Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| GHSA-vq4j-qcx7-ppc6 | thelia/thelia | Thelia Cross-site Scripting vulnerability in BackOffice | medium | 6.1 | – |
| GHSA-vvm3-rv48-j3g5 | zendframework/zendframework1 | Zendframework Potential XSS or HTML Injection vector in Zend_Json | medium | 6.1 | – |
| GHSA-wg8h-gxf4-g4gh | typo3/cms-core | TYPO3 Cross-Site Scripting in Online Media Asset Rendering | medium | 6.1 | – |
| GHSA-ww6p-q26w-fr6m | phpxmlrpc/extras | phpxmlrpc/extra XSS in class documenting_xmlrpc_server | medium | 6.1 | – |
| GHSA-xgmx-j3hv-jh9x | typo3/cms | TYPO3 Cross-Site Scripting in Link Handling | medium | 6.1 | – |
| GHSA-7v3x-h7r2-34jv | pterodactyl/panel | Insufficient Session Expiration in Pterodactyl API | medium | 6.0 | – |
| GHSA-hx53-jchx-cr52 | symfony/symfony | Symfony2 improper IP based access control | medium | 5.9 | – |
| GHSA-mg7h-9qfx-4r83 | zendframework/zendframework | ZendFramework Potential Proxy Injection Vulnerabilities | medium | 5.9 | – |
| GHSA-ppm4-r2vc-pg74 | simplesamlphp/simplesamlphp | SimpleSAMLphp Information Disclosure vulnerability | medium | 5.9 | – |
| GHSA-wwgf-3xp7-cxj4 | gos/web-socket-bundle | Potentially sensitive data exposure in Symfony Web Socket Bundle | medium | 5.9 | – |
| GHSA-gfvf-2f25-f34r | drupal/core | Drupal Anonymous Open Redirect | medium | 5.8 | – |
| GHSA-vp8p-c6xj-xpj7 | silverstripe/framework | Silverstripe External redirection risk in Security?ReturnURL | medium | 5.8 | – |
| GHSA-x6v2-xmrq-574j | drupal/drupal | Drupal Anonymous Open Redirect | medium | 5.8 | – |
| GHSA-8xv9-qcr9-ww9j | shopware/core, shopware/platform | Authenticated XML External Entity Processing | medium | 5.6 | – |
| CVE-2025-30083 | codingms/additional-tca | Additional TCA Allows Cross-Site Scripting (XSS) | medium | 5.5 | – |
| GHSA-qm5v-pj64-852j | passbolt/passbolt_api | Passbolt Api Tabnabbing when opening URI with menu "Open URI in a new tab" | medium | 5.5 | – |
| GHSA-2rcw-9hrm-8q7q | typo3/cms | TYPO3 Cross-Site Scripting in Frontend User Login | medium | 5.4 | – |
| GHSA-4q66-g4mm-8rg5 | silverstripe/admin | Silverstripe has Cross-site Scripting (XSS) vulnerabilities inherited from TinyMCE | medium | 5.4 | – |
| GHSA-52cw-pvq9-9m5v | silverstripe/framework | Silverstripe uses TinyMCE which allows svg files linked in object tags | medium | 5.4 | – |
| GHSA-6xh8-8pfv-53vx | typo3/cms | Authentication Bypass in TYPO3 CMS | medium | 5.4 | – |
| GHSA-7q33-hxwj-7p8v | typo3/cms | TYPO3 Cross-Site Scripting in Backend Modal Component | medium | 5.4 | – |
| GHSA-8m6j-p5jv-v69w | typo3/cms | TYPO3 Cross-Site Scripting in Online Media Asset Rendering | medium | 5.4 | – |
| GHSA-gc5h-6jx9-q2qh | ezsystems/ezplatform-admin-ui | eZ Platform Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget | medium | 5.4 | – |
| GHSA-gp6m-fq6h-cjcx | openmage/magento-lts | Magento LTS vulnerable to stored XSS in admin file form | medium | 5.4 | – |
| GHSA-j86x-pjmr-9m6w | typo3/cms | SQL Injection in TYPO3 Frontend Login | medium | 5.4 | – |
