Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| DRUPAL-CONTRIB-2023-027 | drupal/libraries_ui | This module enables a UI to display all libraries provided by modules and themes on the Drupal site. The module doesn't | unknown | 0.0 | – |
| DRUPAL-CONTRIB-2023-028 | drupal/expandable_formatter | This module enables you to render a field in an expandable/collapsible region. The module doesn't sufficiently sanitize | unknown | 0.0 | – |
| DRUPAL-CONTRIB-2023-029 | drupal/tacjs | This module enables sites to comply with the European cookie law using tarteaucitron.js. The module doesn't sufficientl | unknown | 0.0 | – |
| DRUPAL-CONTRIB-2023-030 | drupal/tfa | This module enables you to allow and/or require users to use a second authentication method in addition to password auth | unknown | 0.0 | – |
| DRUPAL-CONTRIB-2023-031 | drupal/symfony_mailer | The module doesn’t sufficiently protect against malicious links, which means an attacker can trick an administrator into | unknown | 0.0 | – |
| DRUPAL-CONTRIB-2023-032 | drupal/minifyhtml | Carefully crafted input by an attacker will not be sanitized by this module, which can result in a script injection. | unknown | 0.0 | – |
| DRUPAL-CONTRIB-2023-033 | drupal/matomo | This module enables you to add the Matomo web statistics tracking system to your website. The module does not check the | unknown | 0.0 | – |
| DRUPAL-CONTRIB-2023-034 | drupal/acl | The ACL module, short for Access Control Lists, is an API for other modules to create lists of users and give them acces | unknown | 0.0 | – |
| DRUPAL-CONTRIB-2023-035 | drupal/forum_access | This module changes your forum administration page to allow you to set forums private. You can control what user roles c | unknown | 0.0 | – |
| DRUPAL-CONTRIB-2023-037 | drupal/config_pages | This module enables you to build administrative pages for managing configuration objects, which may then be used elsewhe | unknown | 0.0 | – |
| DRUPAL-CONTRIB-2023-038 | drupal/shorthand | This module provides integration with Shorthand, an application which describes itself as "beautifully simple storytelli | unknown | 0.0 | – |
| DRUPAL-CONTRIB-2023-039 | drupal/safedelete | This module aims to prevent broken content references by informing content editors either on delete or archive moderatio | unknown | 0.0 | – |
| DRUPAL-CONTRIB-2023-040 | drupal/datafield | The Data Field module provides a way of building field types that are made up of other fields, a simpler alternative to | unknown | 0.0 | – |
| DRUPAL-CONTRIB-2023-041 | drupal/unified_twig_ext | This module makes PatternLab's custom Twig functions available to Drupal theming. The module's included examples don't | unknown | 0.0 | – |
| DRUPAL-CONTRIB-2023-042 | drupal/obfuscate_email | This module enables you to hide email addresses from bots and site scrapers by using the rot13 strategy. The module doe | unknown | 0.0 | – |
| DRUPAL-CONTRIB-2023-043 | drupal/highlight_php | Provides [highlight.php](https://github.com/scrivo/highlight.php "highlight.php") integration to Drupal, allowing <code> | unknown | 0.0 | – |
| DRUPAL-CONTRIB-2023-044 | drupal/webprofiler | The Webprofiler module provides a way of displaying the Symfony profile debugging tool at the bottom of each page. The | unknown | 0.0 | – |
| DRUPAL-CONTRIB-2023-045 | drupal/mail_login | This module enables users to log in by email address with minimal configurations. Drupal core contains protection again | unknown | 0.0 | – |
| DRUPAL-CONTRIB-2023-047 | drupal/content_moderation_notifications | This module enables notifications to be sent to all users of a particular role, or to the content's author when a piece | unknown | 0.0 | – |
| DRUPAL-CONTRIB-2023-048 | drupal/mail_login | This module enables users to log in by email address with minimal configurations. Drupal core contains protection again | unknown | 0.0 | – |
| DRUPAL-CONTRIB-2023-049 | drupal/paragraphs_admin | This module enables you to view all paragraph entities in an admin view. The module contains an access bypass that all | unknown | 0.0 | – |
| DRUPAL-CONTRIB-2023-050 | drupal/graphql | This module lets you craft and expose a GraphQL schema for Drupal 9 and 10. The module currently does not adequately ve | unknown | 0.0 | – |
| DRUPAL-CONTRIB-2023-051 | drupal/graphql | The GraphQL module enables you to build GraphQL APIs which can include data fetching through Queries and data updates (c | unknown | 0.0 | – |
| DRUPAL-CONTRIB-2023-052 | drupal/mollie | This module enables you to pay online via Mollie. The module might not properly load the correct order to update the pa | unknown | 0.0 | – |
