Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-45690 | moodle/moodle | Moodle IDOR when deleting OAuth2 linked accounts | high | 7.5 | 0% |
| CVE-2026-46721 | evoweb/sf-register | TYPO3 sf_register extension allows unauthorized assignment of frontend user groups | medium | 0.0 | 0% |
| CVE-2026-33160 | craftcms/cms | Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL | low | 0.0 | 0% |
| CVE-2026-26016 | pterodactyl/panel | Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization | critical | 0.0 | 0% |
| CVE-2025-3889 | wordpress-simple-paypal-shopping-cart (WordPress plugin) | The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includi | medium | 5.3 | 0% |
| CVE-2026-33158 | craftcms/cms | Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR) | medium | 0.0 | 0% |
| CVE-2026-56385 | craftcms/cms | Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata | low | 0.0 | 0% |
| CVE-2026-33297 | wwbn/avideo | AVideo: IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php | medium | 0.0 | 0% |
| CVE-2024-13425 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Obj | medium | 4.3 | 0% |
| CVE-2024-13429 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Obj | medium | 4.3 | 0% |
| CVE-2026-38530 | krayin/laravel-crm | Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php | high | 8.1 | 0% |
| CVE-2026-38532 | krayin/laravel-crm | Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php | high | 8.1 | 0% |
| CVE-2026-47231 | admidio/admidio | Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders | high | 8.1 | 0% |
| CVE-2024-6410 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versio | medium | 4.3 | 0% |
| CVE-2026-47226 | admidio/admidio | Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges | medium | 6.5 | 0% |
| CVE-2023-6223 | learnpress (WordPress plugin) | The LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.5.7 via the | medium | 4.3 | 0% |
| CVE-2023-6504 | profile-builder (WordPress plugin) | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unautho | medium | 4.3 | 0% |
| CVE-2023-6630 | contact-form-7-dynamic-text-extension (WordPress plugin) | The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, an | medium | 4.3 | 0% |
| CVE-2024-13854 | education-addon (WordPress plugin) | The Education Addon for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includin | medium | 4.3 | 0% |
| CVE-2026-28781 | craftcms/cms | Craft CMS: Entries Authorship Spoofing via Mass Assignment | medium | 0.0 | 0% |
| CVE-2025-4691 | easync-booking (WordPress plugin) | The Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking plugin for WordPress is vulnerable to Insecure Direct Objec | medium | 5.3 | 0% |
| CVE-2024-5438 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions | medium | 4.3 | 0% |
| CVE-2024-12767 | buddyboss-platform (WordPress plugin) | The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private p | low | 3.5 | 0% |
| CVE-2026-33052 | mantisbt/mantisbt | MantisBT Has Authorization Bypass in Global Profile Creation | medium | 0.0 | 0% |
| CVE-2026-55515 | snipe/snipe-it | Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint | medium | 5.0 | 0% |
| CVE-2025-3636 | moodle/moodle | Moodle allows IDOR in RSS block, which allows access to additional RSS feeds | medium | 4.3 | 0% |
| CVE-2024-13601 | majestic-support (WordPress plugin) | The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Ref | medium | 4.3 | 0% |
| CVE-2024-13855 | prime-addons-for-elementor (WordPress plugin) | The Prime Addons for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, | medium | 4.3 | 0% |
| CVE-2026-55482 | snipe/snipe-it | Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update | medium | 6.3 | 0% |
| CVE-2021-3991 | dolibarr/dolibarr | Improper Authorization in dolibarr/dolibarr | medium | 4.3 | 0% |
| CVE-2025-7899 | in2code/powermail | Powermail extension for TYPO3 allows Insecure Direct Object Reference | medium | 0.0 | 0% |
| CVE-2024-13832 | ut-elementor-addons-lite (WordPress plugin) | The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.8 v | medium | 4.3 | 0% |
| CVE-2024-13873 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Obj | medium | 4.3 | 0% |
| CVE-2026-47227 | admidio/admidio | Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php | medium | 6.5 | 0% |
| CVE-2024-13457 | event-tickets (WordPress plugin) | The Event Tickets and Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includi | medium | 5.3 | 0% |
| CVE-2024-12131 | wp-job-portal (WordPress plugin) | The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Obj | medium | 4.3 | 0% |
| CVE-2024-12114 | foogallery (WordPress plugin) | The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Insecure Direct | medium | 4.3 | 0% |
| CVE-2024-10787 | lastudio-element-kit (WordPress plugin) | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4 | medium | 4.3 | 0% |
| CVE-2024-12472 | post-duplicator (WordPress plugin) | The Post Duplicator plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.36 via the mtphr_dupl | medium | 4.3 | 0% |
| CVE-2022-3459 | woocommerce-multiple-free-gift (WordPress plugin) | The WooCommerce Multiple Free Gift plugin for WordPress is vulnerable to gift manipulation in all versions up to, and including, 1.2.3. This | medium | 5.3 | 0% |
| CVE-2026-49858 | api-platform/core, api-platform/hal, api-platform/json-api | API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate | medium | 5.9 | 0% |
| CVE-2024-4874 | bricks (WordPress plugin) | The Bricks Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.8 via th | medium | 4.3 | 0% |
| CVE-2025-3292 | user-registration (WordPress plugin) | The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure D | medium | 4.3 | 0% |
| CVE-2026-47266 | verbb/formie | formie's unauthenticated front-end submission editing can overwrite existing submissions | high | 0.0 | 0% |
| CVE-2024-13692 | woo-refund-and-exchange-lite (WordPress plugin) | The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPre | medium | 5.4 | 0% |
| CVE-2024-10779 | cowidgets-elementor-addons (WordPress plugin) | The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.0 via | medium | 5.3 | 0% |
| CVE-2026-32300 | opensource-workshop/connect-cms | Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information | high | 8.1 | 0% |
| CVE-2024-12102 | typer-core (WordPress plugin) | The Typer Core plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.6 via the 'elementor-tem | medium | 4.3 | 0% |
| CVE-2024-5942 | page-or-post-clone (WordPress plugin) | The Page and Post Clone plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0 via | medium | 4.3 | 0% |
| CVE-2024-7848 | user-private-files (WordPress plugin) | The User Private Files – WordPress File Sharing Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all version | medium | 4.3 | 0% |