Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| GHSA-crr3-h4m8-7f56 | silverstripe/framework | silverstripe/framework vulnerable to member disclosure in login form | medium | 5.3 | – |
| GHSA-f624-8hfq-5fh3 | typo3/cms | TYPO3 Information Disclosure of Installed Extensions | medium | 5.3 | – |
| GHSA-g43w-98wp-m694 | silverstripe/framework | SilverStripe framework XML Quadratic Blowup Attack | medium | 5.3 | – |
| GHSA-g84q-cq55-xwgp | silverstripe/framework | silverstripe/framework member disclosure in login form | medium | 5.3 | – |
| GHSA-m895-2hj3-8cg9 | shopware/core, shopware/platform | Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually | medium | 5.3 | – |
| GHSA-mj63-m3rc-8ppr | league/commonmark | league/commonmark: Denial of service via deeply nested XML output | medium | 5.3 | – |
| GHSA-p2h4-7fp3-cmh8 | typo3/cms-core | TYPO3 Disclosure of Information about Installed Extensions | medium | 5.3 | – |
| GHSA-pqfv-97hj-g97g | typo3/cms | TYPO3 Frontend vulnerable to Unauthenticated Path Disclosure | medium | 5.3 | – |
| GHSA-pr99-c33p-fwf6 | drupal/core | Drupal core Denial of Service | medium | 5.3 | – |
| GHSA-pw2q-qwvj-gh43 | typo3/cms | Cache Flooding in TYPO3 Frontend | medium | 5.3 | – |
| GHSA-q8fc-v85f-78pw | stormpath/sdk | stormpath/sdk uses Insecure Random Number Generator | medium | 5.3 | – |
| GHSA-qg7m-mwxm-j3h7 | zendframework/zend-developer-tools | Zend-developer-tools information disclosure vulnerability | medium | 5.3 | – |
| GHSA-vfgc-c76h-mwh4 | drupal/core | Drupal core Cross-Site Scripting (XSS) vulnerabilities | medium | 5.3 | – |
| GHSA-vpr3-rc99-2wpr | typo3/cms | Information Disclosure in TYPO3 Backend | medium | 5.3 | – |
| GHSA-w333-5f96-mjrr | drupal/drupal | Drupal core Denial of Service | medium | 5.3 | – |
| GHSA-w8fq-xgvh-cxc2 | silverstripe/forum | Silverstripe Forum Module CSRF Vulnerability | medium | 5.3 | – |
| GHSA-w98g-5fmx-wm4x | pocketmine/raklib | pocketmine/raklib reliable-ordered queue size is unlimited, allowing a session to hog server memory | medium | 5.3 | – |
| GHSA-wj85-rg5g-v8jm | typo3/cms-core | TYPO3 Information Disclosure in User Authentication | medium | 5.3 | – |
| GHSA-wjfc-pgfp-pv9c | nyholm/psr7 | Improper Input Validation in nyholm/psr7 | medium | 5.3 | – |
| GHSA-2w46-vq8h-98vh | shopware/core | Shopware 6's password recovery link does not expire after email change | medium | 5.0 | – |
| GHSA-4cv2-xc5f-px8h | brotkrueml/codehighlight | Denial of Service in extension "Code Highlight" (codehighlight) | medium | 5.0 | – |
| GHSA-65xh-hh78-6454 | brotkrueml/codehighlight | Denial of Service in extension "Code Highlight" (codehighlight) | medium | 5.0 | – |
| GHSA-c7rj-92xr-wprg | typo3/cms | Insecure Unserialize in TYPO3 Backend | medium | 5.0 | – |
| GHSA-27c9-vp3w-6ww8 | shopware/core, shopware/platform | Shopware exposes sensitive user information via CSV export mapping | medium | 4.9 | – |
| GHSA-wr3c-6c22-m9v6 | typo3/neos | Privilege Escalation in TYPO3 Neos | medium | 4.9 | – |
