Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| GHSA-34q6-xqxh-gq39 | silverstripe/framework | Silverstripe XSS In rewritten hash links | medium | 6.1 | – |
| GHSA-3vhm-q4w3-rw8q | oro/platform | OroPlatform Forced Redirect to External Website | medium | 6.1 | – |
| GHSA-4459-qrcc-vfcf | typo3/cms-core | TYPO3 Cross-Site Scripting in Form Framework | medium | 6.1 | – |
| GHSA-468j-6jrc-2rjx | silverstripe/framework | silverstripe/framework vulnerable to Cross-site Scripting In `OptionsetField` and `CheckboxSetField` | medium | 6.1 | – |
| GHSA-4h54-vwx9-3vr3 | silverstripe/framework | Silverstripe XSS In FormAction | medium | 6.1 | – |
| GHSA-4h5c-5g25-v7fh | typo3/cms | TYPO3 Cross-Site Scripting in Form Framework | medium | 6.1 | – |
| GHSA-4ppr-jw47-9qm5 | typo3/cms-core | TYPO3 Cross-Site Scripting in Link Handling | medium | 6.1 | – |
| GHSA-4v57-pwvf-x35j | zendframework/zendframework1 | Zendframework potential Cross-site Scripting vector in `Zend_Service_ReCaptcha_MailHide` | medium | 6.1 | – |
| GHSA-4vf6-mq7w-3hp6 | zendframework/zendframework1 | Zend_Filter_StripTags vulnerable to Cross-site Scripting when comments allowed | medium | 6.1 | – |
| GHSA-5f5v-5c3v-gw5v | silverstripe/framework | Silverstripe IE requests not properly behaving with rewritehashlinks | medium | 6.1 | – |
| GHSA-5gmf-3c43-q73v | zendframework/zendframework | ZendFramework vulnerable to Cross-site Scripting | medium | 6.1 | – |
| GHSA-6hh6-59j2-qrxw | silverstripe/cms | Silverstripe History XSS Vulnerability | medium | 6.1 | – |
| GHSA-6wqp-7g94-f69j | sensiolabs/connect | sensiolabs/connect has a Cross-Site Request Forgery Vulnerability | medium | 6.1 | – |
| GHSA-6xwf-7rfm-4gwc | typo3/cms-core | TYPO3 Cross-Site Scripting in Filelist Module | medium | 6.1 | – |
| GHSA-76r3-m635-p3vc | typo3/cms-core | TYPO3 Cross-Site Scripting in Language Pack Handling | medium | 6.1 | – |
| GHSA-85ch-44w7-rf32 | typo3/cms | TYPO3 Cross-Site Scripting in Fluid ViewHelpers | medium | 6.1 | – |
| GHSA-88jp-9jrv-6368 | silverstripe/framework | Silverstripe XSS In GridField print | medium | 6.1 | – |
| GHSA-8c25-vj2w-p72j | typo3/cms-core | TYPO3 Cross-Site Scripting in Frontend User Login | medium | 6.1 | – |
| GHSA-8q77-cv62-jj38 | zendframework/zendframework | Zendframework has potential Cross-site Scripting vector in multiple view helpers | medium | 6.1 | – |
| GHSA-95qm-3xp7-vfj5 | typo3/cms-core | TYPO3 Cross-Site Scripting in Form Framework validation handling | medium | 6.1 | – |
| GHSA-97jm-g33h-f46g | silverstripe/framework | silverstripe/framework ReadOnly transformation for formfields exploitable | medium | 6.1 | – |
| GHSA-g4c9-qfvw-fmr4 | typo3/cms-core | TYPO3 Cross-Site Scripting in Backend Modal Component | medium | 6.1 | – |
| GHSA-g52p-86j5-xr8q | zendframework/zendframework1 | ZendFramework Potential Cross-site Scripting in Development Environment Error View Script | medium | 6.1 | – |
| GHSA-g5vj-wj9x-4jg9 | symbiote/silverstripe-multivaluefield | symbiote/silverstripe-multivaluefield Possible PHP Object Injection via Multi-Value Field Extension | medium | 6.1 | – |
| GHSA-g6f5-4w43-2x63 | socalnick/scn-social-auth | ScnSocialAuth Cross-site Scripting vulnerability in login redirect param | medium | 6.1 | – |
