Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-25817 | silverstripe/framework | CVE-2021-25817 XXE: Vulnerability in CSSContentParser | unknown | 0.0 | – |
| CVE-2021-30492 | zendesk/zendesk_api_client_php | Lack of Input Validation in zendesk_api_client_php for Zendesk Subdomain | critical | 0.0 | – |
| CVE-2021-3142 | mautic/core | XSS in Mautic | high | 0.0 | – |
| CVE-2023-32302 | silverstripe/framework | Silverstripe Framework: Members with no password can be created and bypass custom login forms | low | 0.0 | – |
| CVE-2024-43372 | ezsystems/ezplatform-richtext | Persistent Cross-site Scripting in eZ Platform Rich Text Field Type | high | 0.0 | – |
| CVE-2026-118547 | drupal/content_synchronizer | The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive fil | unknown | 0.0 | – |
| CVE-2026-118566 | drupal/content_synchronizer | The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive fil | unknown | 0.0 | – |
| CVE-2026-122057 | drupal/s3fs_cors | This module enables you to upload files from the browser directly to Amazon S3 and register them as Drupal files, bypass | unknown | 0.0 | – |
| CVE-2026-122058 | drupal/simple_oauth | This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with a | unknown | 0.0 | – |
| CVE-2026-122066 | drupal/workflow_notifications | This module enables you to send messages ("Notifications") to users upon a certain Workflow state change. The module do | unknown | 0.0 | – |
| CVE-2026-122067 | drupal/rest_api_authentication | The REST & JSON API Authentication module provides API authentication for Drupal sites. The module does not properly re | unknown | 0.0 | – |
| CVE-2026-122068 | drupal/highlight_js | This module enables you to add syntax-highlighted code snippets to content using CKEditor 5. The module doesn't suffici | unknown | 0.0 | – |
| CVE-2026-122069 | drupal/basket_paypal | The AlternativeCommerce PayPal Checkout module provides an AlternativeCommerce method to embed payment services from Pay | unknown | 0.0 | – |
| CVE-2026-122070 | drupal/commerce_product_alternative | This module lets customers replace an item in their cart with one of the alternative product variations listed for it. | unknown | 0.0 | – |
| CVE-2026-122071 | drupal/commerce_escrow | This module enables you to accept payments through Escrow.com with Drupal Commerce. The module doesn't sufficiently ver | unknown | 0.0 | – |
| CVE-2026-122072 | drupal/forum_access | This module allows forums to be set private and to be given moderators. The module doesn't sufficiently check access fo | unknown | 0.0 | – |
| CVE-2026-122073 | drupal/name | The Name Field module provides a field for storing a personal name as separate components. The module does not sufficie | unknown | 0.0 | – |
| CVE-2026-122074 | drupal/reset_password_email_otp | This module enables you to reset passwords via one time passcode to email or SMS rather than reset password links. The | unknown | 0.0 | – |
| CVE-2026-122075 | drupal/scheduler | This module enables you to schedule content to be published or unpublished at a certain time in the future. The module | unknown | 0.0 | – |
| CVE-2026-122076 | drupal/change_pwd_page | This module provides a separate page with a form for users to change their own password, which asks for the current pass | unknown | 0.0 | – |
| CVE-2026-122077 | drupal/allowed_languages | The Allowed Languages module makes it possible to set restrictions on which content a user can edit based on language. | unknown | 0.0 | – |
| CVE-2026-122078 | drupal/extended_html_filter | The Extended HTML Filter module allows using style attributes in CKEditor. The module XSS filter does not sufficiently | unknown | 0.0 | – |
