Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.09.1, updated 2026-11-08. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| SS-2026-002 | symbiote/silverstripe-advancedworkflow | SS-2026-002 - Template injection RCE in advanced workflow | unknown | 0.0 | – |
| SS-2026-003 | silverstripe/assets | SS-2026-003 - RCE via renamed uploaded file | unknown | 0.0 | – |
| SS-2026-004 | silverstripe/framework | SS-2026-004 - Password reset token account takeover | unknown | 0.0 | – |
| SS-2026-005 | silverstripe/userforms | SS-2026-005 - XSS in required field label | unknown | 0.0 | – |
| SS-2026-006 | silverstripe/userforms | SS-2026-006 - RCE via template string escaping in userforms email subject | unknown | 0.0 | – |
| SS-2026-007 | symbiote/silverstripe-advancedworkflow | SS-2026-007 - RCE via template string escaping in advanced workflow email template | unknown | 0.0 | – |
| ZF2009-01 | zendframework/zendframework1 | LFI vector in Zend_View::setScriptPath() and render() | unknown | 0.0 | – |
| ZF2009-02 | zendframework/zendframework1 | XSS vector in Zend_Filter_StripTags | unknown | 0.0 | – |
| ZF2010-01 | zendframework/zendframework1 | Potential XSS vectors due to inconsistent encodings | unknown | 0.0 | – |
| ZF2010-02 | zendframework/zendframework1 | Potential XSS vector in Zend_Dojo_View_Helper_Editor | unknown | 0.0 | – |
| ZF2010-03 | zendframework/zendframework1 | Potential XSS vector in Zend_Filter_StripTags when comments allowed | unknown | 0.0 | – |
| ZF2010-05 | zendframework/zendframework1 | Potential XSS vector in Zend_Service_ReCaptcha_MailHide | unknown | 0.0 | – |
| ZF2010-06 | zendframework/zendframework1 | Potential Security Issues in Bundled Dojo Library | unknown | 0.0 | – |
| ZF2010-07 | zendframework/zendframework1 | Potential Security Issues in Bundled Dojo Library | unknown | 0.0 | – |
| ZF2011-01 | zendframework/zendframework1 | Potential XSS in Development Environment Error View Script | unknown | 0.0 | – |
| ZF2011-02 | zendframework/zendframework1 | Potential SQL Injection Vector When Using PDO_MySql | unknown | 0.0 | – |
| ZF2012-01 | zendframework/zendframework1 | Local file disclosure via XXE injection in Zend_XmlRpc | unknown | 0.0 | – |
| ZF2012-02 | zendframework/zendframework1 | Denial of Service vector via XEE injection | unknown | 0.0 | – |
| ZF2012-03 | zendframework/zendframework | Potential XSS Vectors in Multiple Zend Framework 2 Components | unknown | 0.0 | – |
| ZF2012-04 | zendframework/zendframework | Potential Proxy Injection Vulnerabilities in Multiple Zend Framework 2 Components | unknown | 0.0 | – |
| ZF2012-05 | zendframework/zendframework1 | Potential XML eXternal Entity injection vectors in Zend Framework 1 Zend_Feed component | unknown | 0.0 | – |
| ZF2013-01 | zendframework/zendframework | Route Parameter Injection Via Query String in Zend\Mvc | unknown | 0.0 | – |
| ZF2013-02 | zendframework/zendframework | Potential Information Disclosure and Insufficient Entropy vulnerabilities in Zend\Math\Rand and Zend\Validate\Csrf Components | unknown | 0.0 | – |
| ZF2013-03 | zendframework/zendframework | Potential SQL injection due to execution of platform-specific SQL containing interpolations | unknown | 0.0 | – |
| ZF2013-04 | zendframework/zendframework | Potential Remote Address Spoofing Vector in Zend\Http\PhpEnvironment\RemoteAddress | unknown | 0.0 | – |
| ZF2014-01 | zendframework/zend-json, zendframework/zend-xmlrpc, zendframework/zendframework +1 more | Potential XXE/XEE attacks using PHP functions: simplexml_load_*, DOMDocument::loadXML, and xml_parse | unknown | 0.0 | – |
| ZF2014-02 | zendframework/zendframework1, zendframework/zendopenid | Potential security issue in login mechanism of ZendOpenId and Zend_OpenId consumer | unknown | 0.0 | – |
| ZF2014-03 | zendframework/zend-form, zendframework/zend-navigation, zendframework/zend-view +1 more | Potential XSS vector in multiple view helpers | unknown | 0.0 | – |
| ZF2014-04 | zendframework/zendframework1 | Potential SQL injection in the ORDER implementation of Zend_Db_Select | unknown | 0.0 | – |
| ZF2015-01 | zendframework/zend-session, zendframework/zendframework | Session validation vulnerability | unknown | 0.0 | – |
| ZF2015-08 | zendframework/zendframework1 | Potential SQL injection vector using null byte for PDO (MsSql, SQLite) | unknown | 0.0 | – |
| ZF2015-09 | zendframework/zend-captcha, zendframework/zendframework, zendframework/zendframework1 | Potential Information Disclosure and Insufficient Entropy vulnerability in Zend\Captcha\Word | unknown | 0.0 | – |
| ZF2016-01 | zendframework/zendframework1 | Potential Insufficient Entropy Vulnerability in ZF1 | unknown | 0.0 | – |
| ZF2016-03 | zendframework/zendframework1 | Potential SQL injection in ORDER and GROUP functions of ZF1 | unknown | 0.0 | – |
| ZF2016-04 | zendframework/zend-mail, zendframework/zendframework | Potential remote code execution in zend-mail via Sendmail adapter | unknown | 0.0 | – |
| ZF2018-01 | zendframework/zend-diactoros, zendframework/zend-feed, zendframework/zend-http +1 more | URL Rewrite vulnerability | unknown | 0.0 | – |
| ZF2019-01 | zendframework/zend-developer-tools | Information disclosure | unknown | 0.0 | – |