Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| GHSA-26hq-7286-mg8f | magento/community-edition | Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability | critical | 0.0 | – |
| GHSA-27qh-8cxx-2cr5 | aws/aws-sdk-php | AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters | high | 0.0 | – |
| GHSA-2867-6rrm-38gr | illuminate/cookie | Laravel Cookie serialization vulnerability | high | 0.0 | – |
| GHSA-28fw-88hq-6jmm | shopware/shopware | Persistent XSS in shopping worlds | low | 0.0 | – |
| GHSA-2fch-hv74-fgw9 | wwbn/avideo | Cross site scripting (XSS) in wwbn/avideo | high | 0.0 | – |
| GHSA-2ffv-r4r9-r8xr | illuminate/cookie | Laravel RCE vulnerability in "cookie" session driver | critical | 0.0 | – |
| GHSA-2frx-j9hj-6c65 | lexik/jwt-authentication-bundle | User enumeration in authentication mechanisms | low | 0.0 | – |
| GHSA-2gq2-m628-33xp | gregwar/rst | gregwar/rst Local File Inclusion Vulnerability | high | 0.0 | – |
| GHSA-2jqj-5qv2-xvcg | ezsystems/ezplatform-richtext | ezsystems/ezplatform-richtext allows access to external entities in XML | high | 0.0 | – |
| GHSA-2jx3-65f3-xr8r | spomky-labs/otphp | spomky-labs/otphp: Mass-assignment in Factory::loadFromProvisioningUri lets a hostile provisioning URI corrupt OTP state or leak an uncaught | medium | 0.0 | – |
| GHSA-2mx6-fq24-g2mh | ibexa/admin-ui | ibexa/admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal | medium | 0.0 | – |
| GHSA-2p4f-vc9q-r5vp | typo3/flow | Typo3 Arbitrary file upload and XML External Entity processing | medium | 0.0 | – |
| GHSA-2p6g-gjp8-ggg9 | personnummer/personnummer | personnummer/php vulnerable to Improper Input Validation | low | 0.0 | – |
| GHSA-2rh5-jvgx-pgw3 | ezsystems/ezplatform | Any storage file can be downloaded from p.sh if full server path is known | high | 0.0 | – |
| GHSA-2vh3-cj9j-mcj5 | ezsystems/ezpublish-legacy | eZ Publish Legacy Cross-site Scripting (XSS) in 'disabled module' error template | medium | 0.0 | – |
| GHSA-2w9p-xxqr-h253 | ezsystems/ezplatform-kernel | eZ Platform Object Injection in SiteAccessMatchListener | high | 0.0 | – |
| GHSA-2x4v-g8cx-jxrq | ibexa/core | Login timing attack in ibexa/core | critical | 0.0 | – |
| GHSA-32wx-4gxx-h48f | flarum/tags | Users can edit the tags of any discussion | medium | 0.0 | – |
| GHSA-342c-vcff-2ff2 | ezsystems/ezplatform-kernel | Login timing attack in ezsystems/ezplatform-kernel | critical | 0.0 | – |
| GHSA-36mj-6r7r-mqhf | ezsystems/ezplatform-rest | User can obtain JWT token even if account is disabled | high | 0.0 | – |
| GHSA-394j-x37r-2q27 | ibexa/core | Ibexa DXP users with the Company admin role can assign any role to any user | critical | 0.0 | – |
| GHSA-3988-h75v-hwf6 | squizlabs/php_codesniffer | Arbitrary shell execution | high | 0.0 | – |
| GHSA-39j2-4p9j-5w4j | ezsystems/ezpublish-legacy | Ez Platform Object Injection in legacy shop module | medium | 0.0 | – |
| GHSA-3fgr-xjr6-xqm8 | phpxmlrpc/phpxmlrpc | code injection in phpxmlrpc/phpxmlrpc | high | 0.0 | – |
| GHSA-3fmq-x9q6-wm39 | paragonie/random_compat | random_compat Uses insecure CSPRNG | low | 0.0 | – |
| GHSA-3fvf-2gp4-89wq | barryvdh/laravel-translation-manager | Possibility for Denial of Service by overwriting PHP files with language exports | medium | 0.0 | – |
