Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| GHSA-87mp-xc4x-x8rh | asymmetricrypt/asymmetricrypt | asymmetricrypt/asymmetricrypt Padding Oracle Vulnerability in RSA Encryption | medium | 0.0 | – |
| GHSA-88rc-3p98-rgvx | shopware/core, shopware/platform | After order payment process manipulation in shopware/platform and shopware/core | critical | 0.0 | – |
| GHSA-8c2g-f8jm-5cr7 | ibexa/fieldtype-richtext | ibexa/fieldtype-richtext has an XSS vulnerability via acronym custom tag in Rich Text | medium | 0.0 | – |
| GHSA-8c85-4rr5-chr4 | ezsystems/demobundle | Cross-site Scripting (XSS) in DemoBundle/ezdemo bundled VideoJS | high | 0.0 | – |
| GHSA-8h28-f46f-m87h | typo3/cms | Insecure Deserialization in TYPO3 CMS | high | 0.0 | – |
| GHSA-8h83-chh2-fchp | ezsystems/ezplatform-kernel | eZ Platform users with the Company admin role can assign any role to any user | critical | 0.0 | – |
| GHSA-8j7c-682x-r9f2 | magento/community-edition | Magento RCE,XSS and other vulnerabilities | critical | 0.0 | – |
| GHSA-8j9v-4hhh-x43c | typo3/cms | Cross-Site Scripting (XSS) in TYPO3 component CSS styled content | medium | 0.0 | – |
| GHSA-8pfh-mm2g-hmc3 | shopware/core, shopware/platform | Authenticated Server Side Request Forgery | low | 0.0 | – |
| GHSA-8v5x-6vv5-jv4g | amphp/http | amphp/http Host Header Injection vulnerability | medium | 0.0 | – |
| GHSA-8wx3-8m4x-g5h4 | friendsofsymfony/user-bundle | FOSUserBundle User Identity Validation Vulnerability | medium | 0.0 | – |
| GHSA-92xh-6x7v-4rmq | leantime/leantime | Leantime allows Cross-Site Request Forgery (CSRF) | medium | 0.0 | – |
| GHSA-946c-f9w6-2c25 | ezsystems/ezpublish-kernel | Download route allows filename change in eZpublish kernel | low | 0.0 | – |
| GHSA-9895-26wr-4fgv | ezsystems/ezpublish-legacy | EZsystems Remote code execution in file uploads | high | 0.0 | – |
| GHSA-9895-53fc-98v2 | typo3/cms | TYPO3 SQL Injection in dbal | high | 0.0 | – |
| GHSA-98j6-67v3-mw34 | auth0/symfony | Auth0 Symfony SDK Deserialization of Untrusted Data vulnerability | critical | 0.0 | – |
| GHSA-99c7-c3mw-mxhv | ezsystems/ezplatform-admin-ui | ezsystems/ezplatform-admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal | medium | 0.0 | – |
| GHSA-99r3-xmmq-7q7g | ezsystems/ezpublish-kernel | eZ Platform users with the Company admin role can assign any role to any user | critical | 0.0 | – |
| GHSA-9cq2-pcgr-8h62 | ezsystems/ezfind-ls | Cross-site Scripting in eZFind spellcheck | high | 0.0 | – |
| GHSA-9gxv-x7rp-r2hc | gree/jose | gree/jose - "None" Algorithm treated as valid in tokens | critical | 0.0 | – |
| GHSA-9j39-4686-m3c4 | ibexa/core | Ibexa Kernel's files with blacklisted extensions can be still saved to drafts | medium | 0.0 | – |
| GHSA-9jp8-cwwx-p64q | ezsystems/ezplatform-admin-ui | XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext | medium | 0.0 | – |
| GHSA-9m6v-8fxc-4r44 | sulu/sulu | Sulu: Used API Keys may be available via Admin API | low | 0.0 | – |
| GHSA-9qv6-4pwm-m68f | ibexa/fieldtype-richtext | Ibexa RichText Field Type XSS vulnerabilities in back office | medium | 0.0 | – |
| GHSA-9vxv-wpv4-f52p | shopware/shopware | Information leakage in Error Handler | medium | 0.0 | – |
