Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| GHSA-58h5-h554-429q | ezsystems/ezplatform-admin-ui | ezplatform-admin-ui vulnerable to Cross-Site Scripting (XSS) | critical | 0.0 | – |
| GHSA-58q2-9x27-h2jm | solspace/craft-freeform | solspace/craft-freeform Has a DoS Vulnerability | low | 0.0 | – |
| GHSA-58xv-7h9r-mx3c | drupal/drupal | Drupal Malicious file upload with filenames stating with dot | medium | 0.0 | – |
| GHSA-595p-g7xc-c333 | algolia/algoliasearch-magento-2 | Algolia Search & Discovery for Magento 2 Has Untrusted Data Handling | medium | 0.0 | – |
| GHSA-5cxf-xx9j-54jc | typo3/cms | Multiple Cross-Site Scripting vulnerabilities in TYPO3 backend | medium | 0.0 | – |
| GHSA-5gmh-85x8-5cx7 | magento/community-edition | Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities | critical | 0.0 | – |
| GHSA-5j86-5xvg-7q93 | typo3/cms | TYPO3 Cross-Site Scripting (XSS) in form component | medium | 0.0 | – |
| GHSA-5j8p-438x-rgg5 | onelogin/php-saml | SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475 | critical | 0.0 | – |
| GHSA-5mpg-w6q2-2vrw | sylius/sylius | Unpublished product reviews disclosed through the Shop API item endpoint | unknown | 0.0 | – |
| GHSA-5q58-x5h2-v5rx | shopware/core, shopware/platform | Authenticated Privilege Escalation | low | 0.0 | – |
| GHSA-5q8v-j673-m5v4 | grumpydictator/firefly-iii | Firefly III user API endpoints expose all users' information to any authenticated user (IDOR) | medium | 0.0 | – |
| GHSA-5r6x-g6jv-4v87 | ibexa/admin-ui | Ibexa Admin UI XSS vulnerabilities in back office | medium | 0.0 | – |
| GHSA-5vv7-j593-mgjc | neos/flow | Neos Flow Arbitrary file upload and XML External Entity processing | medium | 0.0 | – |
| GHSA-63cr-xg3f-8jvr | leantime/leantime | Leantime allows Stored Cross-Site Scripting (XSS) | medium | 0.0 | – |
| GHSA-64vj-933f-6pm3 | ezsystems/ezpublish-kernel | eZ Platform Object Injection in SiteAccessMatchListener | high | 0.0 | – |
| GHSA-6ccv-8fgf-cjpw | drupal/core | Drupal core Denial of Service vulnerability | medium | 0.0 | – |
| GHSA-6cj3-rc4p-f38f | neos/neos | Cross-site Scripting vulnerabilities in Neos | high | 0.0 | – |
| GHSA-6f9m-v7mp-7jjq | typo3/cms | Authentication Bypass in TYPO3 CMS | medium | 0.0 | – |
| GHSA-6fc6-cj2j-h22x | typo3/cms | TYPO3 Multiple Cross-Site Scripting vulnerabilities in frontend | medium | 0.0 | – |
| GHSA-6gv9-7q4g-pmvm | shopware/shopware | Persistent XSS in customer module in Shopware | low | 0.0 | – |
| GHSA-6hg4-vp5q-47mw | cakephp/cakephp | CakePHP allows direct access of prefixed controller actions | medium | 0.0 | – |
| GHSA-6jq6-x4cx-qvcm | grumpydictator/firefly-iii | Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig) | medium | 0.0 | – |
| GHSA-6jvx-8ch9-j2jr | laravel/framework | Laravel Cookie serialization vulnerability | high | 0.0 | – |
| GHSA-6mgp-v5cm-ghg5 | drupal/core | Drupal core Remote Code Execution | critical | 0.0 | – |
| GHSA-6mjq-9x4w-m3w9 | friendsofsymfony/user-bundle | FOSUserBundle Session Hijacking Vulnerability | high | 0.0 | – |
| GHSA-6q9v-4hq6-5m67 | doctrine/orm | Doctrine SQL injection vulnerability | critical | 0.0 | – |
