Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2011-4291 | moodle/moodle | Moodle allows remote authenticated users to cause a denial of service (invalid database records) | medium | 0.0 | 2% |
| CVE-2018-8711 | woocommerce-products-filter (WordPress plugin) | A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated | critical | 9.8 | 2% |
| CVE-2022-31090 | guzzlehttp/guzzle | Authorization header leaked to a different origin on cross-origin redirect (curl handler) | high | 7.7 | 2% |
| CVE-2015-6828 | security-audit (WordPress plugin) | The tweet_info function in class/__functions.php in the SecureMoz Security Audit plugin 1.0.5 and earlier for WordPress does not use an HTTP | medium | 6.8 | 2% |
| CVE-2016-9449 | drupal/core, drupal/drupal | Drupal sensitive information disclosure | medium | 4.3 | 2% |
| CVE-2022-24828 | composer/composer | Missing input validation can lead to command execution in composer | high | 8.3 | 2% |
| CVE-2020-36848 | boldgrid-backup (WordPress plugin) | The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Sensitive Information Ex | high | 7.5 | 2% |
| CVE-2014-0217 | moodle/moodle | Moodle does not check for the moodle/course:viewhiddencourses capability | medium | 0.0 | 2% |
| CVE-2015-3176 | moodle/moodle | Moodle allows attackers obtain full-name information | medium | 0.0 | 2% |
| CVE-2020-9690 | magento/community-edition | Magento observable timing discrepancy vulnerability | medium | 4.2 | 2% |
| CVE-2017-6921 | drupal/core, drupal/drupal | Drupal file REST resource does not properly validate | medium | 5.9 | 2% |
| CVE-2015-1000002 | filedownload (WordPress plugin) | Open Proxy in filedownload v1.4 wordpress plugin | high | 8.2 | 2% |
| CVE-2020-13764 | gravityforms (WordPress plugin), wp-premium/gravityforms | common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special ca | high | 7.5 | 2% |
| CVE-2017-1000018 | phpmyadmin/phpmyadmin | phpMyAdmin DoS Vulnerability | high | 7.5 | 2% |
| CVE-2013-2080 | moodle/moodle | Moodle is vulnerable to Sensitive Information Disclosure | medium | 0.0 | 2% |
| CVE-2021-24948 | the-plus-addons-for-elementor (WordPress plugin) | The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not validate the qvquery parameter of the tp_get_dl_post_info_ajax AJ | high | 7.5 | 2% |
| CVE-2020-6164 | silverstripe/cms, silverstripe/framework | Silverstripe CMS information disclosure | high | 7.5 | 2% |
| CVE-2017-6955 | invite-anyone (WordPress plugin) | An issue was discovered in by-email/by-email.php in the Invite Anyone plugin before 1.3.15 for WordPress. A user is able to change the subje | medium | 5.3 | 2% |
| CVE-2020-15099 | typo3/cms, typo3/cms-core | Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS | high | 8.1 | 2% |
| CVE-2021-36038 | magento/community-edition, magento/project-community-edition | Magento discloses sensitive information via the Multishipping Module | medium | 6.5 | 2% |
| CVE-2013-1939 | sabre/dav | SabreDAV Directory Traversal vulnerability | medium | 0.0 | 2% |
| CVE-2019-16738 | mediawiki/core | MediaWiki information disclosure | medium | 5.3 | 2% |
| CVE-2018-20981 | ninja-forms (WordPress plugin) | The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data req | critical | 9.1 | 2% |
| CVE-2018-1137 | moodle/moodle | Moodle Portfolio script allows instantiation of class chosen by user | high | 8.1 | 2% |
| CVE-2015-9348 | sell-downloads (WordPress plugin) | The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs. | high | 7.5 | 2% |
| CVE-2018-21011 | charitable (WordPress plugin) | The charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details. | high | 7.5 | 2% |
| CVE-2016-10948 | post-indexer (WordPress plugin) | The Post Indexer plugin before 3.0.6.2 for WordPress has incorrect handling of data passed to the unserialize function. | high | 8.1 | 2% |
| CVE-2014-0215 | moodle/moodle | Moodle Reveals Student Information Meant To Be Anonymous | medium | 0.0 | 2% |
| CVE-2016-9452 | drupal/core, drupal/drupal | Drupal Denial of service via transliterate mechanism | medium | 6.5 | 2% |
| CVE-2026-25892 | vrana/adminer | Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint | high | 7.5 | 2% |
| CVE-2016-6612 | phpmyadmin/phpmyadmin | phpMyAdmin Local file exposure | medium | 6.5 | 2% |
| CVE-2013-1835 | moodle/moodle | Moodle's login_as feature leaks information from external repositories | low | 0.0 | 2% |
| CVE-2016-2158 | moodle/moodle | Moodle allows attackers to obtain sensitive category-detail information | medium | 4.3 | 2% |
| CVE-2012-5657 | zendframework/zendframework1 | Zend Framework XXE Vulnerability | medium | 0.0 | 2% |
| CVE-2016-6623 | phpmyadmin/phpmyadmin | phpMyAdmin DoS Vulnerability | medium | 6.5 | 2% |
| CVE-2016-2154 | moodle/moodle | Moodle allows attackers to discover hidden course names | medium | 4.3 | 2% |
| CVE-2016-2156 | moodle/moodle | Moodle provides calendar-event data without considering whether an activity is hidden | medium | 4.3 | 2% |
| CVE-2026-40261 | composer/composer | Composer has a command injection via malicious perforce reference | high | 8.8 | 2% |
| CVE-2020-10235 | froxlor/froxlor | Froxlor arbitrary code execution via the database configuration options | high | 8.8 | 2% |
| CVE-2019-14366 | wp-slacksync (WordPress plugin) | WP SlackSync plugin through 1.8.5 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about | high | 7.5 | 2% |
| CVE-2011-4289 | moodle/moodle | Moodle does not recogniz configuration setting that makes e-mail addresses visible only to course members | medium | 0.0 | 2% |
| CVE-2014-7831 | moodle/moodle | Moodle exposes hidden grades to students | medium | 0.0 | 2% |
| CVE-2014-7833 | moodle/moodle | Moodle allows attackers to obtain sensitive information | medium | 0.0 | 2% |
| CVE-2015-0211 | moodle/moodle | Moodle allows attackers to obtain sensitive information | medium | 0.0 | 2% |
| CVE-2015-0215 | moodle/moodle | Moodle allows attackers to obtain sensitive calendar-event information | medium | 0.0 | 2% |
| CVE-2015-2266 | moodle/moodle | Moodle allows attackers to obtain sensitive personal-contact and unread-message-count information | medium | 0.0 | 2% |
| CVE-2015-3180 | moodle/moodle | Moodle allows attackers to obtain sensitive course-structure information | medium | 0.0 | 2% |
| CVE-2013-7400 | directmailteam/direct-mail | The Direct Mail (direct_mail) TYPO3 extension improperly discloses sensitive information | high | 7.5 | 2% |
| CVE-2010-5104 | typo3/cms-core | TYPO3 Sensitive Information Disclosure via escapeStrForLike method | medium | 0.0 | 2% |
| CVE-2016-10991 | imdb-widget (WordPress plugin) | The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion. | high | 7.5 | 2% |