Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24585 | timetable-and-event-schedule (WordPress plugin) | The Timetable and Event Schedule WordPress plugin before 2.4.0 outputs the Hashed Password, Username and Email Address (along other less sen | medium | 6.5 | 1% |
| CVE-2022-1186 | be-popia-compliant (WordPress plugin) | The WordPress plugin Be POPIA Compliant exposed sensitive information to unauthenticated users consisting of site visitors emails and userna | medium | 5.3 | 1% |
| CVE-2018-19133 | flarum/framework | Flarum Core Leaks PII | medium | 5.3 | 1% |
| CVE-2019-7929 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Information Disclosure | medium | 4.9 | 1% |
| CVE-2019-19983 | minify (WordPress plugin) | In the WordPress plugin, Fast Velocity Minify before 2.7.7, the full web root path to the running WordPress application can be discovered. I | medium | 4.3 | 1% |
| CVE-2017-15110 | moodle/moodle | Moodle Exposure of Sensitive Information to an Unauthorized Actor | medium | 4.3 | 1% |
| CVE-2017-14240 | dolibarr/dolibarr | Dolibarr ERP and CRM Sensitive Data Disclosure | high | 7.5 | 1% |
| CVE-2022-2117 | give (WordPress plugin) | The GiveWP plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.20.2 via the /donor-wa | medium | 5.3 | 1% |
| CVE-2021-22967 | concrete5/core | Exposure of sensitive information in concrete5/core | medium | 0.0 | 1% |
| CVE-2011-4901 | typo3/cms | Typo3 Arbitrary Information Disclosure | medium | 6.5 | 1% |
| CVE-2018-10189 | mautic/core | Mautic Sessions could be hijacked due to tracking contacts by an auto-incremented ID | high | 7.5 | 1% |
| CVE-2021-32712 | shopware/shopware | Exposure of Sensitive Information to an Unauthorized Actor | medium | 5.3 | 1% |
| CVE-2018-1044 | moodle/moodle | Moodle Privilege escalation in quiz web services | medium | 4.3 | 1% |
| CVE-2009-3628 | typo3/cms-backend | TYPO3 Backend Discloses Encryption Key | medium | 0.0 | 1% |
| CVE-2017-20194 | formidable-form-builder (WordPress plugin) | The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the | medium | 5.3 | 1% |
| CVE-2013-1832 | moodle/moodle | Moodle includes the WebDAV password in the configuration form | medium | 0.0 | 1% |
| CVE-2014-3946 | typo3/cms | Typo3 Information Disclosure | medium | 0.0 | 1% |
| CVE-2021-32716 | shopware/platform, shopware/core | Exposure of Sensitive Information to an Unauthorized Actor | medium | 4.4 | 1% |
| CVE-2022-27863 | vikbooking (WordPress plugin) | Sensitive Information Exposure in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 on WordPress allows attackers to get the | medium | 5.3 | 1% |
| CVE-2021-22951 | concrete5/core | Password exposure in concrete5/core | medium | 0.0 | 1% |
| CVE-2022-37783 | craftcms/cms | Craft CMS discloses password hashes | high | 7.5 | 1% |
| CVE-2017-12849 | silverstripe/cms | Silverstripe CMS User Enumeration | medium | 5.3 | 1% |
| CVE-2022-30598 | moodle/moodle | Exposure of Sensitive Information in moodle | medium | 4.3 | 1% |
| CVE-2022-23984 | wpdiscuz (WordPress plugin) | Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11). | low | 3.7 | 1% |
| CVE-2008-6507 | phpbb/phpbb | phpBB vulnerable to sensitive information disclosure | high | 7.5 | 1% |
| CVE-2016-5012 | moodle/moodle | Moodle Glossary search displays entries without checking user permissions to view them | medium | 5.3 | 1% |
| CVE-2022-24747 | shopware/core, shopware/platform, shopware/storefront | HTTP caching is marking private HTTP headers as public in Shopware | medium | 6.3 | 1% |
| CVE-2017-12157 | moodle/moodle | Moodle sensitive information disclosure | medium | 4.3 | 1% |
| CVE-2020-10195 | popup-builder (WordPress plugin) | The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege | medium | 6.3 | 1% |
| CVE-2018-6591 | jcbrand/converse.js | Converse.js Exposure of Sensitive Information | medium | 5.3 | 1% |
| CVE-2016-6625 | phpmyadmin/phpmyadmin | phpMyAdmin allows to detect if user is logged in | medium | 4.3 | 1% |
| CVE-2020-35934 | advanced-access-manager (WordPress plugin) | The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object (including all metadata) upon login via th | medium | 4.3 | 1% |
| CVE-2022-0588 | librenms/librenms | Missing Authorization in librenms/librenms | medium | 6.5 | 1% |
| CVE-2023-38499 | typo3/cms-core | Information Disclosure due to Out-of-scope Site Resolution | low | 3.7 | 1% |
| CVE-2022-0569 | snipe/snipe-it | Exposure of Sensitive Information in snipe/snipe-it | medium | 4.3 | 1% |
| CVE-2023-0994 | francoisjacquet/rosariosis | RosarioSIS Improper Access Control vulnerability | high | 7.5 | 1% |
| CVE-2022-24784 | statamic/cms | Discoverability of user password hash in Statamic CMS | low | 3.7 | 1% |
| CVE-2021-32473 | moodle/moodle | Moodle Information Disclosure vulnerability | medium | 5.3 | 1% |
| CVE-2021-4377 | doneren-met-mollie (WordPress plugin) | The Doneren met Mollie plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.8.5 via the dmm_exp | medium | 6.5 | 1% |
| CVE-2021-43564 | hov/jobfair | Unrestricted access to predictable file paths in hov/jobfair | high | 7.5 | 1% |
| CVE-2026-45793 | composer/composer | Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs | high | 7.5 | 1% |
| CVE-2024-5483 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includ | medium | 5.3 | 1% |
| CVE-2022-0384 | video-conferencing-with-zoom (WordPress plugin) | The Video Conferencing with Zoom WordPress plugin before 3.8.17 does not have authorisation in its vczapi_get_wp_users AJAX action, allowing | medium | 4.3 | 1% |
| CVE-2023-5192 | pimcore/demo | Pimcore Demo Allows GraphQL Introspection | medium | 6.5 | 1% |
| CVE-2018-20154 | wp-maintenance-mode (WordPress plugin) | The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses. | medium | 4.3 | 1% |
| CVE-2016-5014 | moodle/moodle | Moodle sensitive information disclosure | medium | 5.4 | 1% |
| CVE-2022-0565 | pimcore/pimcore | Cross-site Scripting in pimcore | medium | 6.4 | 1% |
| CVE-2022-2558 | simple-job-board (WordPress plugin) | The Simple Job Board WordPress plugin before 2.10.0 is susceptible to Directory Listing which allows the public listing of uploaded resumes | medium | 5.3 | 1% |
| CVE-2026-26273 | idno/known | Known affected by Account Takeover via Password Reset Token Leakage | critical | 9.8 | 1% |
| CVE-2025-24408 | magento/community-edition, magento/project-community-edition | Magento Information Exposure vulnerability | medium | 6.5 | 1% |