| GHSA-wxjx-r2j2-96fx | wwbn/avideo | AVideo: Full-Read SSRF Through Unvalidated statsURL Parameter in plugin/Live/test.php | medium | 4.9 | – |
| CVE-2022-3788 | tobiasbg/tablepress | TablePress Plugin vulnerable to Cross-site Scripting | medium | 4.8 | – |
| GHSA-2xpm-cmvw-3jcc | pimcore/pimcore | Reflected XSS in Application Logger module | medium | 4.8 | – |
| GHSA-297g-xg4h-7w4c | illuminate/view | Laravel Cross-site Scripting vulnerability in blade templating | medium | 4.7 | – |
| GHSA-fh7r-58q4-6387 | zendframework/zendframework | Zendframework URL Rewrite vulnerability | medium | 4.7 | – |
| GHSA-fq4p-86hh-42v9 | zendframework/zend-diactoros | Zend-Diactoros URL Rewrite vulnerability | medium | 4.7 | – |
| GHSA-hq4p-5mpr-jj9m | silverstripe/framework | Silverstripe XSS in dev/build returnURL Parameter | medium | 4.7 | – |
| GHSA-m8fw-p3cr-6jqc | typo3/cms-rte-ckeditor | Cross-Site Scripting in CKEditor4 WordCount Plugin | medium | 4.7 | – |
| GHSA-q9j3-4ghj-6h57 | codeigniter/framework | Inadequate XSS Prevention in CodeIgniter/Framework Security Library | medium | 4.7 | – |
| GHSA-vf6x-59hh-332f | getformwork/formwork | Formwork has a cross-site scripting (XSS) vulnerability in Site title | medium | 4.7 | – |
| GHSA-5wx6-xwxf-q8qj | typo3/cms | Cross-Site Scripting in TYPO3 Backend | medium | 4.6 | – |
| GHSA-86r8-4g3w-7xjp | typo3/cms | Cross-Site Scripting in TYPO3 Backend | medium | 4.6 | – |
| GHSA-qf65-hph9-453r | drupal/drupal | Drupal Cross-Site Scripting (XSS) affecting CKEditor Third-party library | medium | 4.6 | – |
| GHSA-5cwr-5jxg-pcf6 | winter/wn-backend-module | Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles | medium | 4.5 | – |
| GHSA-hq84-x37p-j6q5 | winter/wn-backend-module | Winter: Reflected XSS through the search query parameter in the backend Table widget | medium | 4.5 | – |
| GHSA-frm9-7pm9-5rgc | silverstripe/comments | SilverStripe comments module includes version of jQuery vulnerable to Cross-site Scripting | medium | 4.4 | – |
| GHSA-v86m-j5f7-ccwh | passbolt/passbolt_api | Passbolt Api E-mail HTML injection | medium | 4.4 | – |
| CVE-2022-0227 | silverstripe/framework | Business Logic Errors in SilverStripe Framework | medium | 4.3 | – |
| GHSA-2hpc-mf4q-j885 | silverstripe/framework | Silverstripe CSRF vulnerability in GridFieldAddExistingAutocompleter | medium | 4.3 | – |
| GHSA-52cx-hpc5-cxwc | silverstripe/framework | silverstripe/framework missing ACL on reports | medium | 4.3 | – |
| GHSA-55pp-293f-3365 | silverstripe/userforms | silverstripe/userforms file upload exposure on UserForms module | medium | 4.3 | – |
| GHSA-56fm-hfp3-x3w3 | wallabag/wallabag | Wallabag user can disable 2FA unintentionally | medium | 4.3 | – |
| GHSA-5pm7-cp8f-p2c2 | wallabag/wallabag | wallabag/wallabag Has Multiple Cross-Site Request Forgery (CSRF) Vulnerabilities | medium | 4.3 | – |
| GHSA-5rjc-jc28-cwgg | opensource-workshop/connect-cms | Connect-CMS Access control vulnerability | medium | 4.3 | – |
| GHSA-5x28-3f32-x523 | drupal/drupal | Drupal core Access control bypass | medium | 4.3 | – |