| GHSA-6vvh-pxr4-25r7 | web-token/jwt-experimental, web-token/jwt-framework, web-token/jwt-library | PHP JWT Framework: Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on decry | medium | 0.0 | – |
| GHSA-6wjw-qf87-fv5v | illuminate/encryption | Laravel Encrypter Failure to decryption vulnerability | low | 0.0 | – |
| GHSA-6wm4-3rjj-c8xx | magento/community-edition | Magento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities | critical | 0.0 | – |
| GHSA-6xch-2vxx-5pvr | ezsystems/ezplatform | eZ Platform Rules to disable executable access are ignored on Platform.sh (eZ Cloud) | medium | 0.0 | – |
| GHSA-74j9-xhqr-6qv3 | silverstripe/framework | Reflected Cross Site Scripting (XSS) in error message | low | 0.0 | – |
| GHSA-7644-cxp8-h23r | ibexa/admin-ui | ibexa/admin-ui vulnerable to Cross-site Scripting in content type name/shortname | critical | 0.0 | – |
| GHSA-769f-539v-f5jg | prestashop/gamification | PrestaShop gamification module ZIP archives were vulnerable from CVE-2017-9841 | high | 0.0 | – |
| GHSA-76r7-h46w-463r | pimcore/pimcore | Cross Site Scripting (XSS) in Model\DataObject\Data\UrlSlug | medium | 0.0 | – |
| GHSA-7852-w36x-6mf6 | laravel/framework | Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior | medium | 0.0 | – |
| GHSA-78hm-5hjw-58mh | ua-parser/uap-php | ua-parser/uap-php ReDoS vulnerability | medium | 0.0 | – |
| GHSA-78vr-q6cf-c7p6 | craftcms/commerce | Craft Commerce: Partial Payment Amount Without Lower Bound Validation | medium | 0.0 | – |
| GHSA-7crc-r3wg-cfgf | ezsystems/ezplatform-solr-search-engine | Json response for search reveals Solr credentials | critical | 0.0 | – |
| GHSA-7f4f-p7mq-p4fv | drupal/core | Drupal External URL injection through URL aliases leading to Open Redirect | medium | 0.0 | – |
| GHSA-7fjp-g4m7-fx23 | pwweb/laravel-core | User (Encrypted) Password Field Being Serialised | low | 0.0 | – |
| GHSA-7fjv-25q9-2w88 | laravel/socialite | State Guessing Vulnerability in laravel/socialite | medium | 0.0 | – |
| GHSA-7m2v-x7rg-5hm5 | silverstripe/framework | silverstripe/framework vulnerable to user enumeration via timing attack on login and password reset forms | high | 0.0 | – |
| GHSA-7v68-3pr5-h3cr | drupal/core | Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution | critical | 0.0 | – |
| GHSA-7vcx-v65q-9wpg | phpxmlrpc/phpxmlrpc | XML-RPC for PHP's `Wrapper::buildClientWrapperCode` method allows code injection via malicious `$client` argument | medium | 0.0 | – |
| GHSA-7vfx-4246-jcfh | solidinvoice/solidinvoice | SolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API tokens and notification transport settings | high | 0.0 | – |
| GHSA-7vwg-39h8-8qp8 | ezsystems/ezplatform-rest | /user/sessions endpoint allows detecting valid accounts | high | 0.0 | – |
| GHSA-829q-v5g8-hhxc | cakephp/cakephp | CakePHP has incorrect Cross-Site Request Forgery validation | medium | 0.0 | – |
| GHSA-82rv-45pc-v28w | ezsystems/ezpublish-legacy | eZ Publish Legacy Patch EZSA-2018-001 for Several vulnerabilities | high | 0.0 | – |
| GHSA-862m-5253-832r | auth0/wordpress | Auth0 Wordpress Plugin vulnerable to Deserialization of Untrusted Data | critical | 0.0 | – |
| GHSA-86xw-vmcx-9mj4 | drupal/drupal | Drupal Content moderation Access bypass | medium | 0.0 | – |