Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| GHSA-m95x-m25c-w9mp | phpxmlrpc/phpxmlrpc | XML-RPC for PHP allows access to local files via malicious argument to the Client::send method | medium | 0.0 | – |
| GHSA-m96r-7vqm-j95g | typo3/cms | Typo3 Information Disclosure in User Authentication | medium | 0.0 | – |
| GHSA-mcfc-67vm-j568 | magento/community-edition | Magento Cross-Site Scripting (XSS) vulnerability | medium | 0.0 | – |
| GHSA-mg4c-884j-pcq9 | leantime/leantime | Leantime allows Stored Cross-Site Scripting (XSS) | medium | 0.0 | – |
| GHSA-mgfg-7533-7jf6 | ezsystems/ezplatform-http-cache | ezsystems/ezplatform-http-cache affected by Breach with Varnish VCL | medium | 0.0 | – |
| GHSA-mgr9-6c2j-jxrq | pterodactyl/panel | Pterodactyl has a Reflected XSS vulnerability in “Create New Database Host” | low | 0.0 | – |
| GHSA-mhfv-8rc9-w38c | squizlabs/php_codesniffer | Arbitrary shell execution | high | 0.0 | – |
| GHSA-mqf3-qpc3-g26q | silverstripe/framework | Silverstripe Framework has a Reflected Cross Site Scripting (XSS) in error message | low | 0.0 | – |
| GHSA-mqq7-wxx5-mp8h | prestashop/ps_checkout | ps_checkout allows unauthorized method invocation through unvalidated parameter | low | 0.0 | – |
| GHSA-mvf6-3f2g-xfxf | endroid/qr-code-bundle | endroid/qr-code-bundle File Disclosure via logo_path query parameter | medium | 0.0 | – |
| GHSA-mw28-p745-4jrv | sylius/sylius | A disabled API stays reachable through a percent-encoded path | unknown | 0.0 | – |
| GHSA-mwvh-p3hx-x4gg | ezsystems/ezplatform-kernel | Ibexa Kernel's files with blacklisted extensions can be still saved to drafts | medium | 0.0 | – |
| GHSA-p5c5-gmj4-g48f | typo3/cms | Cross-Site Scripting (XSS) vulnerability in typolinks | medium | 0.0 | – |
| GHSA-p62r-7637-3wwc | laravel/framework | Laravel Hijacked authentication cookies vulnerability | medium | 0.0 | – |
| GHSA-p68v-frgx-4rjp | shopware/core, shopware/platform | Denial of Service via Cache Flooding | low | 0.0 | – |
| GHSA-p76f-wr22-4rv6 | cakephp/cakephp | CakePHP vulnerable to Remote File Inclusion through View template name manipulation | medium | 0.0 | – |
| GHSA-p84g-j2gh-83g3 | typo3/cms | TYPO3 possible cache poisoning on the homepage when anchors are used | high | 0.0 | – |
| GHSA-p9fg-j6ww-953m | friendsofsymfony/rest-bundle | FOSRestBundle issue with broken validation of JSONP callbacks | medium | 0.0 | – |
| GHSA-p9mp-vq4v-v5m5 | ezsystems/ezpublish-legacy | eZ Publish Legacy Passwordless login for LDAP users | high | 0.0 | – |
| GHSA-pcpm-vc4v-cmvx | ezsystems/ezplatform-admin-ui | eZ Platform users with the Company admin role can assign any role to any user | critical | 0.0 | – |
| GHSA-pjj4-jjgc-h3r8 | shopware/platform | Authenticated remote code execution | medium | 0.0 | – |
| GHSA-pjx8-984p-7p3x | friendsofsymfony/user-bundle | FOSUserBundle Entropy is lost in the TokenGenerator | medium | 0.0 | – |
| GHSA-pmxp-7224-h794 | typo3/cms | Denial of Service (DoS) attack possibility in TYPO3 component Indexed Search | medium | 0.0 | – |
| GHSA-ppgf-8745-8pgx | typo3/cms | Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS | high | 0.0 | – |
