Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| 2016-04-12-4 | typo3/cms | Privilege Escalation in TYPO3 CMS | unknown | 0.0 | – |
| 2016-05-24-1 | typo3/cms | Missing Access Check in TYPO3 CMS | unknown | 0.0 | – |
| 2016-06-29-1 | fuel/core | ImageMagick driver does not escape all shell arguments. | unknown | 0.0 | – |
| 2016-07-19-1 | typo3/cms | Cross-Site Scripting in TYPO3 Backend | unknown | 0.0 | – |
| 2016-07-19-2 | typo3/cms | Insecure Unserialize in TYPO3 Import/Export | unknown | 0.0 | – |
| 2016-07-19-3 | typo3/cms | SQL Injection in TYPO3 Frontend Login | unknown | 0.0 | – |
| 2016-07-19-4 | typo3/cms | Information Disclosure in TYPO3 Backend | unknown | 0.0 | – |
| 2016-07-19-5 | typo3/cms | Cross-Site Scripting vulnerability in typolinks | unknown | 0.0 | – |
| 2016-07-19-7 | typo3/cms | Cross-Site Scripting in third party library mso/idna-convert | unknown | 0.0 | – |
| 2016-07-26-1 | codeigniter/framework | Critical SQL injection bug in the ODBC database driver | unknown | 0.0 | – |
| 2016-08-30 | gree/jose | Critical vulnerabilities in JSON Web Token libraries | unknown | 0.0 | – |
| 2016-09-05 | cartalyst/sentry | Null reset codes were allowed | unknown | 0.0 | – |
| 2016-09-14-1 | typo3/cms | Cross-Site Scripting in TYPO3 Backend | unknown | 0.0 | – |
| 2016-09-14-2 | typo3/cms | Cache Flooding in TYPO3 Frontend | unknown | 0.0 | – |
| 2016-10-31 | gregwar/rst | Local File Inclusion Vulnerability | unknown | 0.0 | – |
| 2016-11-01 | neos/flow, typo3/flow | Time-Based Information Disclosure Vulnerability in Flow | unknown | 0.0 | – |
| 2016-11-22-1 | typo3/cms | Insecure Unserialize in TYPO3 Backend | unknown | 0.0 | – |
| 2016-11-22-2 | typo3/cms | Path Traversal in TYPO3 Core | unknown | 0.0 | – |
| 201606-01 | simplesamlphp/simplesamlphp | Link injection | unknown | 0.0 | – |
| 2017-01-03-1 | typo3/cms | Remote Code Execution in third party library swiftmailer | unknown | 0.0 | – |
| 2017-01-06 | neos/swiftmailer, typo3/swiftmailer | Security fix for Flow Swift Mailer package | unknown | 0.0 | – |
| 2017-01-24 | shopware/shopware | Remote Code Execution Vulnerability | unknown | 0.0 | – |
| 2017-01-25 | shopware/shopware | Remote Code Execution Vulnerability | unknown | 0.0 | – |
| 2017-02-01 | cart2quote/module-quotation | Remote Code Execution in Qquoteadv/controllers/DownloadController.php | unknown | 0.0 | – |
| 2017-02-07 | magento/magento1ce, magento/magento1ee | SUPEE-9652 - Remote Code Execution using mail vulnerability | unknown | 0.0 | – |
| 2017-02-28 | onelogin/php-saml | An error during signature verification can be treated as a successful verification. | unknown | 0.0 | – |
| 2017-02-28-1 | typo3/cms | Authentication Bypass in TYPO3 Frontend | unknown | 0.0 | – |
| 2017-02-28-2 | typo3/cms | Cross-Site Scripting in TYPO3 CMS | unknown | 0.0 | – |
| 2017-03-01 | squizlabs/php_codesniffer | Arbitrary shell execution | unknown | 0.0 | – |
| 2017-04-12 | neos/flow, typo3/flow | Flow Bugfix Releases for Entity Security | unknown | 0.0 | – |
| 2017-05-09 | amphp/artax | Cookie leakage to wrong origins and non-restricted cookie acceptance | unknown | 0.0 | – |
| 2017-05-15 | 3f/pygmentize | Remote Code Execution | unknown | 0.0 | – |
| 2017-05-18 | squizlabs/php_codesniffer | Arbitrary shell execution | unknown | 0.0 | – |
| 2017-06-22 | shopware/shopware | Remote Code Execution Vulnerability | unknown | 0.0 | – |
| 2017-09-05-1 | typo3/cms | Cross-Site Scripting in TYPO3 CMS Backend | unknown | 0.0 | – |
| 2017-09-05-2 | typo3/cms | Information Disclosure in TYPO3 CMS | unknown | 0.0 | – |
| 2017-09-05-3 | typo3/cms | Information Disclosure in TYPO3 CMS | unknown | 0.0 | – |
| 2017-09-05-4 | typo3/cms | Arbitrary Code Execution in TYPO3 CMS | unknown | 0.0 | – |
| 2017-09-11-1 | ezsystems/ezpublish-legacy | EZSA-2017-006 Information disclosure in backend content tree menu | unknown | 0.0 | – |
| 2017-10-29 | phpxmlrpc/extras | XSS in class documenting_xmlrpc_server | unknown | 0.0 | – |
| 2017-11-20 | asymmetricrypt/asymmetricrypt, pagarme/pagarme-php, stormpath/sdk +1 more | Padding Oracle Vulnerability in RSA Encryption | unknown | 0.0 | – |
| 201710-01 | simplesamlphp/simplesamlphp | Signature validation bypass | unknown | 0.0 | – |
| 2018-01-22 | shopware/shopware | Non-Persistent XSS | unknown | 0.0 | – |
| 2018-02-14 | propel/propel, propel/propel1 | SQL injection possible with limit() on MySQL | unknown | 0.0 | – |
| 2018-02-26-1 | ezsystems/ezpublish-legacy | EZSA-2018-001 Several vulnerabilities in Forgot password, Information collector, XML text, and Matrix field type features | unknown | 0.0 | – |
| 2018-03-06 | adodb/adodb-php | Potential SQL injection vector | unknown | 0.0 | – |
| 2018-03-15 | amphp/http | Incorrect header injection check | unknown | 0.0 | – |
| 2018-03-30-1 | illuminate/encryption, laravel/framework | Exploit of encryption failure vulnerability | unknown | 0.0 | – |
| 2018-04-14-1 | fuel/core | Crypt encryption compromised. | unknown | 0.0 | – |
| 2018-05-20 | cakephp/cakephp | XSS in some development error pages | unknown | 0.0 | – |