Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| GHSA-r7pm-mw8g-p7px | ezsystems/ezplatform-admin-ui | Ibexa eZ Platform Admin UI XSS vulnerabilities in back office | medium | 0.0 | – |
| GHSA-rj3w-99gc-8j58 | laravel/framework | Laravel Risk of mass-assignment vulnerabilities | medium | 0.0 | – |
| GHSA-rq6q-hjvh-5mwh | neos/swiftmailer | Flow Swift Mailer package Remote code execution | critical | 0.0 | – |
| GHSA-rrwm-8wqm-gwgv | pimcore/pimcore | Cross-site Scripting (XSS) - stored in Print Documents | medium | 0.0 | – |
| GHSA-rwr8-xrpw-9qf5 | solspace/craft-freeform | solspace/craft-freeform Exposed to Known Axios Vulnerabilities via Precompiled Assets | low | 0.0 | – |
| GHSA-v4q9-437p-mhpg | leantime/leantime | Leantime allows Cross Site Scripting (XSS) and SQL Injection (SQLi) | high | 0.0 | – |
| GHSA-v6xp-ccvx-w52m | ibexa/solr | Json response for search reveals Solr credentials | critical | 0.0 | – |
| GHSA-v73w-r9xg-7cr9 | october/october, october/system | Use of insecure jQuery version in OctoberCMS | medium | 0.0 | – |
| GHSA-v78h-66q4-h9px | sylius/sylius | Host header injection in the shop password reset e-mail link when the channel has no hostname | unknown | 0.0 | – |
| GHSA-vfm6-r2gc-pwww | symfony/http-foundation, symfony/symfony | Symfony2 security issue when the trust proxy mode is enabled | medium | 0.0 | – |
| GHSA-vgm8-r9gm-fw59 | typo3/cms | TYPO3 Cross-Site Scripting in legacy form component | medium | 0.0 | – |
| GHSA-vh6j-wv25-8qxr | typo3/flow | Flow Bugfix Releases for Entity Security | high | 0.0 | – |
| GHSA-vhgq-r8gx-5fpv | ibexa/admin-ui-assets | Ibexa Admin UI assets XSS vulnerabilities in back office | medium | 0.0 | – |
| GHSA-vjrg-wpm8-rhrw | doctrine/orm | doctrine/orm Regression in Query Parenthesis can have Security Implications | high | 0.0 | – |
| GHSA-vrpv-vw92-328g | rudloff/rtmpdump-bin | Multiple rtmpdump vulnerabilities | critical | 0.0 | – |
| GHSA-w5mj-j45q-m638 | zendframework/zendframework1 | ZendFramework1 Potential Security Issues in Bundled Dojo Library | medium | 0.0 | – |
| GHSA-w8qp-hmh5-4v9v | ezsystems/ezplatform-kernel | Object state limitation has no effect | critical | 0.0 | – |
| GHSA-w9p3-26fx-5mp3 | ezsystems/platform-ui-assets-bundle | eZ Platform Admin UI is vulnerable to Cross-site Scripting (XSS) | medium | 0.0 | – |
| GHSA-wf98-vxv9-jqfv | craftcms/cms | XSS Injection Vulnerability | low | 0.0 | – |
| GHSA-wh8q-72cp-p5wf | typo3/cms | Cross-Site Scripting in TYPO3 component Indexed Search | medium | 0.0 | – |
| GHSA-wq3r-jwrq-xg6w | shopware/core, shopware/platform | Canceling of orders not related to the logged-in user | medium | 0.0 | – |
| GHSA-wq43-8r5p-w3mc | contao/core | contao/core PHP object injection vulnerability allows for arbitrary code execution | high | 0.0 | – |
| GHSA-wq8p-mqvg-2p5h | laravel/framework | laravel framework SQL Injection via limit and offset functions | high | 0.0 | – |
| GHSA-wqq8-mqj9-697f | prestashop/autoupgrade | PrestaShop autoupgrade module ZIP archives were vulnerable from CVE-2017-9841 | high | 0.0 | – |
