Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| 2022-11-28-1 | phpxmlrpc/phpxmlrpc | local file access in `Client:send` via manipulation of `$protocol` argument | unknown | 0.0 | – |
| 2022-11-28-2 | phpxmlrpc/phpxmlrpc | code injection in `Wrapper::buildClientWrapperCode` via manipulation of the `$client` argument | unknown | 0.0 | – |
| 2023-04-17 | nyholm/psr7 | Improper Input Validation in headers | unknown | 0.0 | – |
| 2024-01-17 | drupal/core | Drupal core - Moderately critical - Denial of Service | unknown | 0.0 | – |
| 2024-04-24 | mdanter/ecc | Cryptographic side-channels in PHPECC | unknown | 0.0 | – |
| 2024-05-01 | nategood/httpful | Insecure HTTPS Connections due to Missing Default Certificate Validation | unknown | 0.0 | – |
| 2024-10-31 | aptoma/twig-markdown | Cross-site Scripting (XSS) | unknown | 0.0 | – |
| 2024-11-04 | drupal-pattern-lab/add-attributes-twig-extension, drupal-pattern-lab/bem-twig-extension, drupal-pattern-lab/unified-twig-extensions +2 more | Cross-site Scripting (XSS) | unknown | 0.0 | – |
| 2025-12-30 | paragonie/sodium_compat | Missing check that a point is on the prime subgroup for Edwards25519 | unknown | 0.0 | – |
| 2026-04-20 | spatie/schema-org | Cross-site scripting (XSS) via script break-out in toScript() output | unknown | 0.0 | – |
| 2026-04-28 | dedoc/scramble | Remote code execution via evaluation of user-controlled input in validation rules | unknown | 0.0 | – |
| 2026-08-18 | paragonie/sodium_compat | Incorrect Ed25519 public key validation | unknown | 0.0 | – |
| 2026-08-25 | contao-components/colorbox, contao/comments-bundle, contao/newsletter-bundle | Cross-site scripting in the Colorbox caption (see GHSA-rr85-7j77-pppg) | unknown | 0.0 | – |
| 2026-08-25-1 | contao/contao, contao/core-bundle | Improper access control in the table access voter (see GHSA-5974-gfqc-wrcm) | unknown | 0.0 | – |
| 2026-08-25-10 | contao/contao | Cross-site scripting in the comments bundle (see GHSA-628f-v4f6-p37r) | unknown | 0.0 | – |
| 2026-08-25-11 | contao/contao | Improper access control in the newsletter module (see GHSA-3r9g-pfhv-3228) | unknown | 0.0 | – |
| 2026-08-25-2 | contao/contao, contao/core-bundle | Improper access control in the CSV import wizard (see GHSA-23w9-4pg3-xwm3) | unknown | 0.0 | – |
| 2026-08-25-3 | contao/contao, contao/core-bundle | Non-admin users can self-grant permissions that implicitly make them administrators (see GHSA-r9qp-pqx5-8369) | unknown | 0.0 | – |
| 2026-08-25-4 | contao/contao, contao/core-bundle | Cross-site scripting in the frontend search results (see GHSA-h57j-5f5m-789v) | unknown | 0.0 | – |
| 2026-08-25-5 | contao/contao, contao/core-bundle | Improper access control in the preview links module (see GHSA-q6wp-fr43-gm9v) | unknown | 0.0 | – |
| 2026-08-25-6 | contao/contao, contao/core-bundle | Path traversal in the images controller (see GHSA-mrvp-7wmx-5m4h) | unknown | 0.0 | – |
| 2026-08-25-7 | contao/contao, contao/core-bundle | Cross-site request forgery in custom backend actions (see GHSA-9ff2-p842-45wq) | unknown | 0.0 | – |
| 2026-08-25-8 | contao/contao, contao/core-bundle | Unrestricted activation email resending (see GHSA-mfxh-vp55-7gc6) | unknown | 0.0 | – |
| 2026-08-25-9 | contao/contao, contao/core-bundle | Exposure of sensitive information through a stale search index (see GHSA-x2rp-9qf7-2fmq) | unknown | 0.0 | – |
| 2026-09-06-1 | jayanta/laravel-threat-detection | Plaintext credentials written to the threat log and readable by any authenticated user | unknown | 0.0 | – |