| GHSA-pqjm-xcp8-wgmm | ezsystems/ezpublish-legacy | Ez Platform and Legacy are prone to an insecure interpretation of PHP/PHAR uploads | medium | 0.0 | – |
| GHSA-prpf-cj87-hwvr | magento/community-edition | Magento Patch SUPEE-10752 - Multiple security enhancements vulnerabilities | critical | 0.0 | – |
| GHSA-pxqj-xrv5-qvjf | phpxmlrpc/phpxmlrpc | XML-RPC for PHP's debugger vulnerable to possible XSS attack | medium | 0.0 | – |
| GHSA-q37h-jhf3-85cj | wintercms/winter | Bypass of CMS Safe Mode Security Feature | medium | 0.0 | – |
| GHSA-q3x8-6898-23g3 | ibexa/user | ibexa/user login enumerates user accounts | medium | 0.0 | – |
| GHSA-q4xf-7fw5-4x8v | illuminate/auth | Laravel Hijacked authentication cookies vulnerability | medium | 0.0 | – |
| GHSA-q683-8468-r6h6 | web-auth/webauthn-symfony-bundle | WebauthnAuthenticator leaks sensitive HTTP headers through INFO-level logs | medium | 0.0 | – |
| GHSA-q73v-79x3-jv2w | ezsystems/ezplatform-admin-ui | eZ Platform Admin UI Cross-site Scripting vulnerability | high | 0.0 | – |
| GHSA-q79m-c546-2g63 | cakephp/cakephp | CakePHP vulnerable to Denial of Service attack through XML payloads | high | 0.0 | – |
| GHSA-q7qq-9gx2-ggxv | phpxmlrpc/phpxmlrpc | phpxmlrpc vulnerable to argument injection | medium | 0.0 | – |
| GHSA-q9c4-9v5m-597p | typo3/cms | Typo3 Information Disclosure in Backend User Interface | medium | 0.0 | – |
| GHSA-qffc-gwpp-m2xr | typo3/cms | XML External Entity (XXE) Processing in TYPO3 Core | high | 0.0 | – |
| GHSA-qg7c-q3vq-rgxr | shopware/core, shopware/platform | Leak of information via Store-API aggregations in shopware/platform and shopware/core | critical | 0.0 | – |
| GHSA-qhjc-hg94-245v | ezsystems/ezplatform | eZ Platform Prevent accepting app.php in URL in Platform.sh | medium | 0.0 | – |
| GHSA-qmwf-j7g7-f5jw | typo3/cms | Cross-Site Scripting in third party library mso/idna-convert | medium | 0.0 | – |
| GHSA-qr5f-6fcv-w69q | typo3/cms | Typo3 Security Misconfiguration in Frontend Session Handling | medium | 0.0 | – |
| GHSA-qrxh-46mr-pr7q | typo3/cms | TYPO3 is susceptible to Cross-Site Flashing | medium | 0.0 | – |
| GHSA-qvc5-cfrr-384v | shopware/core, shopware/platform | RCE in Third Party Library in Shopware | low | 0.0 | – |
| GHSA-qvgg-r6rq-vwfx | datadog/dd-trace | datadog/dd-trace Circumvents open_basedir INI directive | low | 0.0 | – |
| GHSA-qvhr-55hg-3qwv | shopware/core, shopware/platform | Non-persistent XSS in the Storefront in Shopware | low | 0.0 | – |
| GHSA-qwvp-268g-jjm8 | livewire/livewire | Data Leakage Vulnerability in livewire/livewire | medium | 0.0 | – |
| GHSA-r2r8-36pq-27cm | nzo/url-encryptor-bundle | nzo/url-encryptor-bundle Insecure default secret key and IV allowing anyone to decrypt values | high | 0.0 | – |
| GHSA-r5rx-53g9-25rj | ezsystems/ezplatform-admin-ui-assets | Ibexa eZ Platform Admin UI assets XSS vulnerabilities in back office | medium | 0.0 | – |
| GHSA-r64m-qchj-hrjp | shopware/core, shopware/platform | Webcache Poisoning in shopware/platform and shopware/core | critical | 0.0 | – |
| GHSA-r67r-42wx-c8r7 | drupal/drupal | Drupal External URL injection through URL aliases leading to Open Redirect | medium | 0.0 | – |
| GHSA-r6mm-wmhf-849m | typo3/flow | Time-Based Information Disclosure Vulnerability in Flow | medium | 0.0 | – |