| GHSA-wrpf-2x8h-82gr | typo3/cms | Typo3 Arbitrary File Disclosure in Form Component | medium | 0.0 | – |
| GHSA-xfqg-p48g-hh94 | ezsystems/ezpublish-kernel | Login timing attack in ezsystems/ezpublish-kernel | critical | 0.0 | – |
| GHSA-xhr8-mpwq-2rr2 | cuyz/valinor | Automatic named constructor discovery in Valinor | high | 0.0 | – |
| GHSA-xjw3-5r5c-m5ph | typo3/swiftmailer | typo3 Security fix for Flow Swift Mailer package | high | 0.0 | – |
| GHSA-xm3x-4ph3-3x9c | friendsofsymfony/oauth2-php | friendsofsymfony/oauth2-php open redirection in oauth | medium | 0.0 | – |
| GHSA-xmp3-7745-g4vj | ezsystems/ez-support-tools | ezsystems/ez-support-tools Failing access control in system info view | medium | 0.0 | – |
| GHSA-xwhj-pqcg-8rcr | cakephp/cakephp | CakePHP vulnerable to Cross-site Scripting in some development error pages | medium | 0.0 | – |
| MAL-2026-3637 | intercom/intercom-php | Malicious code in intercom-php (Packagist) | unknown | 0.0 | – |
| SS-2014-015-1 | silverstripe/framework | SS-2014-015: IE requests not properly behaving with rewritehashlinks | unknown | 0.0 | – |
| SS-2014-017-1 | silverstripe/framework | SS-2014-017: XML Quadratic Blowup Attack | unknown | 0.0 | – |
| SS-2015-003-1 | silverstripe/cms | SS-2015-003: History XSS Vulnerability | unknown | 0.0 | – |
| SS-2015-004-1 | silverstripe/framework | SS-2015-004: TreeDropdownField and TreeMultiSelectField XSS | unknown | 0.0 | – |
| SS-2015-005-1 | silverstripe/cms | SS-2015-005: VirtualPage XSS | unknown | 0.0 | – |
| SS-2015-006-1 | silverstripe/framework | SS-2015-006: XSS In GridField print | unknown | 0.0 | – |
| SS-2015-007-1 | silverstripe/framework | SS-2015-007: XSS In FormAction | unknown | 0.0 | – |
| SS-2015-008-1 | silverstripe/cms | SS-2015-008: SiteTree Creation Permission Vulnerability | unknown | 0.0 | – |
| SS-2015-009-1 | silverstripe/framework | SS-2015-009: XSS In rewritten hash links | unknown | 0.0 | – |
| SS-2015-010-1 | silverstripe/framework | SS-2015-010: XSS in Director::force_redirect() | unknown | 0.0 | – |
| SS-2015-011-1 | silverstripe/framework | SS-2015-011: Potential SQL Injection Vulnerability | unknown | 0.0 | – |
| SS-2015-012-1 | silverstripe/framework | SS-2015-012: External redirection risk in Security?ReturnURL | unknown | 0.0 | – |
| SS-2015-013-1 | silverstripe/framework | SS-2015-013: X-Forwarded-Host request hostname injection | unknown | 0.0 | – |
| SS-2015-014-1 | silverstripe/framework | SS-2015-014: Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validation | unknown | 0.0 | – |
| SS-2015-015-1 | silverstripe/framework | SS-2015-015: XSS in dev/build returnURL Parameter | unknown | 0.0 | – |
| SS-2015-016-1 | silverstripe/framework | SS-2015-016: XSS in install.php | unknown | 0.0 | – |
| SS-2015-017-1 | silverstripe/forum | SS-2015-017: Forum Module CSRF Vulnerability | unknown | 0.0 | – |
| SS-2015-018-1 | silverstripe/userforms | SS-2015-018: File upload exposure on UserForms module | unknown | 0.0 | – |