| GHSA-mh3r-6cp5-hc2j | typo3/cms | Authentication Bypass in TYPO3 Frontend | medium | 5.4 | – |
| GHSA-qrfh-cc86-vc8c | leantime/leantime | Leantime has HTML injection through firstname and lastname fields | medium | 5.4 | – |
| GHSA-r3fg-3r88-6x3f | ibexa/user | Ibexa User Settings are accessible on the front-end for anonymous user | medium | 5.4 | – |
| GHSA-r9vp-fp72-xgf7 | silverstripe/framework | silverstripe/framework's `Member.Name` is not escaped | medium | 5.4 | – |
| GHSA-rv8r-8mh5-5376 | typo3/cms-core | TYPO3 Information Disclosure in Backend User Interface | medium | 5.4 | – |
| GHSA-v4qr-8h2v-qpjx | typo3/cms | Cross-Site Scripting in TYPO3 CMS Backend | medium | 5.4 | – |
| GHSA-v858-922f-fj9v | simplesamlphp/simplesamlphp | SimpleSAMLphp Link Injection vulnerability | medium | 5.4 | – |
| GHSA-vj2j-6g3w-4662 | silverstripe/framework | Silverstripe Missing CSRF protection in login form | medium | 5.4 | – |
| GHSA-wp8j-c736-c5r3 | typo3/cms | TYPO3 Cross-Site Scripting Vulnerability Exploitable by Editors | medium | 5.4 | – |
| GHSA-wqm8-jx8r-8rcq | silverstripe/admin | Cross-site scripting vulnerabilities in old version of bundled TinyMCE | medium | 5.4 | – |
| CVE-2014-6061 | symfony/http-foundation, symfony/symfony | Symfony has a security issue when parsing the Authorization header | medium | 5.3 | – |
| CVE-2015-2309 | symfony/http-foundation, symfony/symfony | Symfony has unsafe methods in the Request class | medium | 5.3 | – |
| GHSA-256q-hx8w-xcqx | silverstripe/framework | Silverstripe Framework user enumeration via timing attack on login and password reset forms | medium | 5.3 | – |
| GHSA-29m4-mx89-3mjg | typo3/cms-core | TYPO3 Denial of Service in Online Media Asset Handling | medium | 5.3 | – |
| GHSA-2fhr-8r8r-qp56 | zendframework/zendframework | ZendFramework Information Disclosure and Insufficient Entropy vulnerability | medium | 5.3 | – |
| GHSA-2wwr-9x6f-88gp | easycorp/easyadmin-bundle | EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components | medium | 5.3 | – |
| GHSA-6487-3qvg-8px9 | typo3/cms | TYPO3 Information Disclosure in Install Tool | medium | 5.3 | – |
| GHSA-66c2-7g4p-wx4p | typo3/cms-core | TYPO3 Information Disclosure in Install Tool | medium | 5.3 | – |
| GHSA-6pq8-67pw-j6hw | neos/flow | Time-Based Information Disclosure Vulnerability in Flow | medium | 5.3 | – |
| GHSA-6v6p-g8cg-2hgg | ezsystems/ezplatform-admin-ui | Improper Certificate Validation in node-sass affects eZ Platform | medium | 5.3 | – |
| GHSA-7cvr-xhm5-x998 | twig/twig | Twig Path Traversal vulnerability in the filesystem loader | medium | 5.3 | – |
| GHSA-7mc6-x925-7qvx | microsoft/microsoft-graph-beta | Test code in published microsoft-graph-beta package exposes phpinfo() | medium | 5.3 | – |
| GHSA-7wh8-jrq7-p27f | simplesamlphp/simplesamlphp | SimpleSAMLphp exposes credentials in session storage | medium | 5.3 | – |
| GHSA-8grv-jq2g-cfhw | amphp/http-server | amphp/http-server affected by HTTP/2 DDoS vulnerability | medium | 5.3 | – |
| GHSA-9jxr-mwpp-w643 | httpsoft/http-message | Improper header validation in httpsoft/http-message | medium | 5.3 | – |