| CVE-2026-122079 | drupal/htmlawed | The htmLawed module enables use of the [htmLawed](https://bioinformatics.org/phplabware/internal_utilities/htmLawed/inde | unknown | 0.0 | – |
| CVE-2026-122080 | drupal/htmlawed | The htmLawed module enables use of the [htmLawed](https://bioinformatics.org/phplabware/internal_utilities/htmLawed/inde | unknown | 0.0 | – |
| CVE-2026-122081 | drupal/islandora | Islandora does not sufficiently check file update access when processing media source and derivative uploads. A user wit | unknown | 0.0 | – |
| CVE-2026-122082 | drupal/mimemail | The Mime Mail module gives Drupal sites the ability to send HTML email messages. Under rare site configuration conditio | unknown | 0.0 | – |
| CVE-2026-122083 | drupal/adobe_analytics | This module integrates the Site Catalyst or AdobeAnalytics software into a Drupal site. The module does not sufficientl | unknown | 0.0 | – |
| CVE-2026-122084 | drupal/wordsonline_connector | The WordsOnline Connector module integrates Drupal with the WordsOnline translation service through the TMGMT module. T | unknown | 0.0 | – |
| CVE-2026-46626 | symfony/runtime, symfony/symfony | CVE-2026-46626: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch | unknown | 0.0 | – |
| CVE-2026-47142 | mantisbt/mantisbt | MantisBT: SQL Injection via history_order Configuration Value | high | 0.0 | – |
| CVE-2026-47677 | facturascripts/facturascripts | FacturaScripts: Account takeover of any 2FA-enabled user | critical | 0.0 | – |
| CVE-2026-49273 | mantisbt/mantisbt | MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php | high | 0.0 | – |
| CVE-2026-49280 | mantisbt/mantisbt | MantisBT: REST API unauthorized Issue status change | medium | 0.0 | – |
| CVE-2026-52847 | mantisbt/mantisbt | MantisBT: Reflected XSS in admin/install.php | critical | 0.0 | – |
| CVE-2026-52881 | mantisbt/mantisbt | MantisBT: Reflected XSS in admin/install.php via unescaped printf | critical | 0.0 | – |
| CVE-2026-52882 | mantisbt/mantisbt | MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters | medium | 0.0 | – |
| CVE-2026-52883 | mantisbt/mantisbt | MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs | medium | 0.0 | – |
| CVE-2026-62944 | mantisbt/mantisbt | MantisBT: Stored XSS in print_all_bug_page_word.php | high | 0.0 | – |
| CVE-2026-88987 | silverstripe/framework | CVE-2026-88987 - XSS via XHTML data URI | unknown | 0.0 | – |
| CVE-2026-88988 | silverstripe/framework | CVE-2026-88988 - XSS via SVG data URI | unknown | 0.0 | – |
| CVE-2026-88989 | silverstripe/framework | CVE-2026-88989 - Auth bypass GridFieldDetailForm | unknown | 0.0 | – |
| CVE-2026-88990 | symbiote/silverstripe-advancedworkflow | CVE-2026-88990 - RCE in email template field via template execution | unknown | 0.0 | – |
| CVE-2026-88991 | silverstripe/userforms | CVE-2026-88991 - RCE in email subject field via template execution | unknown | 0.0 | – |
| CVE-2026-88992 | silverstripe/userforms | CVE-2026-88992 - Userforms CSV export restricted file access | unknown | 0.0 | – |
| CVE-2026-91110 | silverstripe/framework | CVE-2026-91110 - XSS using control bytes | unknown | 0.0 | – |
| CVE-2026-91111 | silverstripe/userforms | CVE-2026-91111 - Uploaded XML XSS | unknown | 0.0 | – |
| CVE-2026-91112 | silverstripe/framework | CVE-2026-91112 - CMS_ACCESS_SecurityAdmin privilege escalation | unknown | 0.0 | – |
| CVE-2026-91113 | silverstripe/framework | CVE-2026-91113 - User-controlled ClassName allows unauthorized record type change | unknown | 0.0 | – |
| CVE-2026-91114 | silverstripe/framework | CVE-2026-91114 - Stored XSS via unescaped permission in PermissionCheckboxSetField | unknown | 0.0 | – |
| CVE-2026-91115 | silverstripe/framework | CVE-2026-91115 - RCE via i18nTextCollectorTask writer parameter | unknown | 0.0 | – |