Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-37709 | snipe/snipe-it | Snipe-IT has insecure permissions in file uploads | critical | 9.8 | 1% |
| CVE-2023-5549 | moodle/moodle | Moodle Improper Access Control vulnerability | medium | 5.3 | 1% |
| CVE-2023-4304 | froxlor/froxlor | Froxlor vulnerable to business logic errors | low | 3.8 | 1% |
| CVE-2024-21667 | pimcore/customer-management-framework-bundle | Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access GDPR extracts | medium | 6.5 | 1% |
| CVE-2024-22202 | phpmyfaq/phpmyfaq | phpMyFAQ User Removal Page Allows Spoofing Of User Details | medium | 5.7 | 1% |
| CVE-2022-0178 | snipe/snipe-it | Improper Access Control in snipe-it | medium | 5.4 | 1% |
| CVE-2026-34381 | admidio/admidio | Admidio allows Unauthenticated Access to Role-Restricted documents via neutralized .htaccess | high | 7.5 | 1% |
| CVE-2024-25981 | moodle/moodle | Improper Access Control in moodle | medium | 5.3 | 1% |
| CVE-2024-10393 | tutor (WordPress plugin) | The Tutor LMS plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 2.7.6. This is due to a mi | medium | 5.3 | 1% |
| CVE-2024-45135 | magento/community-edition | Magento Open Source Improper Access Control vulnerability | low | 2.7 | 1% |
| CVE-2024-1088 | password-protected-woo-store (WordPress plugin) | The Password Protected Store for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and | medium | 5.3 | 1% |
| CVE-2024-0366 | starbox (WordPress plugin) | The Starbox – the Author Box for Humans plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and in | medium | 4.3 | 1% |
| CVE-2024-21666 | pimcore/customer-management-framework-bundle | Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access customers duplicates list | medium | 6.5 | 1% |
| CVE-2022-3771 | noumo/easyii | easyii CMS's File Upload Management vulnerable to unrestricted upload | critical | 9.8 | 1% |
| CVE-2024-45122 | magento/community-edition | Magento Open Source Improper Access Control vulnerability | medium | 4.3 | 1% |
| CVE-2024-38873 | studiomitte/friendlycaptcha | FriendlyCaptcha Plugin for TYPO3 Captcha Check Bypass | medium | 5.3 | 1% |
| CVE-2024-25120 | typo3/cms-core | TYPO3 vulnerable to Improper Access Control of Resources Referenced by t3:// URI Scheme | medium | 4.3 | 1% |
| CVE-2025-24436 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control vulnerability | medium | 4.3 | 1% |
| CVE-2023-6785 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to unauthorized file download of files added via the plugin in all versions up to, a | medium | 5.3 | 1% |
| CVE-2024-0687 | restrict-user-access (WordPress plugin) | The Restrict User Access – Ultimate Membership & Content Protection plugin for WordPress is vulnerable to Information Exposure in all versio | medium | 5.3 | 1% |
| CVE-2025-27190 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control leads to Security feature bypass | medium | 5.3 | 1% |
| CVE-2023-2202 | francoisjacquet/rosariosis | RosarioSIS improper access control vulnerability | medium | 6.5 | 1% |
| CVE-2023-32062 | oro/calendar-bundle | OroCalendarBundle has incorrect system calendar events visibility | medium | 5.0 | 1% |
| CVE-2023-32063 | oro/crm-call-bundle | OroCRMCallBundle has incorrect call view page visibility | medium | 5.0 | 1% |
| CVE-2024-45121 | magento/community-edition | Magento Open Source Improper Access Control vulnerability | medium | 4.3 | 1% |
| CVE-2024-45129 | magento/community-edition | Magento Open Source Improper Access Control vulnerability | medium | 4.3 | 1% |
| CVE-2024-45130 | magento/community-edition | Magento Open Source Improper Access Control vulnerability | medium | 4.3 | 1% |
| CVE-2023-2429 | thorsten/phpmyfaq | phpMyFAQ Improper Access Control vulnerability | medium | 6.6 | 1% |
| CVE-2024-25980 | moodle/moodle | Improper Access Control in moodle | medium | 5.3 | 1% |
| CVE-2025-24435 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control vulnerability | medium | 4.3 | 1% |
| CVE-2024-1462 | maintenance-page (WordPress plugin) | The Maintenance Page plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 1.0.8 via the RE | medium | 5.3 | 1% |
| CVE-2024-1473 | colorlib-coming-soon-maintenance (WordPress plugin) | The Coming Soon & Maintenance Mode by Colorlib plugin for WordPress is vulnerable to Information Exposure in all versions up to, and includi | medium | 5.3 | 1% |
| CVE-2024-1478 | hkdev-maintenance-mode (WordPress plugin) | The Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.1 via th | medium | 5.3 | 1% |
| CVE-2023-6582 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 5.3 | 1% |
| CVE-2024-0975 | wordpress-access-control (WordPress plugin) | The WordPress Access Control plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0. | medium | 5.3 | 1% |
| CVE-2026-34570 | ci4-cms-erp/ci4ms | CI4MS: Account Deletion Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw) | high | 8.8 | 1% |
| CVE-2026-34572 | ci4-cms-erp/ci4ms | CI4MS: Account Deactivation Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw) | high | 8.8 | 1% |
| CVE-2022-40216 | bp-better-messages (WordPress plugin) | Auth. (subscriber+) Messaging Block Bypass vulnerability in Better Messages plugin <= 1.9.10.69 on WordPress. | medium | 4.3 | 1% |
| CVE-2025-24429 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control vulnerability | low | 3.5 | 1% |
| CVE-2022-41135 | customizable-wordpress-gallery-plugin---modula-image-gallery (WordPress plugin) | Unauth. Plugin Settings Change vulnerability in Modula plugin <= 2.6.9 on WordPress. | medium | 6.5 | 1% |
| CVE-2020-36831 | social-networks-auto-poster (WordPress plugin) | The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on | medium | 5.0 | 1% |
| CVE-2025-27191 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control leads to Security feature bypass | medium | 5.3 | 0% |
| CVE-2023-32064 | oro/customer-portal | OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility | medium | 4.3 | 0% |
| CVE-2024-25121 | typo3/cms-core | TYPO3 vulnerable to Improper Access Control Persisting File Abstraction Layer Entities via Data Handler | high | 7.1 | 0% |
| CVE-2023-1883 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable to improper access control | medium | 5.4 | 0% |
| CVE-2023-32065 | oro/commerce | OroCommerce get-totals-for-checkout API endpoint returns unwanted data | medium | 5.8 | 0% |
| CVE-2022-28612 | m-wp-popup (WordPress plugin) | Improper Access Control vulnerability leading to multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) | medium | 5.4 | 0% |
| CVE-2024-21665 | pimcore/ecommerce-framework-bundle | Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders list | medium | 4.3 | 0% |
| CVE-2025-0968 | elementskit-lite (WordPress plugin) | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 5.3 | 0% |
| CVE-2024-24751 | derhansen/sf_event_mgt | derhansen/sf_event_mgt vulnerable to Broken Access Control in Backend Module | medium | 4.3 | 0% |