Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-38739 | ezsystems/ezpublish-legacy | ezsystems/ezpublish-legacy has a SQL injection in dfscleanup | high | 7.1 | – |
| GHSA-32rx-xvvr-4xv9 | alterphp/easyadmin-extension-bundle | easyadmin-extension-bundle action case insensitivity | high | 7.1 | – |
| GHSA-6mp4-q625-mxjp | yourls/yourls | YOURLS is vulnerable to XSS through JSONP and Callback request parameters | high | 7.1 | – |
| GHSA-gxxh-8vcj-w2mh | mckenziearts/livewire-markdown-editor | livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handler | high | 7.1 | – |
| GHSA-r9vc-jfmh-6j48 | typo3/cms | TYPO3 frontend login vulnerable to Session Fixation | high | 7.1 | – |
| GHSA-rv3r-vqjj-8c76 | getkirby/cms | Cross-site scripting from content entered in the tags and multiselect fields | high | 7.1 | – |
| GHSA-6f85-3f8q-qc94 | oro/commerce | OroCommerce vulnerable to XSS when adding class name to Selector Manager on pages that use GrapeJS editor | medium | 6.9 | – |
| GHSA-rrgw-3hg3-9x8c | oro/platform | XSS vulnerability in translations | medium | 6.9 | – |
| CVE-2026-40500 | processwire/processwire | ProcessWire: server-side request forgery vulnerability in the admin panel's 'Add Module From URL' feature | medium | 6.8 | – |
| CVE-2026-96629 | adminneo-org/adminneo | AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery | medium | 6.8 | – |
| GHSA-7hh9-gp72-wh7h | auth0/login | Auth0 Laravel SDK has Improper Audience Validation via Auth0-PHP SDK dependency | medium | 6.8 | – |
| GHSA-f3r2-88mq-9v4g | auth0/symfony | Auth0 Symfony SDK has Improper Audience Validation via Auth0-PHP SDK | medium | 6.8 | – |
| GHSA-vvg7-8rmq-92g7 | auth0/wordpress | Auth0 WordPress has Improper Audience Validation via Auth0-PHP SDK Dependency | medium | 6.8 | – |
| GHSA-7rhv-h82h-vpjh | ec-cube/ec-cube | EC-CUBE has a Vulnerability that Allows MFA Bypass in the Administrative Interface | medium | 6.7 | – |
| GHSA-7gwj-7fhm-vw4w | drupal/core | Drupal core unrestricted file upload | medium | 6.6 | – |
| CVE-2024-30173 | causal/oidc | OpenID Connect Authentication (oidc) Typo3 extension Authentication Bypass | medium | 6.5 | – |
| CVE-2026-45016 | egroupware/egroupware | EGroupware Vulnerable to Local File Inclusion via file:// URI in Mail Compose | medium | 6.5 | – |
| GHSA-534c-hcr7-67jg | kimai/kimai | Kimai has an XXE Leading to Local File Read | medium | 6.5 | – |
| GHSA-55qg-6c4m-mw6g | silverstripe/framework | silverstripe/framework's URL parameters `isDev` and `isTest` unguarded | medium | 6.5 | – |
| GHSA-5gr6-97fv-52cc | typo3/cms | Cross-Site Scripting in TYPO3 CMS | medium | 6.5 | – |
| GHSA-62f6-h68r-3jpw | zendframework/zendframework | Zendframework session validation vulnerability | medium | 6.5 | – |
| GHSA-65v7-wg35-2qpm | sylius/resource-bundle | Sylius Resource Bundle Cross-Site Request Forgery vulnerability | medium | 6.5 | – |
| GHSA-772m-43f3-hmf8 | typo3/cms | TYPO3 Broken Access Control in Localization Handling | medium | 6.5 | – |
| GHSA-7mx2-7q8p-pgmw | symfony/symfony | Symfony may allow a user to switch to using another user's identity | medium | 6.5 | – |
| GHSA-7v7m-pcw5-h3cg | pusher/pusher-php-server | Pusher Service Channel Authentication Bypass | medium | 6.5 | – |
