Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-67507 | filament/filament | Filament multi-factor authentication (app) recovery codes can be used multiple times | high | 8.1 | 0% |
| CVE-2025-3627 | moodle/moodle | Moodle makes some user data available before completing second factor with MFA enabled | medium | 4.3 | 0% |
| CVE-2026-52793 | froxlor/froxlor | Froxlor's API Authentication bypasses 2FA Authentication | high | 8.1 | 0% |
| CVE-2026-41671 | admidio/admidio | Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation | medium | 6.8 | 0% |
| CVE-2024-50341 | symfony/security-bundle, symfony/symfony | Symfony's `Security::login` does not take into account custom `user_checker` | low | 3.1 | 0% |
| CVE-2026-29069 | craftcms/cms | Craft CMS has unauthenticated activation email trigger with potential user enumeration | high | 0.0 | 0% |
| CVE-2026-39976 | laravel/passport | Laravel Passport: TokenGuard Authenticates Unrelated User for Client Credentials Tokens | high | 7.1 | 0% |
| CVE-2022-25768 | mautic/core, mautic/core-lib | Mautic vulnerable to Improper Access Control in UI upgrade process | high | 7.0 | 0% |
| CVE-2025-29773 | froxlor/froxlor | Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account Takeover | medium | 5.8 | 0% |
| CVE-2025-3634 | moodle/moodle | Moodle self enrollment available before completing second factor with MFA enabled | medium | 4.3 | 0% |
| CVE-2025-62398 | moodle/moodle | Moodle does not properly enforce MFA | medium | 5.3 | 0% |
| CVE-2026-33512 | wwbn/avideo | AVideo has an unauthenticated decrypt oracle leaking any ciphertext | high | 7.5 | 0% |
| CVE-2023-45023 | in2code/femanager | TYPO3 extension femanager Broken Access Control vulnerability | medium | 0.0 | 0% |
| CVE-2026-4587 | hybridauth/hybridauth | HybridAuth Has Improper SSL Certificate Validation in Curl HTTP Client | low | 3.7 | 0% |
| CVE-2026-29113 | craftcms/cms | Craft CMS has a potential information disclosure vulnerability in preview tokens | low | 0.0 | 0% |
| CVE-2026-44584 | paymenter/paymenter | Paymenter doesn't reset email verification status after email change | medium | 4.3 | 0% |
| GHSA-2f4r-34m4-3w8q | auth0/wordpress | Auth0 Wordpress plugin Vulnerable to Brute Force Authentication Tags of CookieStore Sessions | critical | 9.1 | – |
| GHSA-9fwj-9mjf-rhj3 | auth0/login | laravel-auth0 SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions | critical | 9.1 | – |
| GHSA-9wg9-93h9-j8ch | auth0/symfony | Auth0 Symfony SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions | critical | 9.1 | – |
| GHSA-cmwh-g2h8-c222 | poweradmin/poweradmin | Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover | high | 8.1 | – |
| GHSA-3x57-m5p4-rgh4 | zendframework/zendopenid | ZendOpenID potential security issue in login mechanism | high | 7.5 | – |
| GHSA-9v78-h226-2rmq | zendframework/zendframework1 | Zendframework potential security issue in login mechanism | high | 7.5 | – |
| GHSA-g8pg-33v4-9r96 | thelia/thelia | Thelia authentication bypass vulnerability | high | 7.5 | – |
| GHSA-rxc9-f2x6-qh4w | typo3/cms-core | TYPO3 Security Misconfiguration for Backend User Accounts | high | 7.5 | – |
| GHSA-x4rj-f7m6-42c3 | typo3/cms-core | TYPO3 CMS Authentication Bypass vulnerability | high | 7.5 | – |
| GHSA-9phw-7h96-q3rv | scheb/two-factor-bundle | scheb/two-factor-bundle bypass two-factor authentication with remember-me option | high | 7.4 | – |
| GHSA-h6mp-mc7g-mg49 | scheb/two-factor-bundle | scheb/two-factor-bundle bypass two-factor authentication with unverified JWT trusted device token | high | 7.4 | – |
| GHSA-c5mj-39cf-3pp5 | typo3/cms | TYPO3 Security Misconfiguration for Backend User Accounts | high | 7.3 | – |
| GHSA-7rhv-h82h-vpjh | ec-cube/ec-cube | EC-CUBE has a Vulnerability that Allows MFA Bypass in the Administrative Interface | medium | 6.7 | – |
| GHSA-7mx2-7q8p-pgmw | symfony/symfony | Symfony may allow a user to switch to using another user's identity | medium | 6.5 | – |
| GHSA-6xh8-8pfv-53vx | typo3/cms | Authentication Bypass in TYPO3 CMS | medium | 5.4 | – |
| GHSA-p5h2-vr99-xm99 | silverstripe/framework | silverstripe/framework ChangePasswordForm does not check `Member::canLogIn()` | medium | 4.3 | – |
| CVE-2026-47677 | facturascripts/facturascripts | FacturaScripts: Account takeover of any 2FA-enabled user | critical | 0.0 | – |