| 2026-09-29-1 | jayanta/laravel-threat-detection | Attacks go unrecorded when a request carries malformed headers or oversized fields | unknown | 0.0 | – |
| 2026-09-29-2 | jayanta/laravel-threat-detection | Marking a detection as a false positive could create a wider exclusion rule than intended | unknown | 0.0 | – |
| 2026-09-29-3 | jayanta/laravel-threat-detection | Credentials under prefixed or nested names stored in cleartext in the threat log | unknown | 0.0 | – |
| 2026-10-16-1 | litesaml/lightsaml | Signature validation bypass | unknown | 0.0 | – |
| 2026-11-04-1 | symfony/config, symfony/symfony | XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = true | unknown | 0.0 | – |
| 2026-11-04-10 | symfony/http-client, symfony/symfony | ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References | unknown | 0.0 | – |
| 2026-11-04-11 | symfony/http-kernel, symfony/symfony | Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request | unknown | 0.0 | – |
| 2026-11-04-14 | symfony/security-http, symfony/symfony | Programmatic Logins Skip the checkPostAuth() Method of User Checkers | unknown | 0.0 | – |
| 2026-11-04-15 | symfony/http-client, symfony/symfony | NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports: Incomplete Fix for C | unknown | 0.0 | – |
| 2026-11-04-17 | symfony/serializer, symfony/symfony | DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server File | unknown | 0.0 | – |
| 2026-11-04-18 | symfony/filesystem, symfony/symfony | Filesystem Path Treats Any Prefix Before "://" as a Root, Letting Paths Escape Their Base Directory | unknown | 0.0 | – |
| 2026-11-04-19 | symfony/symfony, symfony/yaml | Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a Process | unknown | 0.0 | – |
| 2026-11-04-2 | symfony/html-sanitizer, symfony/symfony | HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypass | unknown | 0.0 | – |
| 2026-11-04-20 | symfony/json-path, symfony/symfony | Incomplete Fix for CVE-2026-45756: JsonPath Queries Can Still Hold a Process Through search(), match() and Chained Filters | unknown | 0.0 | – |
| 2026-11-04-21 | symfony/http-foundation, symfony/symfony | Path Rules Enforced in Front of PHP Can Be Bypassed by Appending the Path to the Script Name | unknown | 0.0 | – |
| 2026-11-04-22 | symfony/http-foundation, symfony/symfony | Generated URLs Can Point to a Host Chosen by the Client | unknown | 0.0 | – |
| 2026-11-04-3 | symfony/html-sanitizer, symfony/symfony | HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar: Incomplete Fix for CVE-2026-48761 | unknown | 0.0 | – |
| 2026-11-04-6 | symfony/serializer, symfony/symfony | ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects | unknown | 0.0 | – |
| 2026-11-04-7 | symfony/symfony, symfony/validator | Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses: SSRF Filter Bypass | unknown | 0.0 | – |
| 2026-11-04-9 | symfony/framework-bundle, symfony/http-foundation, symfony/symfony | The "private_ranges" Trusted Proxies Shortcut Trusts Clients Presenting an IPv4-Mapped, 6to4, Teredo or NAT64 Address as Reverse Proxies | unknown | 0.0 | – |
| 2026-11-05-1 | prinsfrank/pdfparser | Memory exhaustion when decoding malicious zlib/deflate streams | unknown | 0.0 | – |
| 2026-11-05-2 | prinsfrank/pdfparser | Unbounded recursion in compressed object resolution | unknown | 0.0 | – |
| 2026-11-06 | paragonie/halite | AAD parameter not correctly bound in File cryptography | unknown | 0.0 | – |
| CVE-2015-3542 | phpoffice/phpexcel | PHPExcel XXE Vulnerability | high | 0.0 | – |
| CVE-2016-1000253 | onelogin/php-saml | onelogin/php-saml signature wrapping attacks | medium | 0.0 | – |