| GHSA-87pf-7x99-5xc4 | silverstripe/framework | Silverstripe Hostname, IP and Protocol Spoofing through HTTP Headers | medium | 6.5 | – |
| GHSA-945h-6vcv-pc8h | sylius/admin-bundle | Sylius Admin Bundle Cross-Site Request Forgery vulnerability | medium | 6.5 | – |
| GHSA-96c6-m98x-hxjx | zendframework/zend-session | Zend-Session session validation vulnerability | medium | 6.5 | – |
| GHSA-99r5-84gr-59f6 | leantime/leantime | Leantime has Host Header Injection Vulnerability | medium | 6.5 | – |
| GHSA-9rx9-7fmh-gj3g | typo3/cms-core | TYPO3 Broken Access Control in Localization Handling | medium | 6.5 | – |
| GHSA-9wv8-3h8h-x2wc | doctrine/doctrine-module | doctrine/doctrine-module zero-valued authentication credentials vulnerability | medium | 6.5 | – |
| GHSA-f3wf-q4fj-3gxf | typo3/cms | TYPO3 Denial of Service in Online Media Asset Handling | medium | 6.5 | – |
| GHSA-g4hp-pfvf-vm5w | silverstripe/framework | SilverStripe Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validation | medium | 6.5 | – |
| GHSA-gff2-p6vm-3p8g | zendframework/zendframework | ZendFramework potential remote code execution in zend-mail via Sendmail adapter | medium | 6.5 | – |
| GHSA-jqr8-q455-xx45 | typo3/cms | TYPO3 Brute Force Protection Bypass in backend login | medium | 6.5 | – |
| GHSA-m2hh-2m46-x6j5 | silverstripe/framework | silverstripe/framework may disclose database credentials during connection failure | medium | 6.5 | – |
| GHSA-mhf7-xp6r-6qrc | livewire/livewire | Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order | medium | 6.5 | – |
| GHSA-ph62-fv59-vf9h | silverstripe/framework | silverstripe/framework users inadvertently passing sensitive data to LoginAttempt | medium | 6.5 | – |
| GHSA-r287-hc8j-w56h | typo3/cms | TYPO3 Information Disclosure Vulnerability Exploitable by Editors | medium | 6.5 | – |
| GHSA-r3pr-fh25-wrfc | silverstripe/framework | silverstripe/framework's install.php script discloses sensitive data by pre-populating DB credential forms | medium | 6.5 | – |
| GHSA-v5jp-4h2p-j2p4 | typo3/cms | Privilege Escalation in TYPO3 CMS | medium | 6.5 | – |
| GHSA-x5w2-wcr8-9q45 | silverstripe/framework | Silverstripe Missing security check on dev/build/defaults | medium | 6.5 | – |
| GHSA-xg43-5579-qw6v | adawolfa/isdoc | adawolfa/isdoc: Uncontrolled resource consumption (decompression bomb) when reading untrusted ISDOCX or PDF files | medium | 6.5 | – |
| GHSA-xmgr-jff3-fcfv | typo3/cms-core | TYPO3 Security Misconfiguration in User Session Handling | medium | 6.5 | – |
| GHSA-xpff-c35g-j3cr | silverstripe/framework | silverstripe/framework Privilege Escalation Risk in Member Edit form | medium | 6.5 | – |
| GHSA-8q6q-m837-fv64 | phanan/koel | Koel has SSRF through Authenticated Subsonic podcast feed URLs | medium | 6.4 | – |
| CVE-2025-30081 | clickstorm/cs-seo | Clickstorm SEO Allows Cross-Site Scripting (XSS) | medium | 6.3 | – |
| GHSA-cvpc-hccg-wmw4 | verbb/formie | Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration | medium | 6.3 | – |
| GHSA-xvcp-33rc-j8gq | typo3/cms | Insecure Unserialize in TYPO3 Import/Export | medium | 6.3 | – |
| GHSA-22q7-cg4r-p9mx | typo3/cms-fluid | TYPO3 Cross-Site Scripting in Fluid ViewHelpers | medium | 6.1 | – |