Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| GHSA-f84q-mgj9-8jfc | drupal/core | Drupal Content moderation Access bypass | medium | 0.0 | – |
| GHSA-f884-gm86-cg3q | prestashop/ps_facetedsearch | PrestaShop module ps_facetedsearch might be vulnerable from CVE-2017-9841 | high | 0.0 | – |
| GHSA-fgrx-4637-fcf5 | fuel/core | fuel/core Crypt encryption compromised. | medium | 0.0 | – |
| GHSA-fh7v-q458-7vmw | ibexa/http-cache | ibexa/http-cache affected by Breach with Varnish VCL | medium | 0.0 | – |
| GHSA-fxwm-rx68-p5vx | ezsystems/ezplatform-richtext | XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext | medium | 0.0 | – |
| GHSA-g2qj-pmxm-9f8f | symfony/security-http, symfony/symfony | User enumeration in authentication mechanisms | low | 0.0 | – |
| GHSA-g3j5-mpp2-2fqm | symfont/process | symfont/process typosquatting malware spoofs symfony/process | high | 0.0 | – |
| GHSA-g4f2-2pf3-2pwj | react/http | Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS in react/http | unknown | 0.0 | – |
| GHSA-g4pf-3jvq-2gcw | typo3/cms | TYPO3 Remote Code Execution in third party library swiftmailer | high | 0.0 | – |
| GHSA-g4xv-r3qw-v3q2 | typo3/neos | typo3 Information Disclosure Security Note | high | 0.0 | – |
| GHSA-g6jc-xrc3-4wwq | ibexa/admin-ui | Ibexa DXP users with the Company admin role can assign any role to any user | critical | 0.0 | – |
| GHSA-g7m4-839x-ch6v | spomky-labs/otphp | spomky-labs/otphp: Unbounded digits parameter in a provisioning URI triggers an uncaught DivisionByZeroError in OTP generation | high | 0.0 | – |
| GHSA-g95c-xc83-8353 | ibexa/core | Ibexa DXP Download route allows filename change | low | 0.0 | – |
| GHSA-g9rv-6g56-65h8 | typo3/cms | Typo3 Security Misconfiguration in User Session Handling | medium | 0.0 | – |
| GHSA-gj48-w74w-8gvm | typo3/cms | Path Traversal in TYPO3 Core | medium | 0.0 | – |
| GHSA-gm98-g2wf-7c68 | amphp/artax | amphp/artax Cookie leakage to wrong origins and non-restricted cookie acceptance | medium | 0.0 | – |
| GHSA-gq4g-fpc9-vjfq | web-auth/webauthn-lib | Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protectio | low | 0.0 | – |
| GHSA-gqcf-83rq-gpfr | ibexa/post-install | Any storage file can be downloaded from p.sh if full server path is known | high | 0.0 | – |
| GHSA-gv2c-5g79-h73c | ezsystems/ezplatform-kernel | Ibexa ezplatform-kernel download route allows filename change | low | 0.0 | – |
| GHSA-gvj8-4cj4-h776 | ibexa/core | Object state limitation has no effect | critical | 0.0 | – |
| GHSA-h29g-c9cx-c73q | torrentpier/torrentpier | torrentpier has PHP Serialize Injections | critical | 0.0 | – |
| GHSA-h533-5v22-8vcp | firebase/php-jwt | firebase/php-jwt: "None" Algorithm treated as valid on tokens | critical | 0.0 | – |
| GHSA-h63c-xvpf-264j | adodb/adodb-php | ADOdb SQL injection vulnerability | critical | 0.0 | – |
| GHSA-h6w8-27ph-c385 | leantime/leantime | Leantime has Insufficiently Protected Credentials | medium | 0.0 | – |
| GHSA-h76r-rr27-3gm4 | sylius/sylius | Promotion and coupon usage limit bypass via race condition | unknown | 0.0 | – |
