Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-35921 | fof/byobu | Byobu user preference to prevent private discussions being started are not respected | low | 3.5 | 1% |
| CVE-2024-43438 | moodle/moodle | Moodle's IDOR in Feedback non-respondents report allows messaging arbitrary site users | high | 7.5 | 1% |
| CVE-2022-2597 | visual-portfolio\,-photo-gallery-\&-post-grid (WordPress plugin) | The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.19.0 does not have proper authorisation checks in some of its REST | medium | 5.4 | 1% |
| CVE-2023-4269 | user-activity-log (WordPress plugin) | The User Activity Log WordPress plugin before 1.6.6 lacks proper authorisation when exporting its activity logs, allowing any authenticated | medium | 4.3 | 1% |
| CVE-2023-5509 | mystickymenu (WordPress plugin) | The myStickymenu WordPress plugin before 2.6.5 does not adequately authorize some ajax calls, allowing any logged-in user to perform the act | medium | 5.4 | 1% |
| CVE-2023-5799 | wp-hotel-booking (WordPress plugin) | The WP Hotel Booking WordPress plugin before 2.0.8 does not have proper authorisation when deleting a package, allowing Contributor and abov | medium | 5.4 | 1% |
| CVE-2020-36714 | brizy (WordPress plugin) | The Brizy plugin for WordPress is vulnerable to authorization bypass due to a incorrect capability check on the is_administrator() function | high | 7.4 | 1% |
| CVE-2024-4390 | depicter (WordPress plugin) | The Slider and Carousel slider by Depicter plugin for WordPress is vulnerable to Arbitrary Nonce Generation in all versions up to, and inclu | medium | 6.5 | 1% |
| CVE-2024-1677 | a4-barcode-generator (WordPress plugin) | The Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce plugin for WordPress is vulnerable to unauth | medium | 6.3 | 1% |
| CVE-2022-45353 | betheme (WordPress plugin) | Broken Access Control in Betheme theme <= 26.6.1 on WordPress. | medium | 4.3 | 1% |
| CVE-2023-3957 | navz-photo-gallery (WordPress plugin) | The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient restriction on th | medium | 4.3 | 1% |
| CVE-2023-5644 | wp-mail-log (WordPress plugin) | The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role | high | 7.6 | 0% |
| CVE-2026-52819 | kimai/kimai | Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the targ | medium | 0.0 | 0% |
| CVE-2024-24751 | derhansen/sf_event_mgt | derhansen/sf_event_mgt vulnerable to Broken Access Control in Backend Module | medium | 4.3 | 0% |
| CVE-2024-39322 | aimeos/ai-admin-jsonadm | aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required records | medium | 5.5 | 0% |
| CVE-2024-41964 | getkirby/cms | Kirby has insufficient permission checks in the language settings | high | 8.1 | 0% |
| CVE-2025-31481 | api-platform/core, api-platform/graphql | GraphQL query operations security can be bypassed | high | 7.5 | 0% |
| CVE-2026-54180 | backpack/crud | Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR) | high | 7.6 | 0% |
| CVE-2022-3881 | wptools (WordPress plugin) | The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin b | medium | 5.7 | 0% |
| CVE-2024-2098 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to an improper authorization check on the 'protec | high | 7.5 | 0% |
| CVE-2024-45131 | magento/community-edition | Magento Open Source Improper Authorization vulnerability | medium | 5.4 | 0% |
| CVE-2024-27915 | sulu/sulu | Sulu grants access to pages regardless of role permissions | medium | 6.8 | 0% |
| CVE-2025-24437 | magento/community-edition, magento/project-community-edition | Magento Improper Access Control vulnerability | medium | 5.4 | 0% |
| CVE-2026-81892 | easycorp/easyadmin-bundle | EasyAdmin custom-action dispatcher bypasses access_control on other routes | high | 8.1 | 0% |
| CVE-2024-39323 | aimeos/ai-admin-graphql | aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account | high | 8.2 | 0% |
| CVE-2026-55460 | snipe/snipe-it | Snipe-IT has an authorization bypass on bulk editing users | high | 7.1 | 0% |
| CVE-2025-54267 | magento/community-edition, magento/project-community-edition | Magento vulnerable to privilege escalation due to incorrect authorization | medium | 6.5 | 0% |
| CVE-2026-45075 | symfony/http-kernel, symfony/security-http, symfony/symfony | Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] | high | 0.0 | 0% |
| CVE-2024-39324 | aimeos/ai-admin-graphql | aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own services | low | 3.8 | 0% |
| CVE-2026-45704 | pimcore/pimcore | Pimcore has a CustomReports Share Bypass | high | 0.0 | 0% |
| CVE-2026-82395 | sulu/sulu | Sulu: Media move/update authorization bypass (IDOR) | medium | 0.0 | 0% |
| CVE-2025-68129 | auth0/auth0-php | Auth0-PHP SDK has Improper Audience Validation | medium | 6.8 | 0% |
| CVE-2022-25274 | drupal/core | Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated | medium | 5.4 | 0% |
| CVE-2023-44401 | silverstripe/graphql | View permissions are bypassed for paginated lists of ORM data | medium | 5.3 | 0% |
| CVE-2026-48806 | twig/twig | Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys | medium | 0.0 | 0% |
| CVE-2026-48808 | twig/twig | Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface` | medium | 0.0 | 0% |
| CVE-2023-5352 | awesome-support (WordPress plugin) | The Awesome Support WordPress plugin before 6.1.5 does not correctly authorize the wpas_edit_reply function, allowing users to edit posts fo | medium | 4.3 | 0% |
| CVE-2024-29885 | silverstripe/reports | Silverstripe Reports are still accessible even when `canView()` returns false | medium | 4.3 | 0% |
| CVE-2024-7624 | zephyr-project-manager (WordPress plugin) | The Zephyr Project Manager plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 3.3.101. | high | 8.1 | 0% |
| CVE-2025-31694 | drupal/tfa | This module enables you to allow and/or require users to use a second authentication method in addition to password auth | high | 8.1 | 0% |
| CVE-2024-5071 | bookster (WordPress plugin) | The Bookster WordPress plugin through 1.1.0 allows adding sensitive parameters when validating appointments allowing attackers to manipulat | medium | 6.5 | 0% |
| CVE-2026-24749 | silverstripe/assets | Silverstripe Assets Module has a DBFile::getURL() permission bypass | medium | 5.3 | 0% |
| CVE-2024-1639 | license-manager-for-woocommerce (WordPress plugin) | The License Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on t | medium | 6.5 | 0% |
| CVE-2026-80202 | kimai/kimai | Kimai has Missing Voter Check that Allows Cross-Team Timesheet Manipulation | medium | 0.0 | 0% |
| CVE-2025-49549 | magento/community-edition, magento/project-community-edition | Magento Authenticated Security feature bypass | low | 2.7 | 0% |
| CVE-2021-25097 | labtools (WordPress plugin) | The LabTools WordPress plugin through 1.0 does not have proper authorisation and CSRF check in place when deleting publications, allowing an | medium | 6.5 | 0% |
| CVE-2026-88974 | wp-graphql/wp-graphql | WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost | medium | 5.4 | 0% |
| CVE-2025-49550 | magento/community-edition, magento/project-community-edition | Magento Security feature bypass | medium | 4.3 | 0% |
| CVE-2026-48807 | twig/twig | Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters | medium | 0.0 | 0% |
| CVE-2025-3645 | moodle/moodle | Moodle has an IDOR in messaging web service which allows access to some user details | medium | 4.3 | 0% |