Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2014-5011 | dompdf/dompdf | DOMPDF Information Disclosure | medium | 6.5 | 1% |
| CVE-2022-31140 | cuyz/valinor | Valinor error messages leading to potential data exfiltration before v0.12.0 | high | 7.5 | 1% |
| CVE-2021-32717 | shopware/core, shopware/platform | Private files publicly accessible with Cloud Storage providers | high | 7.5 | 1% |
| CVE-2026-6826 | concrete5/concrete5 | Concrete CMS is vulnerable to unauthenticated file usage disclosure | medium | 0.0 | 1% |
| CVE-2017-12872 | simplesamlphp/simplesamlphp | SimpleSAMLphp allows timing side-channel attacks | medium | 5.9 | 1% |
| CVE-2023-5070 | ultimate-social-media-icons (WordPress plugin) | The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to | medium | 6.5 | 1% |
| CVE-2021-24163 | ninja-forms (WordPress plugin) | The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protect | high | 8.8 | 1% |
| CVE-2022-41876 | ezsystems/ezplatform-graphql | ezplatform-graphql GraphQL queries can expose password hashes | high | 7.5 | 1% |
| CVE-2021-28566 | magento/community-edition | Magento Information Disclosure vulnerability | low | 3.7 | 1% |
| CVE-2012-1159 | moodle/moodle | Moodle included private user files in course backups | medium | 4.3 | 1% |
| CVE-2019-11633 | honeypress (WordPress plugin) | HoneyPress through 2016-09-27 can be fingerprinted by attackers because of the ingrained unique www.atxsec.com and ayylmao.wpengine.com host | high | 7.5 | 1% |
| CVE-2026-45332 | automad/automad | Automad has Broken Access Control: Unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint | high | 7.5 | 1% |
| CVE-2023-1263 | cmp-coming-soon-maintenance (WordPress plugin) | The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 4.1.6 via | medium | 5.3 | 1% |
| CVE-2019-9942 | twig/twig | Twig Sandbox Information Disclosure | low | 3.7 | 1% |
| CVE-2011-4279 | moodle/moodle | Moodle does not use the forceloginforprofiles setting for course-profiles access control | medium | 0.0 | 1% |
| CVE-2021-31567 | download-monitor (WordPress plugin) | Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6). The plugin | medium | 6.8 | 1% |
| CVE-2005-4875 | typo3/cms | TYPO3 Reveals Sensitive Information via Direct Request to `misc/phpcheck/` | high | 0.0 | 1% |
| CVE-2012-2353 | moodle/moodle | Moodle Exposes Sensitive User Information | medium | 0.0 | 1% |
| CVE-2011-3744 | ezyang/htmlpurifier | HTML Purifier allows remote attackers to obtain sensitive information | medium | 5.3 | 1% |
| CVE-2012-5890 | sjbr/sr-feuser-register | Front End User Registration (sr_feuser_register) extension for TYPO3 allows remote attackers to obtain user names, passwords | medium | 0.0 | 1% |
| CVE-2022-29248 | guzzlehttp/guzzle, drupal/core | Cross-domain cookie leakage in Guzzle | high | 8.0 | 1% |
| CVE-2021-20281 | moodle/moodle | Moodle allowed some users without permission to view other users' full names | medium | 5.3 | 1% |
| CVE-2021-32711 | shopware/platform | Exposure of Sensitive Information to an Unauthorized Actor | critical | 9.1 | 1% |
| CVE-2015-7503 | zendframework/zend-crypt, zendframework/zendframework | Zend Framework Information Disclosure | high | 7.5 | 1% |
| CVE-2014-3542 | moodle/moodle | Moodle allows remote attackers to read arbitrary files | medium | 0.0 | 1% |
| CVE-2016-3124 | simplesamlphp/simplesamlphp | SimpleSAMLphp Information leakage issue in the sanitycheck module | medium | 5.3 | 1% |
| CVE-2014-10388 | wp-support-plus-responsive-ticket-system (WordPress plugin) | The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has full path disclosure. | medium | 5.3 | 1% |
| CVE-2022-25602 | responsive-menu (WordPress plugin) | Nonce token leak vulnerability leading to arbitrary file upload, theme deletion, plugin settings change discovered in Responsive Menu WordPr | high | 8.3 | 1% |
| CVE-2020-15005 | mediawiki/core | img_auth.php may leak private extension images into the public cache | medium | 0.0 | 1% |
| CVE-2022-0813 | phpmyadmin/phpmyadmin | Exposure of Sensitive Information to an Unauthorized Actor in PhpMyAdmin | high | 7.5 | 1% |
| CVE-2018-1135 | moodle/moodle | Moodle Portfolio forum caller class allows a user to download any file | medium | 6.5 | 1% |
| CVE-2015-5340 | moodle/moodle | Moodle sensitive information disclosure | medium | 4.3 | 1% |
| CVE-2019-5884 | studio-42/elfinder | Sensitive Data Exposure in elFinder | medium | 5.9 | 1% |
| CVE-2013-7073 | typo3/cms | TYPO3 vulnerable to Information Disclosure via Content Editing Wizards component | medium | 6.5 | 1% |
| CVE-2017-2642 | moodle/moodle | Moodle User fullname disclosure on user preferences page | medium | 6.5 | 1% |
| CVE-2017-13761 | fastly/magento2 | Fastly Magento2 sensitive information disclosure | medium | 6.5 | 1% |
| CVE-2019-10667 | librenms/librenms | Exposure of Sensitive Information to an Unauthorized Actor in LibreNMS | medium | 5.3 | 1% |
| CVE-2019-10911 | symfony/security, symfony/security-http, symfony/symfony | Improper authentication in Symfony | high | 7.5 | 1% |
| CVE-2022-23982 | perfect-woocommerce-brands (WordPress plugin) | The vulnerability discovered in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4) allows server information exposure. | medium | 4.3 | 1% |
| CVE-2017-6926 | drupal/core, drupal/drupal | Drupal Comment reply form allows access to restricted content | high | 8.1 | 1% |
| CVE-2009-4160 | jweiland/kk-downloader | TYPO3 Simple Download-System with Counter and Categories Vulnerable to Information Disclosure | medium | 0.0 | 1% |
| CVE-2010-3673 | typo3/cms-core | TYPO3 is vulnerable to Information Disclosure in the HTML mailing API | medium | 5.3 | 1% |
| CVE-2019-16409 | silverstripe/framework, symbiote/silverstripe-versionedfiles | SilverStripe Versioned Files module Unpublished files are exposed publicly | medium | 5.3 | 1% |
| CVE-2010-3664 | typo3/cms-backend | TYPO3 is vulnerable to Information Disclosure on the backend | medium | 6.5 | 1% |
| CVE-2018-19609 | showdoc/showdoc | Showdoc Forced Browsing | medium | 6.5 | 1% |
| CVE-2024-8852 | all-in-one-wp-migration (WordPress plugin) | The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inclu | medium | 5.3 | 1% |
| CVE-2017-14775 | illuminate/auth, laravel/framework | Laravel Sensitive Data Exposure | medium | 5.9 | 1% |
| CVE-2023-39999 | WordPress core | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1 | medium | 4.3 | 1% |
| CVE-2019-7951 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Information Leak | high | 7.5 | 1% |
| CVE-2018-0575 | baserproject/basercms | Sensitive Data Exposure in baserCMS | medium | 5.3 | 1% |