Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| GHSA-3mm9-2p44-rw39 | silverstripe/cms | Silverstripe SiteTree Creation Permission Vulnerability | high | 7.5 | – |
| GHSA-3x57-m5p4-rgh4 | zendframework/zendopenid | ZendOpenID potential security issue in login mechanism | high | 7.5 | – |
| GHSA-45wj-jv2h-jwrf | typo3/cms-core | TYPO3 CMS Privilege Escalation and SQL Injection | high | 7.5 | – |
| GHSA-4j9x-g4x8-vcmf | zendframework/zendframework1 | ZendFramework potential XML eXternal Entity injection vectors | high | 7.5 | – |
| GHSA-4qx8-j9vh-2628 | silverstripe/framework | silverstripe/framework's User-Agent header not correctly invalidating user session | high | 7.5 | – |
| GHSA-4vf2-qfg3-7598 | symfony/validator | symfony/validator XML Entity Expansion vulnerability | high | 7.5 | – |
| GHSA-5jfw-35xp-5m42 | pocketmine/bedrock-protocol | Buffer length underflow in LoginPacket causing unchecked exceptions to be thrown | high | 7.5 | – |
| GHSA-6v7p-5qcq-268c | zendframework/zend-navigation | Zend-Navigation vulnerable to Cross-site Scripting | high | 7.5 | – |
| GHSA-848f-mph5-9pm9 | zendframework/zendframework1 | Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability | high | 7.5 | – |
| GHSA-8xhv-gqm4-3w99 | zendframework/zendframework1 | ZendFramework1 Potential Insufficient Entropy Vulnerability | high | 7.5 | – |
| GHSA-96jg-pmc4-cx39 | typo3/cms-core | TYPO3 CMS Insecure Deserialization | high | 7.5 | – |
| GHSA-97h7-mf38-g9mf | vrana/adminer | Adminer file disclosure vulnerability | high | 7.5 | – |
| GHSA-9j5w-2cqc-cwj9 | openmage/magento-lts | Magento LTS vulnerable to Stored XSS via TinyMCE WYSIWYG Editor | high | 7.5 | – |
| GHSA-9v78-h226-2rmq | zendframework/zendframework1 | Zendframework potential security issue in login mechanism | high | 7.5 | – |
| GHSA-c636-cg5r-2498 | symfony/dependency-injection | Symfony XML Entity Expansion security vulnerability | high | 7.5 | – |
| GHSA-cg8w-5jrc-675g | zendframework/zend-http | Zend-HTTP URL Rewrite vulnerability | high | 7.5 | – |
| GHSA-cwgq-83w5-8jfq | silverstripe/framework | silverstripe/framework has possible denial of service attack vector when flushing | high | 7.5 | – |
| GHSA-f75p-x5vm-83qp | symfony/translation | symfony/translation XML Entity Expansion vulnerability | high | 7.5 | – |
| GHSA-fc86-6rv6-2jpm | webonyx/graphql-php | webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments | high | 7.5 | – |
| GHSA-g2gp-3wwq-f4ph | league/commonmark | league/commonmark: Denial of service via adjacent inline attribute blocks | high | 7.5 | – |
| GHSA-g585-crjf-vhwq | typo3/cms | TYPO3 Denial of Service in Frontend Record Registration | high | 7.5 | – |
| GHSA-g8pg-33v4-9r96 | thelia/thelia | Thelia authentication bypass vulnerability | high | 7.5 | – |
| GHSA-hjx5-v9xg-7h25 | typo3/cms-core | TYPO3 Denial of Service in Frontend Record Registration | high | 7.5 | – |
| GHSA-hx3m-959f-v849 | zendframework/zendframework1 | ZendFramework local file inclusion vector in `Zend_View::setScriptPath()` and `render()` | high | 7.5 | – |
| GHSA-jfm3-95jq-q3rf | league/commonmark | league/commonmark: Denial of service via duplicate footnote definitions | high | 7.5 | – |