| GHSA-9wrw-p9rm-r782 | onelogin/php-saml | onelogin/php-saml Improper signature validation on LogoutRequest/LogoutResponse. | low | 0.0 | – |
| GHSA-9wwx-c723-vm8x | ezsystems/ezpublish-kernel | eZ Platform REST API returns list of all SiteAccesses | medium | 0.0 | – |
| GHSA-c2p2-hgjg-9r3f | islandora/crayfish | Crayfish Allows Remote Code Execution via hypercube X-Islandora-Args Header | critical | 0.0 | – |
| GHSA-c39w-3pjx-qc7m | leantime/leantime | Leantime allows Stored Cross-Site Scripting (XSS) | high | 0.0 | – |
| GHSA-c42h-56wx-h85q | auth0/login | laravel-auth0 SDK Deserialization of Untrusted Data vulnerability | critical | 0.0 | – |
| GHSA-c4c3-j73v-634r | silverstripe/framework | silverstripe/framework has Cross-site Scripting vulnerability in page history comparison | medium | 0.0 | – |
| GHSA-c8rp-cgf4-937w | mezzio/mezzio-swoole | mezzio-swoole Applications Using Diactoros Vulnerable to HTTP Host Header Attack | high | 0.0 | – |
| GHSA-cc2j-92jq-wgjg | ezsystems/ezpublish-legacy | eZ Publish Information disclosure in backend content tree menu | high | 0.0 | – |
| GHSA-cc2w-ghc5-m5qr | illuminate/database | Laravel Risk of mass-assignment vulnerabilities | medium | 0.0 | – |
| GHSA-ccgh-6w73-crf8 | sylius/sylius | Channel-based payment method restriction bypass on shop payment request API endpoint | unknown | 0.0 | – |
| GHSA-cfcv-q4qq-2ph4 | pimcore/pimcore | CKEditor 4 vulnerabilities in versions <4.16.1 | medium | 0.0 | – |
| GHSA-cg4m-qjjp-7497 | typo3/cms | TYPO3 Cross-Site Scripting in link validator component | medium | 0.0 | – |
| GHSA-cg84-55jx-4237 | ezsystems/ezplatform-admin-ui | eZ Platform Password reset vulnerability | high | 0.0 | – |
| GHSA-cj3w-g42v-wcj6 | ibexa/fieldtype-richtext | ibexa/fieldtype-richtext allows access to external entities in XML | high | 0.0 | – |
| GHSA-cq6h-w3mc-57f4 | shopware/core, shopware/platform | Information exposure via query strings in URL | low | 0.0 | – |
| GHSA-cqw6-3fwg-cfv4 | sylius/sylius | Percent-encoded API path bypasses shop API ownership filters, exposing and modifying other customers' data | unknown | 0.0 | – |
| GHSA-cr6x-45gj-q6f5 | doctrine/mongodb-odm | EncryptedFieldsMapGenerator may silently omit encrypted fields when a document has embedded documents | unknown | 0.0 | – |
| GHSA-cv25-3pxr-4q7x | magento/community-edition | Magento Open Source Security Advisory: Patch SUPEE-10975 | critical | 0.0 | – |
| GHSA-f3wp-xpv2-6vmg | silverstripe/framework | silverstripe/framework password encryption salt not updated | low | 0.0 | – |
| GHSA-f43j-8hq4-2xj9 | silverstripe/framework | silverstripe/framework uploaded PHP script execution in assets | medium | 0.0 | – |
| GHSA-f57v-q966-7fh6 | monolog/monolog | Monolog Header injection in NativeMailerHandler | low | 0.0 | – |
| GHSA-f5rr-9r84-wwqf | typo3/cms | Typo3 Broken Access Control in Import Module | medium | 0.0 | – |
| GHSA-f679-254h-qhvj | leantime/leantime | Leantime allows Cross-Site Scripting (XSS) | low | 0.0 | – |
| GHSA-f6p5-76fp-m248 | zendframework/zend-diactoros, zendframework/zend-feed, zendframework/zend-http | URL Rewrite vulnerability in multiple zendframework components | high | 0.0 | – |
| GHSA-f6p7-8xfw-fjqq | shopware/shopware | Authenticated Stored XSS in Administration | medium | 0.0 | – |