| GHSA-h934-f4m4-wc8x | typo3/cms | Typo3 Information Disclosure in Page Tree | low | 0.0 | – |
| GHSA-h97c-qp24-439v | laravel/socialite | Insecure State Generation in laravel/socialite | medium | 0.0 | – |
| GHSA-hfpp-2vhw-qq43 | ezsystems/ezplatform-user | eZ Platform Admin UI Password reset vulnerability | high | 0.0 | – |
| GHSA-hhw9-35p2-q2c5 | socialiteproviders/steam | Steam Socialite Provider v1 does not correctly validate openid server | critical | 0.0 | – |
| GHSA-hq37-rfjc-mr8h | typo3/cms | Cross-Site Scripting (XSS) in TYPO3 Backend | medium | 0.0 | – |
| GHSA-hr7j-63v7-vj7g | pterodactyl/panel | Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change | high | 0.0 | – |
| GHSA-hrfh-fp4x-crrq | shopware/shopware | Persistent XSS in newsletter module in Shopware | low | 0.0 | – |
| GHSA-hvgw-gg3p-295j | klaviyo/magento2-extension | Read private customer data reclaiming carts in Klaviyo Magento | medium | 0.0 | – |
| GHSA-hwmc-r6mf-jh83 | spatie/schema-org | Schema.org has cross-site scripting (XSS) via script break-out in toScript() output | low | 0.0 | – |
| GHSA-hww5-6x85-mc24 | typo3/cms | Typo3 Arbitrary Code Execution and Cross-Site Scripting in Backend API | medium | 0.0 | – |
| GHSA-hxhc-wmg8-xrqf | namshi/jose | namshi/jose insecure JSON Web Signatures (JWS) | high | 0.0 | – |
| GHSA-j7f5-gfqm-pcx3 | pterodactyl/panel | Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system | medium | 0.0 | – |
| GHSA-j9q2-f9q7-jhgq | cakephp/cakephp | CakePHP SecurityComponent cross form submission issue | medium | 0.0 | – |
| GHSA-jc38-x7x8-2xc8 | web-token/jwt-bundle, web-token/jwt-experimental, web-token/jwt-framework +1 more | PHP JWT Framework: JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks | high | 0.0 | – |
| GHSA-jf8c-36vw-98x4 | drupal/drupal | Drupal core Remote Code Execution | critical | 0.0 | – |
| GHSA-jfxf-4frr-9j3q | neos/neos | XSS in various backend modules due to (un)escaping in JS notification module | medium | 0.0 | – |
| GHSA-jjx7-8462-w4m4 | drupal/drupal | Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution | critical | 0.0 | – |
| GHSA-jmh9-6rjq-gjh9 | pimcore/admin-ui-classic-bundle | Vulnerable embedded jQuery Version | medium | 0.0 | – |
| GHSA-jpwx-ffjq-wr4w | ezsystems/ezpublish-legacy | Content object state fetch functions open to SQL injection | high | 0.0 | – |
| GHSA-jq9q-6p42-qpr7 | ezsystems/ezdemo-ls-extension | Cross-site Scripting (XSS) in DemoBundle/ezdemo bundled VideoJS | high | 0.0 | – |
| GHSA-jrpw-8884-2747 | ezsystems/ezplatform-admin-ui-assets | eZ Platform Bundled jQuery affected by CVE-2019-11358 | medium | 0.0 | – |
| GHSA-jvg4-9rc2-wvcr | shopware/platform | Generation of fake documents via public GET-call | low | 0.0 | – |
| GHSA-jwvj-pwww-3mj5 | laravel/framework | laravel framework Unexpected database bindings via requests | high | 0.0 | – |
| GHSA-jxcx-3h54-qqxx | silverstripe/admin | SilverStripe CMS Cross-site Scripting vulnerabilities inherited from TinyMCE | medium | 0.0 | – |
| GHSA-m2hp-5x78-74mg | typo3/flow | Insecure Unserialize Vulnerability in FLOW3 | medium | 0.0 | – |