validates input of User role preventing site and panel availability | high | 8.2 | – |
| GHSA-fmg6-246m-9g2v | auth0/login | Auth0 laravel-auth0 SDK has Insufficient Entropy in Cookie Encryption | high | 8.2 | – |
| GHSA-ghc5-95c2-vwcv | auth0/symfony | Auth0 Symfony SDK has Insufficient Entropy in Cookie Encryption | high | 8.2 | – |
| GHSA-vfpx-q664-h93m | auth0/wordpress | Auth0 WordPress Plugin has Insufficient Entropy in Cookie Encryption | high | 8.2 | – |
| GHSA-w8gf-g2vq-j2f4 | amphp/http-client | amphp/http-client Denial of Service via HTTP/2 CONTINUATION Frames | high | 8.2 | – |
| CVE-2014-6072 | symfony/symfony, symfony/web-profiler-bundle | Symfony Cross-Site Request Forgery vulnerability in the Web Profiler | high | 8.1 | – |
| CVE-2026-96633 | adminneo-org/adminneo | AdminNeo SQLite Database-List Drop Arbitrary File Deletion | high | 8.1 | – |
| GHSA-45xg-4w5x-j429 | typo3/cms | TYPO3 Arbitrary Shell Execution in Swiftmailer library | high | 8.1 | – |
| GHSA-5h5v-m596-r6rf | typo3/cms-core | TYPO3 Possible Insecure Deserialization in Extbase Request Handling | high | 8.1 | – |
| GHSA-76w8-mqx4-wjrf | doctrine/dbal | Doctrine DBAL SQL injection possibility | high | 8.1 | – |
| GHSA-77mv-mp2j-gxxh | 3f/pygmentize | pygmentize Remote Code Execution | high | 8.1 | – |
| GHSA-98h9-727m-44qv | drupal/core | Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar | high | 8.1 | – |
| GHSA-cmwh-g2h8-c222 | poweradmin/poweradmin | Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover | high | 8.1 | – |
| GHSA-cv5c-2qv5-w2m2 | passbolt/passbolt_api | Passbolt Api Remote code execution | high | 8.1 | – |
| GHSA-f777-f784-36gm | typo3/cms | TYPO3 Security Misconfiguration in Install Tool Cookie | high | 8.1 | – |
| GHSA-hh95-5xm5-v8v7 | typo3/cms | TYPO3 CMS Possible Insecure Deserialization in Extbase Request Handling | high | 8.1 | – |
| GHSA-m9fv-whq2-6wmc | drupal/drupal | Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar | high | 8.1 | – |
| GHSA-rm67-g9ch-vxff | poweradmin/poweradmin | Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own | high | 8.1 | – |
| CVE-2026-45263 | facturascripts/facturascripts | FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens th | high | 8.0 | – |
| GHSA-mqjc-x563-c9q8 | silverstripe/framework | silverstripe/framework CSV Excel Macro Injection | high | 8.0 | – |
| GHSA-gxxj-g9v8-w28p | drupal/core | Drupal core Arbitrary PHP code execution | high | 7.8 | – |
| GHSA-j66p-fvp2-fxhj | drupal/drupal | Drupal core Arbitrary PHP code execution | high | 7.8 | – |
| GHSA-mh6w-vxff-9wqp | phpunit/phpunit | PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes | high | 7.8 | – |
| CVE-2014-4931 | symfony/framework-bundle, symfony/symfony | Code injection in the way Symfony implements translation caching in FrameworkBundle | high | 7.5 | – |
| CVE-2014-5244 | symfony/http-foundation, symfony/symfony | Symfony vulnerable to denial of service via a malicious HTTP Host header | high | 7.5 | – |
| CVE-2014-5245 | symfony/http-kernel, symfony/symfony | Symfony allows direct access of ESI URLs behind a trusted proxy | high | 7.5 | – |
| CVE-2026-45693 | facturascripts/facturascripts | FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads Private MyFiles Documents | high | 7.5 | – |
| GHSA-2g98-f9jv-w8c5 | robrichards/xmlseclibs | robrichards/xmlseclibs XPath injection | high | 7.5 | – |
| GHSA-2jx7-xg83-j2m7 | zendframework/zendframework1 | Zendframework Denial of Service vector via XEE injection | high | 7.5 | – |
| GHSA-3c5g-73f7-grvm | neos/neos | Neos Information Disclosure Security Note | high | 7.5 | – |