| DRUPAL-CONTRIB-2023-053 | drupal/xsendfile | The Xsendfile module enables fast transfer for private files in Drupal. In order to control private file downloads, the | unknown | 0.0 | – |
| DRUPAL-CONTRIB-2023-054 | drupal/group | The Group module has the ability to make content private to specific groups. When viewing a list of entities, e.g. nodes | unknown | 0.0 | – |
| DRUPAL-CONTRIB-2023-055 | drupal/dvf | This module allows you to turn various data sources (Eg CSV or JSON file) into interactive visualisation. The DVF module | unknown | 0.0 | – |
| DRUPAL-CONTRIB-2025-057 | drupal/advanced_file_destination | The Advanced File Destination module enhances file upload management in Drupal by allowing users to choose and create cu | unknown | 0.0 | – |
| DRUPAL-CONTRIB-2026-040 | drupal/tacjs | This module enables sites to comply with the European cookie law using tarteaucitron.js. The module doesn't sufficientl | unknown | 0.0 | – |
| DRUPAL-CORE-2018-001 | drupal/core | This security advisory fixes multiple vulnerabilities in both Drupal 7 and Drupal 8. See below for a list. #### Comment | unknown | 0.0 | – |
| DRUPAL-CORE-2019-005 | drupal/core | This security release fixes third-party dependencies included in or required by Drupal core. * [CVE-2019-10909: Escape | unknown | 0.0 | – |
| DRUPAL-CORE-2019-009 | drupal/core | A visit to `install.php` can cause cached data to become corrupted. This could cause a site to be impaired until caches | unknown | 0.0 | – |
| DRUPAL-CORE-2019-010 | drupal/core | Drupal 8 core's `file_save_upload()` function does not strip the leading and trailing dot ('.') from filenames, like Dru | unknown | 0.0 | – |
| DRUPAL-CORE-2019-011 | drupal/core | The Media Library module has a security vulnerability whereby it doesn't sufficiently restrict access to media items in | unknown | 0.0 | – |
| DRUPAL-CORE-2019-012 | drupal/core | The Drupal project uses the third-party library [Archive\_Tar](https://pear.php.net/package/Archive_Tar/), which has rel | unknown | 0.0 | – |
| DRUPAL-CORE-2020-001 | drupal/core | The Drupal project uses the third-party library [CKEditor](https://github.com/ckeditor/ckeditor4), which has released a | unknown | 0.0 | – |
| DRUPAL-CORE-2020-002 | drupal/core | The jQuery project released version 3.5.0, and as part of that, disclosed two security vulnerabilities that affect all p | unknown | 0.0 | – |
| DRUPAL-CORE-2021-001 | drupal/core | The Drupal project uses the pear Archive\_Tar library, which has released a security update that impacts Drupal. For mor | unknown | 0.0 | – |
| DRUPAL-CORE-2021-005 | drupal/core | The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor4), library for WYSIWYG editing. CKEditor has | unknown | 0.0 | – |
| DRUPAL-CORE-2021-011 | drupal/core | The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor4) library for WYSIWYG editing. CKEditor has | unknown | 0.0 | – |
| DRUPAL-CORE-2022-001 | drupal/core | jQuery UI is a third-party library used by Drupal. This library was previously thought to be end-of-life. Late in 2021, | unknown | 0.0 | – |
| DRUPAL-CORE-2023-001 | drupal/core | The Media Library module does not properly check entity access in some circumstances. This may result in users with acce | unknown | 0.0 | – |
| DRUPAL-CORE-2023-002 | drupal/core | The Media module does not properly check entity access in some circumstances. This may result in users seeing thumbnails | unknown | 0.0 | – |
| DRUPAL-CORE-2023-003 | drupal/core | The language module provides a Language switcher block which can be placed to provide links to quickly switch between di | unknown | 0.0 | – |
| DRUPAL-CORE-2023-004 | drupal/core | Drupal core provides a page that outputs the markup from `phpinfo()` to assist with diagnosing PHP configuration. If an | unknown | 0.0 | – |
| DRUPAL-CORE-2026-013 | drupal/core | The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor5) library for WYSIWYG editing. CKEditor has | unknown | 0.0 | – |
| GHSA-2237-5r9w-vm8j | opensource-workshop/connect-cms | Connect-CMS information that is restricted to viewing is visible | high | 0.0 | – |
| GHSA-243q-g9j3-qf6r | shopware/core, shopware/platform | non-admin users can create integration role with administrator role | medium | 0.0 | – |
| GHSA-259v-xm34-p7fr | typo3/cms | Typo3 Cross-Site Scripting in Language Pack Handling | medium | 0.0 | – |
| GHSA-26hp-cgjj-m2j3 | fuel/core | fuel/core ImageMagick driver does not escape all shell arguments. | high | 0.0 | – |