| GHSA-g7hw-jh4p-75wr | typo3/cms | TYPO3 Cross-Site Scripting in Filelist Module | medium | 6.1 | – |
| GHSA-gqqf-g5r7-84vf | typo3/cms-core | TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection | medium | 6.1 | – |
| GHSA-gvpp-6jrj-5pqc | zendframework/zend-form | Zend-Form vulnerable to Cross-site Scripting | medium | 6.1 | – |
| GHSA-gwpm-pm6x-h7rj | zendframework/zendframework1 | ZendFramework Cross-site Scripting vector in `Zend_Filter_StripTags` | medium | 6.1 | – |
| GHSA-hg35-vqp3-fv39 | zendframework/zendframework1 | ZendFramework potential Cross-site Scripting vectors due to inconsistent encodings | medium | 6.1 | – |
| GHSA-hhvj-mcrx-3vcf | silverstripe/framework | silverstripe/framework has Cross-site Scripting vulnerability in page name | medium | 6.1 | – |
| GHSA-j543-vg33-g6vj | zendframework/zendframework1 | ZendFramework potential Cross-site Scripting vector in `Zend_Dojo_View_Helper_Editor` | medium | 6.1 | – |
| GHSA-j982-5jv7-v43r | silverstripe/framework | Silverstripe Form field validation message XSS vulnerability | medium | 6.1 | – |
| GHSA-jqp8-v74p-g8px | silverstripe/framework | Silverstripe XSS in Director::force_redirect() | medium | 6.1 | – |
| GHSA-jqr7-5h7r-ch8p | shopware/shopware | Shopware Non-Persistent XSS in the Frontend | medium | 6.1 | – |
| GHSA-m7hr-j867-3f34 | zendframework/zend-view | ZendFramework has potential Cross-site Scripting vector in multiple view helpers | medium | 6.1 | – |
| GHSA-m8v7-x398-pxrf | silverstripe/framework | Silverstripe XSS in CMS Edit Page | medium | 6.1 | – |
| GHSA-mpqj-f4v3-334h | silverstripe/framework | Silverstripe Cross-site scripting vulnerability in VersionedRequestFilter | medium | 6.1 | – |
| GHSA-mqf5-275h-gf6r | silverstripe/framework | Silverstripe framework is vulnerable to XSS in install.php | medium | 6.1 | – |
| GHSA-mxjf-hc9v-xgv2 | typo3/cms | ExtJS JavaScript framework used in TYPO3 vulnerable to Cross-site Scripting | medium | 6.1 | – |
| GHSA-p2ch-c2c3-4xm5 | winter/wn-backend-module | Winter: CSRF through AJAX handler names reachable as backend page actions | medium | 6.1 | – |
| GHSA-pp7q-6j3f-74vj | silverstripe/framework | silverstripe/framework has Cross-site Scripting vulnerability in RedirectorPage | medium | 6.1 | – |
| GHSA-pp7v-wxx9-hm6r | thelia/backoffice-default-template | Thelia BackOffice default template vulnerable to Cross-site Scripting | medium | 6.1 | – |
| GHSA-r32j-mr8p-hfp8 | silverstripe/framework | Silverstripe XSS in TreeDropdownField and TreeMultiSelectField | medium | 6.1 | – |
| GHSA-r85g-7jpv-8xrx | silverstripe/framework | silverstripe/framework has Cross-site Scripting vulnerability in CMSSecurity BackURL | medium | 6.1 | – |
| GHSA-r97r-64vp-fghm | silverstripe/cms | Silverstripe XSS vulnerability via VirtualPage | medium | 6.1 | – |
| GHSA-v8hp-239v-9367 | oro/crm | OroCRM Forced Redirect to External Website | medium | 6.1 | – |
| GHSA-v8m4-3w37-ghxx | typo3/cms | TYPO3 Cross-Site Scripting in Form Framework validation handling | medium | 6.1 | – |
| GHSA-vjwg-28gv-pm8h | pimcore/pimcore | Pimcore TinyMCE Bundle - tinymce CVE-2024-29203, CVE-2024-29881 | medium | 6.1 | – |
| GHSA-vpr3-cw3h-prw8 | simplesamlphp/simplesamlphp | SimpleSAMLphp Reflected Cross-site Scripting vulnerability | medium | 6.1 | – |