PHP vulnerability advisories

Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.

19,387CVEs

8,743Composer advisories

12,329WordPress advisories

36Actively exploited (KEV) →

CVE	Package	Title	Severity	EPSS
2019-06-25-1	typo3/cms, typo3/cms-core	Information Disclosure in Backend User Interface	unknown	–
2019-06-25-3	typo3/cms, typo3/cms-core	Security Misconfiguration in Frontend Session Handling	unknown	–
2019-06-25-4	typo3/cms, typo3/cms-core	Arbitrary Code Execution and Cross-Site Scripting in Backend API	unknown	–
2019-06-25-7	typo3/cms, typo3/cms-core	Broken Access Control in Import Module	unknown	–
2019-06-27-1	ezsystems/ezplatform	EZSA-2019-004 CSRF token in login form is disabled by default	unknown	–
2019-07-04-1	ezsystems/ezplatform-admin-ui-assets	EZSA-2019-005 Bundled jQuery affected by CVE-2019-11358	unknown	–
2019-07-10	simplesamlphp/simplesamlphp	Reflected Cross-Site-Scripting	unknown	–
2019-08-07-1	passbolt/passbolt_api	Stored XSS on first/last name during setup	unknown	–
2019-08-07-2	passbolt/passbolt_api	Stored XSS in tags autocomplete dropdown	unknown	–
2019-08-07-3	passbolt/passbolt_api	Tabnabbing when opening URI with menu "Open URI in a new tab"	unknown	–
2019-09-03-1	ezsystems/ezplatform	EZSA-2019-006 Rules to disable executable access are ignored on Platform.sh (eZ Cloud)	unknown	–
2019-09-03-2	ezsystems/ezplatform	EZSA-2019-007 Prevent accepting app.php in URL in Platform.sh	unknown	–
2019-09-26-1	datadog/dd-trace	Circumvents open_basedir INI directive	unknown	–
2019-11-19	simplesamlphp/simplesamlphp	Information disclosure	unknown	–
2019-12-17-1	typo3/cms, typo3/cms-core	Cross-Site Scripting in Form Framework validation handling	unknown	–
2019-12-17-2	typo3/cms, typo3/cms-core	Cross-Site Scripting in Link Handling	unknown	–
2019-12-17-3	typo3/cms, typo3/cms-core	Cross-Site Scripting in Filelist Module	unknown	–
2019-12-17-7	typo3/cms, typo3/cms-core	Possible Insecure Deserialization in Extbase Request Handling	unknown	–
2019-12-18-1	drupal/core, drupal/drupal	Drupal core - Moderately critical - Denial of Service - SA-CORE-2019-009	unknown	–
2019-12-18-2	drupal/core, drupal/drupal	Drupal core - Moderately critical - Multiple vulnerabilities - SA-CORE-2019-010	unknown	–
2019-12-18-3	drupal/core, drupal/drupal	Drupal core - Moderately critical - Access bypass - SA-CORE-2019-011	unknown	–
2019-12-18-4	drupal/core, drupal/drupal	Drupal core - Critical - Multiple vulnerabilities - SA-CORE-2019-012	unknown	–
2019-12-19	scheb/two-factor-bundle	Vulnerability to bypass two-factor authentication with remember-me option	unknown	–
2019-12-22	endroid/qr-code-bundle	Disclosure of files via logo_path query parameter	unknown	–
2020-03-03-1	ezsystems/ezpublish-kernel, ezsystems/ezpublish-legacy, friendsofsymfony/oauth2-php	EZSA-2020-001 Remote code execution in file uploads	unknown	–
2020-03-13-1	illuminate/view, laravel/framework	XSS vulnerability in blade templating	unknown	–
2020-03-18	drupal/core, drupal/drupal	Drupal core - Moderately critical - Third-party library - SA-CORE-2020-001	unknown	–
2020-04-21-1	ezsystems/demobundle, ezsystems/ezdemo-ls-extension	EZSA-2020-003 XSS in DemoBundle/ezdemo bundled VideoJS	unknown	–
2020-04-28-1	nystudio107/craft-seomatic	SSTI Vulnerability	unknown	–
2020-05-03	nzo/url-encryptor-bundle	Insecure default secret key and IV allowing anyone to decrypt values	unknown	–
2020-05-20-1	drupal/core, drupal/drupal, ezsystems/ezplatform-kernel +1 more	Drupal core - Moderately critical - Open Redirect - SA-CORE-2020-003	unknown	–
2020-06-16	amphp/http-client	Header leakage on cross-domain redirects	unknown	–
2020-07-06-1	gos/web-socket-bundle	Potentially sensitive data exposure	unknown	–
2020-07-27-1	illuminate/cookie, laravel/framework	RCE vulnerability in "cookie" session driver	unknown	–
2020-08-06-1	laravel/framework	Guard bypass in Eloquent models	unknown	–
2020-08-07-1	ezsystems/ezplatform-admin-ui-assets, ezsystems/platform-ui-assets-bundle	EZSA-2020-005 Editor XSS and trashed drafts in review queue	unknown	–
2020-09-22-1	livewire/livewire	$this->validate() returns all properties, not just validated ones	unknown	–
2020-10-05-1	ezsystems/ezpublish-legacy	IBEXA-SA-2020-006 Object Injection in legacy shop module	unknown	–
2020-11-25	drupal/core, drupal/drupal	Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2020-013	unknown	–
2020-12-01-1	ezsystems/ez-support-tools	IBEXA-SA-2020-007 Failing access control in system info view	unknown	–
2021-01-21	illuminate/database, laravel/framework	Unexpected bindings in QueryBuilder	unknown	–
2021-01-29	socialiteproviders/steam	Authentication bypass via attacker provided openid server	unknown	–
2021-03-16-1	brotkrueml/codehighlight	Regular expression Denial of Service	unknown	–
2021-04-06	doctrine/orm	Regression in Query Parenthesis can have Security Implications	unknown	–
2021-04-28	illuminate/database, laravel/framework	SQL Server LIMIT / OFFSET SQL Injection	unknown	–
2021-05-25-1	klaviyo/magento2-extension	Read private customer data reclaiming carts	unknown	–
2021-05-26	drupal/core, drupal/drupal	Drupal core - Moderately critical - Third-party libraries - SA-CORE-2021-005	unknown	–
2021-09-10	symfont/process	Prevent installation typosquatting malware	unknown	–
2021-11-10-1	brotkrueml/codehighlight	Regular expression Denial of Service	unknown	–
2022-02-04-1	terminal42/contao-tablelookupwizard	Possible SQL injection in widget field value	unknown	–

Severity and CVSS come from the upstream advisory (OSV.dev, NVD, FriendsOfPHP); KEV marks CVEs on CISA's Known Exploited Vulnerabilities list; EPSS is FIRST's 30-day exploitation probability. Rows sort exploitation-first: KEV, then EPSS, then CVSS.