Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| 2014-04-26 | zfr/zfr-oauth2-server-module | Authentication adapter did not verify validity of tokens | unknown | 0.0 | – |
| 2014-04-29 | cakephp/cakephp | SecurityComponent cross form submission issue | unknown | 0.0 | – |
| 2014-05-20 | illuminate/database, laravel/framework | Risk of mass-assignment vulnerabilities | unknown | 0.0 | – |
| 2014-05-22-1 | typo3/cms | The ExtJS JavaScript framework that is shipped with TYPO3 is susceptible to XSS | unknown | 0.0 | – |
| 2014-06-13 | swiftmailer/swiftmailer | Sendmail transport arbitrary shell execution | unknown | 0.0 | – |
| 2014-07-29-1 | willdurand/js-translation-bundle | Fixed potential path traversal attack and remote code injection | unknown | 0.0 | – |
| 2014-09-04-1 | friendsofsymfony/user-bundle | Entropy is lost in the TokenGenerator | unknown | 0.0 | – |
| 2014-10-22-2 | typo3/cms | Arbitrary Shell Execution in Swiftmailer library | unknown | 0.0 | – |
| 2014-12-09-2 | typo3/cms | Possible cache poisining on the homepage when anchors are used | unknown | 0.0 | – |
| 2014-12-29-1 | monolog/monolog | Header injection in NativeMailerHandler | unknown | 0.0 | – |
| 2015-01-15 | socalnick/scn-social-auth | XSS vulnerability in login redirect param | unknown | 0.0 | – |
| 2015-02-19 | namshi/jose | Attackers able to impersonate users | unknown | 0.0 | – |
| 2015-02-24-1 | thelia/backoffice-default-template, thelia/thelia | XSS injection in backoffice | unknown | 0.0 | – |
| 2015-03-10 | namshi/jose | Critical vulnerabilities in JSON Web Token libraries | unknown | 0.0 | – |
| 2015-03-28 | neos/neos, typo3/neos | Privilege Escalation in TYPO3 Neos | unknown | 0.0 | – |
| 2015-04-02 | firebase/php-jwt | Critical vulnerabilities in JSON Web Token libraries | unknown | 0.0 | – |
| 2015-04-13-1 | thelia/thelia | User authentication bypass | unknown | 0.0 | – |
| 2015-05-07 | cakephp/cakephp | Incorrect CSRF validation | unknown | 0.0 | – |
| 2015-05-13 | pusher/pusher-php-server | Exploit in the private channel authentication | unknown | 0.0 | – |
| 2015-05-28 | cakephp/cakephp | Denial of Service attack through XML payloads | unknown | 0.0 | – |
| 2015-07-01-1 | typo3/cms | Access bypass when editing file metadata | unknown | 0.0 | – |
| 2015-07-01-2 | typo3/cms | Frontend login Session Fixation | unknown | 0.0 | – |
| 2015-07-01-3 | typo3/cms | Cross-Site Scripting exploitable by Editors | unknown | 0.0 | – |
| 2015-07-01-4 | typo3/cms | Information Disclosure possibility exploitable by Editors | unknown | 0.0 | – |
| 2015-07-01-5 | typo3/cms | Brute Force Protection Bypass in backend login | unknown | 0.0 | – |
| 2015-07-08 | oro/crm, oro/platform | Forced Redirect to External Website | unknown | 0.0 | – |
| 2015-07-23 | laravel/socialite | Insecure state generation | unknown | 0.0 | – |
| 2015-08-03 | laravel/socialite | State guessing vulnerability | unknown | 0.0 | – |
| 2015-08-06 | cakephp/cakephp | Direct access of prefixed controller actions | unknown | 0.0 | – |
| 2015-09-08-1 | typo3/cms | Frontend: Unauthenticated Path Disclosure | unknown | 0.0 | – |
| 2015-10-31-1 | codeigniter/framework | XSS attack vector in Security Library method xss_clean() | unknown | 0.0 | – |
| 2015-11-05 | cakephp/cakephp | Remote File Inclusion through View template name manipulation | unknown | 0.0 | – |
| 2015-11-23 | neos/flow, neos/neos, typo3/flow +1 more | Arbitrary file upload and XML External Entity processing | unknown | 0.0 | – |
| 2015-12-15-1 | typo3/cms | Multiple Cross-Site Scripting vulnerabilities in TYPO3 backend | unknown | 0.0 | – |
| 2015-12-15-2 | typo3/cms | Cross-Site Scripting vulnerability in typolinks | unknown | 0.0 | – |
| 2015-12-15-3 | typo3/cms | Multiple Cross-Site Scripting vulnerabilities in frontend | unknown | 0.0 | – |
| 2015-12-15-4 | typo3/cms | TYPO3 is susceptible to Cross-Site Flashing | unknown | 0.0 | – |
| 2015-12-15-5 | typo3/cms | Cross-Site Scripting in TYPO3 component Indexed Search | unknown | 0.0 | – |
| 2016-02-16-1 | typo3/cms | SQL Injection in dbal | unknown | 0.0 | – |
| 2016-02-16-2 | typo3/cms | Cross-Site Scripting in link validator component | unknown | 0.0 | – |
| 2016-02-16-3 | typo3/cms | Cross-Site Scripting in legacy form component | unknown | 0.0 | – |
| 2016-02-16-4 | typo3/cms | Cross-Site Scripting in form component | unknown | 0.0 | – |
| 2016-02-23-1 | typo3/cms | XML External Entity (XXE) Processing in TYPO3 Core | unknown | 0.0 | – |
| 2016-02-23-2 | typo3/cms | Cross-Site Scripting in TYPO3 component Backend | unknown | 0.0 | – |
| 2016-02-23-3 | typo3/cms | Cross-Site Scripting in TYPO3 component CSS styled content | unknown | 0.0 | – |
| 2016-02-23-4 | typo3/cms | Denial of Service attack possibility in TYPO3 component Indexed Search | unknown | 0.0 | – |
| 2016-03-16 | paragonie/random_compat | Uses insecure CSPRNG (openssl_random_pseudo_bytes()) | unknown | 0.0 | – |
| 2016-04-12-1 | typo3/cms | Cross-Site Scripting in TYPO3 Backend | unknown | 0.0 | – |
| 2016-04-12-2 | typo3/cms | Arbitrary File Disclosure in Form Component | unknown | 0.0 | – |
| 2016-04-12-3 | typo3/cms | Authentication Bypass in TYPO3 CMS | unknown | 0.0 | – |