phpwarden
FeaturesComparePricingAdvisoriesBlogDocsChangelogLog in
Log inStart free

PHP vulnerability advisories

Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.

19,387CVEs
8,743Composer advisories
12,329WordPress advisories
36Actively exploited (KEV) →
CVEPackageTitleSeverityCVSSEPSS
2018-06-08-1sensiolabs/connectMissing state parameter in OAuth requests leading to CSRF vulnerabilityunknown0.0–
2018-06-27magento/product-community-editionMagento 2.2.5 and 2.1.14 Security updateunknown0.0–
2018-06-29magento/magento1ceSUPEE-10752 - Multiple security enhancements vulnerabilitiesunknown0.0–
2018-07-08scheb/two-factor-bundleVulnerability to bypass two-factor authentication with unverified JWT trusted device tokenunknown0.0–
2018-07-09sylius/admin-bundle, sylius/syliusCSRF vulnerability in the admin panelunknown0.0–
2018-07-12-1typo3/cms, typo3/cms-coreAuthentication Bypass in TYPO3 CMSunknown0.0–
2018-07-12-2typo3/cms, typo3/cms-coreInsecure Deserialization & Arbitrary Code Execution in TYPO3 CMSunknown0.0–
2018-07-12-3typo3/cms, typo3/cms-corePrivilege Escalation & SQL Injection in TYPO3 CMSunknown0.0–
2018-07-12-4typo3/cms, typo3/cms-coreInsecure Deserialization in TYPO3 CMSunknown0.0–
2018-08-08-1illuminate/cookie, laravel/frameworkCookie serialization vulnerabilityunknown0.0–
2018-09-10magento/product-community-editionMagento 2.2.6 and 2.1.15 Security updateunknown0.0–
2018-09-27robrichards/xmlseclibsFilter input to avoid XPath injectionunknown0.0–
2018-10-02alterphp/easyadmin-extension-bundleAction case insensitivityunknown0.0–
2018-10-17-1drupal/core, drupal/drupalContent moderation - Moderately critical - Access bypassunknown0.0–
2018-10-17-2drupal/core, drupal/drupalExternal URL injection through URL aliases - Moderately Critical - Open Redirectunknown0.0–
2018-10-17-3drupal/core, drupal/drupalAnonymous Open Redirect - Moderately Critical - Open Redirectunknown0.0–
2018-10-17-4drupal/core, drupal/drupalInjection in DefaultMailSystem::mail() - Critical - Remote Code Executionunknown0.0–
2018-10-17-5drupal/core, drupal/drupalContextual Links validation - Critical - Remote Code Executionunknown0.0–
2018-10-18-1typo3/phar-stream-wrapperBy-passing Protection of PharStreamWrapper Interceptorunknown0.0–
2018-10-31-1ezsystems/ezpublish-legacyEZSA-2018-005 Passwordless login for LDAP usersunknown0.0–
2018-11-01-1ezsystems/ezpublish-legacyEZSA-2018-006 XSS vulnerability in 'disabled module' error templateunknown0.0–
2018-11-20-1ezsystems/repository-formsEZSA-2018-007 User data disclosureunknown0.0–
2018-11-21-1ezsystems/ezpublish-kernel, ezsystems/ezpublish-legacyEZSA-2018-008 REST API returns list of all SiteAccessesunknown0.0–
2018-11-28magento/magento1ce, magento/magento1ee, magento/product-community-editionSUPEE-10975 - Security enhancements that help close RCE,XSS,CSRF and other vulnerabilitiesunknown0.0–
2018-12-11-1typo3/cms, typo3/cms-coreCross-Site Scripting in Online Media Asset Renderingunknown0.0–
2018-12-11-2typo3/cms, typo3/cms-coreCross-Site Scripting in Backend Modal Componentunknown0.0–
2018-12-11-3typo3/cms, typo3/cms-coreCross-Site Scripting in Frontend User Loginunknown0.0–
2018-12-11-4typo3/cms, typo3/cms-coreSecurity Misconfiguration in Install Tool Cookieunknown0.0–
2018-12-11-5typo3/cms, typo3/cms-coreInformation Disclosure in Install Toolunknown0.0–
2018-12-11-6typo3/cms, typo3/cms-coreDenial of Service in Online Media Asset Handlingunknown0.0–
2018-12-11-7typo3/cms, typo3/cms-coreDenial of Service in Frontend Record Registrationunknown0.0–
2018-12-14ua-parser/uap-phpDenial of serviceunknown0.0–
2018-12-20simplesamlphp/simplesamlphpCredentials exposure in session storageunknown0.0–
2019-01-20vrana/adminerAdminer script versions up to 4.6.2 contains file disclosure vulnerabilityunknown0.0–
2019-01-22-1typo3/cms, typo3/cms-coreInformation Disclosure of Installed Extensionsunknown0.0–
2019-01-22-2typo3/cms, typo3/cms-coreSecurity Misconfiguration for Backend User Accountsunknown0.0–
2019-01-22-3typo3/cms, typo3/cms-coreBroken Access Control in Localization Handlingunknown0.0–
2019-01-22-4typo3/cms, typo3/cms-coreCross-Site Scripting in Fluid ViewHelpersunknown0.0–
2019-01-22-6typo3/cms, typo3/cms-coreCross-Site Scripting in Form Frameworkunknown0.0–
2019-01-22-7typo3/cms, typo3/cms-coreArbitrary Code Execution via File List Moduleunknown0.0–
2019-01-22-8typo3/cms, typo3/cms-coreCross-Site Scripting in Language Pack Handlingunknown0.0–
2019-02-11-1passbolt/passbolt_apiRemote code executionunknown0.0–
2019-02-11-2passbolt/passbolt_apiRetrieval of HTTP-only cookiesunknown0.0–
2019-02-11-3passbolt/passbolt_apiE-mail HTML injectionunknown0.0–
2019-04-03-1ezsystems/ezplatform-admin-ui, ezsystems/ezplatform-userEZSA-2019-002 Password reset vulnerabilityunknown0.0–
2019-05-07-2typo3/cms, typo3/cms-coreSecurity Misconfiguration in User Session Handlingunknown0.0–
2019-05-07-4typo3/cms, typo3/cms-coreInformation Disclosure in Page Treeunknown0.0–
2019-05-07-5typo3/cms, typo3/cms-coreInformation Disclosure in User Authenticationunknown0.0–
2019-05-23-1ezsystems/ezfind-lsEZSA-2019-003 XSS in eZFind spellcheckunknown0.0–
2019-06-17neos/neos, typo3/neosInformation Disclosure Security Noteunknown0.0–
Page 372 of 388 · 19,387 advisories
Severity and CVSS come from the upstream advisory (OSV.dev, NVD, FriendsOfPHP); KEV marks CVEs on CISA's Known Exploited Vulnerabilities list; EPSS is FIRST's 30-day exploitation probability. Rows sort exploitation-first: KEV, then EPSS, then CVSS.