| GHSA-jmmp-vh96-78rm | zendframework/zend-feed | Zend-Feed URL Rewrite vulnerability | high | 7.5 | – |
| GHSA-jq87-2wxp-8349 | zendframework/zendframework | ZendFramework Route Parameter Injection Via Query String in `Zend\Mvc` | high | 7.5 | – |
| GHSA-m5q3-mvcr-gc5m | silverstripe/framework | silverstripe/framework BackURL validation bypass with malformed URLs | high | 7.5 | – |
| GHSA-mg4x-prh7-g4mx | zendframework/zend-captcha | Zend-Captcha Information Disclosure and Insufficient Entropy vulnerability | high | 7.5 | – |
| GHSA-p2v5-xcqm-4fv6 | silverstripe/taxonomy | silverstripe/taxonomy SQL Injection vulnerability | high | 7.5 | – |
| GHSA-ppvg-hw62-6ph9 | typo3/cms-core | TYPO3 Security Misconfiguration in Install Tool Cookie | high | 7.5 | – |
| GHSA-q2gc-gg3x-7942 | symfony/symfony | Symfony XML Entity Expansion security vulnerability | high | 7.5 | – |
| GHSA-rcm4-jv5g-wccm | zfr/zfr-oauth2-server-module | zfr authentication adapter did not verify validity of tokens | high | 7.5 | – |
| GHSA-rjpm-qmq7-q85w | symfony/routing | Symfony XXE security vulnerability | high | 7.5 | – |
| GHSA-rxc9-f2x6-qh4w | typo3/cms-core | TYPO3 Security Misconfiguration for Backend User Accounts | high | 7.5 | – |
| GHSA-vgxh-x8jv-hmff | silverstripe/framework | silverstripe/framework code execution vulnerability | high | 7.5 | – |
| GHSA-x4rj-f7m6-42c3 | typo3/cms-core | TYPO3 CMS Authentication Bypass vulnerability | high | 7.5 | – |
| GHSA-xffp-6w68-4775 | zendframework/zendframework | Zendframework Remote Address Spoofing Vector in `Zend\Http\PhpEnvironment\RemoteAddress` | high | 7.5 | – |
| GHSA-9phw-7h96-q3rv | scheb/two-factor-bundle | scheb/two-factor-bundle bypass two-factor authentication with remember-me option | high | 7.4 | – |
| GHSA-gcfg-hmwx-wq5h | nategood/httpful | Httpful is Missing Certificate Validation | high | 7.4 | – |
| GHSA-h6mp-mc7g-mg49 | scheb/two-factor-bundle | scheb/two-factor-bundle bypass two-factor authentication with unverified JWT trusted device token | high | 7.4 | – |
| GHSA-xg9w-r469-m455 | zendframework/zendframework | ZendFramework Potential Information Disclosure and Insufficient Entropy vulnerabilities | high | 7.4 | – |
| GHSA-95m2-chm4-mq7m | netcarver/textile | PHP-Textile has persistent XSS vulnerability in image link handling | high | 7.3 | – |
| GHSA-c5mj-39cf-3pp5 | typo3/cms | TYPO3 Security Misconfiguration for Backend User Accounts | high | 7.3 | – |
| GHSA-wjg9-v8cf-f5q2 | silverstripe/graphql | silverstripe/graphql Cross-Site Request Forgery vulnerability | high | 7.3 | – |
| CVE-2026-55372 | nukeviet/nukeviet | NukeViet: Pre-authentication SSRF via X-Forwarded-Host | high | 7.2 | – |
| CVE-2026-96630 | adminneo-org/adminneo | AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass) | high | 7.2 | – |
| GHSA-25gq-jvx2-vg9x | silverstripe/framework | Silverstripe X-Forwarded-Host request hostname injection | high | 7.2 | – |
| GHSA-2f46-4xjm-73x5 | passbolt/passbolt_api | Passbolt API Stored XSS on first/last name during setup | high | 7.2 | – |
| GHSA-x7p5-p2c9-phvg | illuminate/database, laravel/framework | Unexpected database bindings | high | 7.2 | – |