| GHSA-3g43-xfrw-pv5m | ezsystems/repository-forms | eZ Platform User data disclosure | high | 0.0 | – |
| GHSA-3h6j-9x8m-rg3g | j0k3r/graby | Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config | low | 0.0 | – |
| GHSA-3hfj-qcvj-4hx8 | leantime/leantime | Leantime has Missing Authorization Check for Host Parameter | low | 0.0 | – |
| GHSA-3jxq-5xhh-9jr3 | typo3/cms | Cross-Site Scripting (XSS) in TYPO3 component Backend | medium | 0.0 | – |
| GHSA-3p7g-wrgg-wq45 | ibexa/graphql | GraphQL queries can expose password hashes | critical | 0.0 | – |
| GHSA-3pcr-4982-548m | shopware/production, shopware/shopware | Exposure of .env if project root is configured as web root in shopware/production | medium | 0.0 | – |
| GHSA-3prj-6hqw-cm82 | web-token/jwt-framework, web-token/jwt-library | PHP JWT Library: PBES2-HS*+A*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of service | high | 0.0 | – |
| GHSA-3vwr-jj4f-h98x | ezsystems/ezpublish-kernel | eZ Publish Remote code execution in file uploads | high | 0.0 | – |
| GHSA-3wgq-h4fr-cwg5 | macropay-solutions/laravel-crud-wizard-free | laravel-crud-wizard-free has File Validation Bypass | medium | 0.0 | – |
| GHSA-446q-xxg5-3vhh | ezsystems/repository-forms | eZ Platform users with the Company admin role can assign any role to any user | critical | 0.0 | – |
| GHSA-44jg-mv3h-wj6g | solspace/craft-freeform | solspace/craft-freeform Vulnerable to XSS in `PhpSpreadsheet` HTML Writer Due to Unsanitized Styling Data | low | 0.0 | – |
| GHSA-44m4-9cjp-j587 | ezsystems/ezpublish-kernel | IBX-1392: Image filenames sanitization | high | 0.0 | – |
| GHSA-44pg-c29v-hp6r | laravel/framework | Laravel Guard bypass in Eloquent models | medium | 0.0 | – |
| GHSA-4542-p56h-8xww | typo3/neos | Cross-Site Scripting (XSS) vulnerabilities in Neos | high | 0.0 | – |
| GHSA-45qm-j4m9-whv9 | ezsystems/ezplatform | eZ Platform CSRF token in login form is disabled by default | high | 0.0 | – |
| GHSA-4c2w-v5rq-5mx7 | ezsystems/ezplatform-admin-ui-assets | eZ Platform Editor Cross-site Scripting (XSS) | medium | 0.0 | – |
| GHSA-4h8f-c635-25p7 | ibexa/post-install | ibexa/post-install affected by Breach with Varnish VCL | medium | 0.0 | – |
| GHSA-4mg9-vhxq-vm7j | illuminate/database, laravel/framework | SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database | high | 0.0 | – |
| GHSA-4qpj-gxxg-jqg4 | swiftmailer/swiftmailer | Swiftmailer Sendmail transport arbitrary shell execution | critical | 0.0 | – |
| GHSA-4rr6-gf59-ggw5 | namshi/jose | namshi/jose - Verification bypass | critical | 0.0 | – |
| GHSA-4v5g-8pq2-32m2 | typo3/phar-stream-wrapper | By-passing Protection of PharStreamWrapper Interceptor | medium | 0.0 | – |
| GHSA-52xf-h226-pfgx | leantime/leantime | Leantime allows Refelected Cross-Site Scripting (XSS) | medium | 0.0 | – |
| GHSA-5739-39v2-5754 | web-token/jwt-framework, web-token/jwt-library | RSA1_5 (RSAES-PKCS1-v1_5) decryption lacks implicit rejection, exposing a Bleichenbacher/Marvin padding oracle | medium | 0.0 | – |
| GHSA-5822-pw57-vv37 | pterodactyl/panel | XSS vulnerability when listing users on add & modify server pages. | medium | 0.0 | – |