Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| SS-2015-026-1 | silverstripe/framework | SS-2015-026: Form field validation message XSS vulnerability | unknown | 0.0 | – |
| SS-2015-027-1 | silverstripe/framework | SS-2015-027: HtmlEditor embed url sanitisation | unknown | 0.0 | – |
| SS-2015-028-1 | silverstripe/framework | SS-2015-028: Missing security check on dev/build/defaults | unknown | 0.0 | – |
| SS-2016-002-1 | silverstripe/framework | SS-2016-002: CSRF vulnerability in GridFieldAddExistingAutocompleter | unknown | 0.0 | – |
| SS-2016-003-1 | silverstripe/framework | SS-2016-003: Hostname, IP and Protocol Spoofing through HTTP Headers | unknown | 0.0 | – |
| SS-2016-004-1 | silverstripe/framework | SS-2016-004: XSS in CMS Edit Page | unknown | 0.0 | – |
| SS-2016-005-1 | silverstripe/framework | SS-2016-005: Brute force bypass on default admin | unknown | 0.0 | – |
| SS-2016-006-1 | silverstripe/framework | SS-2016-006: Missing CSRF protection in login form | unknown | 0.0 | – |
| SS-2016-007-1 | silverstripe/framework | SS-2016-007: VersionedRequestFilter vulnerability | unknown | 0.0 | – |
| SS-2016-008-1 | silverstripe/framework | SS-2016-008: Password encryption salt expiry | unknown | 0.0 | – |
| SS-2016-010-1 | silverstripe/framework | SS-2016-010: ReadOnly transformation for formfields exploitable | unknown | 0.0 | – |
| SS-2016-011-1 | silverstripe/framework | SS-2016-011: ChangePasswordForm does not check Member::canLogIn() | unknown | 0.0 | – |
| SS-2016-012-1 | silverstripe/framework | SS-2016-012: Missing ACL on reports | unknown | 0.0 | – |
| SS-2016-013-1 | silverstripe/framework | SS-2016-013: Member.Name is not escaped | unknown | 0.0 | – |
| SS-2016-014-1 | silverstripe/framework | SS-2016-014: Pre-existing alc_enc cookies log users in if remember me is disabled | unknown | 0.0 | – |
| SS-2016-015-1 | silverstripe/framework | SS-2016-015: XSS In OptionsetField and CheckboxSetField | unknown | 0.0 | – |
| SS-2016-016-1 | silverstripe/framework | SS-2016-016: XSS In CMSSecurity BackURL | unknown | 0.0 | – |
| SS-2017-001-1 | silverstripe/framework | SS-2017-001: XSS In page name | unknown | 0.0 | – |
| SS-2017-002-1 | silverstripe/framework | SS-2017-002: Member disclosure in login form | unknown | 0.0 | – |
| SS-2017-003-1 | silverstripe/framework | SS-2017-003: XSS in RedirectorPage | unknown | 0.0 | – |
| SS-2017-004-1 | silverstripe/framework | SS-2017-004: XSS in page history comparison | unknown | 0.0 | – |
| SS-2017-005-1 | silverstripe/framework | SS-2017-005: User enumeration via timing attack on login and password reset forms | unknown | 0.0 | – |
| SS-2017-006-1 | silverstripe/framework | SS-2017-006: Session user agent change detection | unknown | 0.0 | – |
| SS-2017-007-1 | silverstripe/framework | SS-2017-007: CSV Excel Macro Injection | unknown | 0.0 | – |
| SS-2017-008-1 | silverstripe/framework | SS-2017-008: SQL injection in full text search of SilverStripe 4 | unknown | 0.0 | – |
| SS-2017-009-1 | silverstripe/framework | SS-2017-009: Users inadvertently passing sensitive data to LoginAttempt | unknown | 0.0 | – |
| SS-2017-010-1 | silverstripe/framework | SS-2017-010: install.php discloses sensitive data by pre-populating DB credential forms | unknown | 0.0 | – |
| SS-2018-001-1 | silverstripe/framework | SS-2018-001: Privilege Escalation Risk in Member Edit form | unknown | 0.0 | – |
| SS-2018-004-1 | silverstripe/admin | SS-2018-004: XSS Vulnerability via WYSIWYG editor | unknown | 0.0 | – |
| SS-2018-005-1 | silverstripe/framework | SS-2018-005: isDev and isTest unguarded | unknown | 0.0 | – |
| SS-2018-006-1 | silverstripe/framework | SS-2018-006: Code execution vulnerability | unknown | 0.0 | – |
| SS-2018-007-1 | silverstripe/graphql | SS-2018-007: CSRF vulnerability in graphql | unknown | 0.0 | – |
| SS-2018-008-1 | silverstripe/framework | SS-2018-008: BackURL validation bypass with malformed URLs | unknown | 0.0 | – |
| SS-2018-010-1 | silverstripe/framework | SS-2018-010: Member disclosure in login form | unknown | 0.0 | – |
| SS-2018-011-1 | silverstripe/taxonomy | SS-2018-011: SQL injection vulnerability | unknown | 0.0 | – |
| SS-2018-012-1 | silverstripe/framework | SS-2018-012: Uploaded PHP script execution in assets | unknown | 0.0 | – |
| SS-2018-013-1 | silverstripe/framework | SS-2018-013: Passwords sent back to browsers under some circumstances | unknown | 0.0 | – |
| SS-2018-014-1 | silverstripe/framework | SS-2018-014: Dangerous file types in allowed upload | unknown | 0.0 | – |
| SS-2018-015-1 | silverstripe/comments | SS-2018-015: Vulnerable dependency | unknown | 0.0 | – |
| SS-2018-016-1 | silverstripe/subsites | SS-2018-016: Unsafe SQL Query Construction (Safe Data Source) | unknown | 0.0 | – |
| SS-2018-017-1 | symbiote/silverstripe-multivaluefield | SS-2018-017: Possible PHP Object Injection via Multi-Value Field Extension | unknown | 0.0 | – |
| SS-2018-018-1 | silverstripe/framework | SS-2018-018: Database credentials disclosure during connection failure | unknown | 0.0 | – |
| SS-2018-019-1 | silverstripe/framework | SS-2018-019: Possible denial of service attack vector when flushing | unknown | 0.0 | – |
| SS-2018-020-1 | silverstripe/framework | SS-2018-020: Potential SQL vulnerability in PostgreSQL database connector | unknown | 0.0 | – |
| SS-2023-001 | silverstripe/admin | SS-2023-001 - XSS vulnerability in underlying TinyMCE library | unknown | 0.0 | – |
| SS-2023-002 | silverstripe/admin | SS-2023-002 - Cross-site scripting (XSS) vulnerabilities inherited form TinyMCE | unknown | 0.0 | – |
| SS-2024-001 | silverstripe/framework | SS-2024-001 - TinyMCE allows svg files linked in object tags | unknown | 0.0 | – |
| SS-2024-002 | silverstripe/framework | SS-2024-002 - Reflected Cross Site Scripting (XSS) in error message | unknown | 0.0 | – |
| SS-2025-001 | silverstripe/framework | SS-2025-001 - User enumeration via timing attack | unknown | 0.0 | – |
| SS-2026-001 | silverstripe/userforms | SS-2026-001 - Template injection RCE in userforms | unknown | 0.0 | – |