Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| GHSA-6gf6-24h2-66j4 | drupal/core | Drupal core Open Redirect vulnerability | medium | 4.3 | – |
| GHSA-9cw3-j7wg-jwj8 | neos/flow | Neos Flow Information disclosure in entity security | medium | 4.3 | – |
| GHSA-g46h-v2cc-6c94 | typo3/cms | Information Disclosure in TYPO3 CMS | medium | 4.3 | – |
| GHSA-g776-759r-pf6x | typo3/cms-core | TYPO3 Broken Access Control in Import Module | medium | 4.3 | – |
| GHSA-mh4h-27gq-cxwj | drupal/core | Drupal core Access bypass | medium | 4.3 | – |
| GHSA-mpmw-f6h6-3g26 | winter/wn-backend-module | Winter: My Account preview exposes another backend user's profile by record ID | medium | 4.3 | – |
| GHSA-p5h2-vr99-xm99 | silverstripe/framework | silverstripe/framework ChangePasswordForm does not check `Member::canLogIn()` | medium | 4.3 | – |
| GHSA-qp29-wcc2-vmpc | silverstripe/framework | Silverstripe HtmlEditor embed url sanitisation | medium | 4.3 | – |
| GHSA-qxh3-jgvh-x55j | opensource-workshop/connect-cms | Connect-CMS Privilege Escalation Vulnerability | medium | 4.3 | – |
| GHSA-r2vg-hvjm-fg38 | shopware/core, shopware/platform | Shopware Customer Orders can be canceled, even if refunds are disabled | medium | 4.3 | – |
| GHSA-vr95-p7q6-8m9q | laravel/framework | Laravel Cross-site Scripting (XSS) vulnerability in blade templating | medium | 4.3 | – |
| GHSA-wvvp-jwf5-qcpc | typo3/cms-core | TYPO3 Information Disclosure in Page Tree | medium | 4.3 | – |
| GHSA-wxfg-253g-m7r4 | drupal/drupal | Drupal core Open Redirect vulnerability | medium | 4.3 | – |
| GHSA-337w-fxpq-5m34 | drupal/drupal | Drupal core uses a vulnerable Third-party library CKEditor | medium | 4.2 | – |
| GHSA-43cf-7f3h-38rg | neos/neos | Privilege Escalation in TYPO3 Neos | medium | 4.2 | – |
| GHSA-crmm-hgp2-wgrp | laravel/framework | Laravel Framework: Temporary Signed URL Path Confusion | medium | 4.2 | – |
| GHSA-v273-j5hq-26xp | drupal/core | Drupal core uses a vulnerable Third-party library CKEditor | medium | 4.2 | – |
| GHSA-29w6-c52g-m8jc | grumpydictator/firefly-iii | C5 Firefly III CSV Injection. | medium | 4.0 | – |
| GHSA-68wv-g3fw-pq7q | shopware/core, shopware/platform | Shopware Broken ACL on Document retrieval to access other customers documents | medium | 4.0 | – |
| GHSA-8jp9-mpv9-98rj | amphp/http-client | amphp/http-client Header leakage on cross-domain redirects | medium | 4.0 | – |
| GHSA-779c-7w4p-2c4g | silverstripe/admin | Silverstripe admin XSS Vulnerability via WYSIWYG editor | low | 3.8 | – |
| GHSA-2r3v-q9x3-7g46 | simplesamlphp/simplesamlphp | Link injection in SimpleSAMLphp | low | 3.7 | – |
| GHSA-7h74-7vcw-4mwp | neos/flow | Insecure deserialize Vulnerability in FLOW3 | low | 3.7 | – |
| GHSA-c7p6-3c9c-f88q | typo3/cms | Information Disclosure in TYPO3 CMS | low | 3.7 | – |
| GHSA-f5pp-pmq8-gp46 | passbolt/passbolt_api | Passbolt Api Retrieval of HTTP-only cookies | low | 3.7 | – |
| CVE-2025-2967 | concrete5/concrete5 | ConcreteCMS Cross-Site Scripting (XSS) via HTML Block Text Field | low | 3.5 | – |
| CVE-2026-44701 | devcode-it/openstamanager | OpenSTAManager has HTML Injection in modules/utenti/edit.php | low | 3.5 | – |
| CVE-2026-45710 | facturascripts/facturascripts | FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes i | low | 3.5 | – |
| GHSA-vh7q-j8p5-2h4h | silverstripe/framework | silverstripe/framework sends passwords back to browsers under some circumstances | low | 3.5 | – |
| GHSA-7jp2-5h22-m432 | auth0/symfony | Auth0 Symfony SDK Does Not Properly Handle File Types in Bulk User Import | low | 3.3 | – |
| GHSA-hjfh-5jmm-xr24 | auth0/login | laravel-auth0 SDK Does Not Properly Handle File Types in Bulk User Import | low | 3.3 | – |
| GHSA-5r8w-66hq-rc39 | silverstripe/framework | silverstripe/framework's pre-existing alc_enc cookies log users in if remember me is disabled | low | 3.1 | – |
| GHSA-3cpp-fv95-mpr5 | shopware/core, shopware/platform | Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice | low | 2.7 | – |
| GHSA-6wh5-mw9h-5c3w | shopware/core, shopware/platform | Shopware vulnerable to path traversal via Plugin upload | low | 2.7 | – |
| GHSA-h4fw-6r7f-w494 | web-auth/webauthn-framework | Webauthn has a User Verification Downgrade via Default-Open ClientOverridePolicy | low | 2.1 | – |
| GHSA-7mpf-4465-7fc2 | winter/wn-backend-module | Winter: Stored XSS through Backend List widget image columns | low | 2.0 | – |
| 2011-09-25 | doctrine/dbal, doctrine/orm | SQL injection possibility | unknown | 0.0 | – |
| 2011-11-16 | symfony/symfony | Vulnerability in the EntityUserProvider as provided in the Doctrine bridge | unknown | 0.0 | – |
| 2012-02-24 | symfony/serializer, symfony/symfony | XML decoding attack vector through external entities | unknown | 0.0 | – |
| 2012-03-28 | neos/flow, typo3/flow | Insecure Unserialize Vulnerability in FLOW3 | unknown | 0.0 | – |
| 2012-07-10-1 | friendsofsymfony/user-bundle | Fixed the user refreshing to check the identity by primary key instead of username | unknown | 0.0 | – |
| 2012-07-10-2 | friendsofsymfony/user-bundle | Fixes a security issue where the session could be hijacked | unknown | 0.0 | – |
| 2012-08-28 | symfony/dependency-injection, symfony/routing, symfony/symfony +2 more | Security fixes related to the way XML is handled | unknown | 0.0 | – |
| 2012-11-29 | symfony/http-foundation, symfony/symfony | Request::getClientIp() when the trust proxy mode is enabled | unknown | 0.0 | – |
| 2013-04-08 | twig/twig | Vulnerability in the filesystem loader | unknown | 0.0 | – |
| 2013-05-16 | doctrine/doctrine-module | Authentication Vulnerability - possible attempt to login via zero-valued password credential | unknown | 0.0 | – |
| 2014-01-22-1 | friendsofsymfony/rest-bundle | Fixed issue with broken validation of JSONP callbacks | unknown | 0.0 | – |
| 2014-02-13 | contao/core | PHP object injection vulnerability allows for arbitrary code execution | unknown | 0.0 | – |
| 2014-04-07 | contao/core | Insufficient input validation allows for code injection and remote execution | unknown | 0.0 | – |
| 2014-04-15 | illuminate/auth, laravel/framework | Hijacked authentication cookies vulnerability | unknown | 0.0 | – |