Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-41325 | getkirby/cms | Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection | high | 0.0 | 0% |
| CVE-2026-49981 | twig/twig | Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template` | high | 0.0 | 0% |
| CVE-2026-57994 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ public FAQ APIs expose inactive FAQ content | medium | 5.3 | 0% |
| CVE-2022-3880 | antihacker (WordPress plugin) | The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan WordPress plugin before 4.20 does not have pr | medium | 6.5 | 0% |
| CVE-2024-9654 | easy-digital-downloads (WordPress plugin) | The Easy Digital Downloads plugin for WordPress is vulnerable to Improper Authorization in versions 3.1 through 3.3.4. This is due to a lack | low | 3.7 | 0% |
| CVE-2022-3879 | car-dealer (WordPress plugin) | The Car Dealer (Dealership) and Vehicle sales WordPress Plugin WordPress plugin before 3.05 does not have proper authorisation and CSRF in a | medium | 6.5 | 0% |
| CVE-2026-42843 | getgrav/grav-plugin-api | Grav API Privilege Escalation to Super Admin | high | 8.8 | 0% |
| CVE-2026-47231 | admidio/admidio | Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders | high | 8.1 | 0% |
| CVE-2026-55475 | snipe/snipe-it | Snipe-IT's import created_by can be overwritten | medium | 5.7 | 0% |
| CVE-2022-3882 | wp-memory (WordPress plugin) | The Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix Plugin WordPress plugin before 2.46 does not have proper authoris | medium | 6.5 | 0% |
| CVE-2022-3883 | stopbadbots (WordPress plugin) | The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not have proper authori | medium | 6.5 | 0% |
| CVE-2026-55462 | snipe/snipe-it | Snipe-IT has an authorization bypass on print inventory page | medium | 4.3 | 0% |
| CVE-2023-49783 | silverstripe/admin | No permission checks for editing/deleting records with CSV import form | medium | 4.3 | 0% |
| CVE-2026-46366 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has unauthenticated FAQ permission bypass via getFaqBySolutionId fallback query | high | 7.5 | 0% |
| CVE-2026-34364 | wwbn/avideo | AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php | medium | 5.3 | 0% |
| CVE-2026-55472 | snipe/snipe-it | Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation | medium | 4.3 | 0% |
| CVE-2026-46635 | twig/twig | Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects) | low | 0.0 | 0% |
| CVE-2025-3644 | moodle/moodle | Moodle's AJAX section delete does not respect course_can_delete_section() | medium | 4.3 | 0% |
| CVE-2025-8068 | ht-mega-for-elementor (WordPress plugin) | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to an impro | medium | 4.3 | 0% |
| CVE-2025-48446 | drupal/commerce_alphabank_redirect | This module enables you to pay for Commerce order to an environment provided and secured by the bank The module doesn't | high | 8.8 | 0% |
| CVE-2024-43433 | moodle/moodle | Moodle's user/power level management inconsistent with suspended users | medium | 5.3 | 0% |
| CVE-2025-26526 | moodle/moodle | Moodle's feedback response viewing and deletions did not respect Separate Groups mode | medium | 6.5 | 0% |
| CVE-2026-47227 | admidio/admidio | Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php | medium | 6.5 | 0% |
| CVE-2026-55479 | snipe/snipe-it | Snipe-IT has incorrect permission for legacy license checkin API | medium | 0.0 | 0% |
| CVE-2025-3647 | moodle/moodle | Moodle allows IDOR when accessing the cohorts report | medium | 4.3 | 0% |
| CVE-2026-41657 | admidio/admidio | Admidio Exposes Cross-Organization Member Data via Permission Check Mismatch in contacts_data.php | medium | 4.9 | 0% |
| CVE-2025-48445 | drupal/commerce_eurobank_redirect | This module enables you to pay for Commerce order to an environment provided and secured by the bank The module doesn't | high | 8.8 | 0% |
| CVE-2026-45703 | pimcore/pimcore | Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export | medium | 6.4 | 0% |
| CVE-2025-31673 | drupal/core | Bulk operations allow authorized users to modify several nodes at once from the Content page (`/admin/content`). A site | medium | 4.6 | 0% |
| CVE-2026-44832 | snipe/snipe-it | Snipe-IT has Privilege Escalation via API Permissions Assignment | high | 8.8 | 0% |
| CVE-2025-30741 | pixelfed/pixelfed | Pixelfed may allow unauthorized actor to view private posts and private users | medium | 4.3 | 0% |
| CVE-2020-15248 | october/backend | Privilege escalation by backend users assigned to the default "Publisher" system role | medium | 4.0 | 0% |
| CVE-2025-59020 | typo3/cms-backend | TYPO3 CMS Allows Broken Access Control in Edit Document Controller | medium | 0.0 | 0% |
| CVE-2025-12082 | drupal/civictheme | CivicTheme is a design system and theme framework used to build content-rich Drupal websites. It includes editorial work | high | 7.5 | 0% |
| CVE-2026-48493 | snipe/snipe-it | Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment | medium | 5.5 | 0% |
| CVE-2025-67856 | moodle/moodle | Moodle has an authorization logic flaw | medium | 5.4 | 0% |
| CVE-2025-4101 | dc-woocommerce-multi-vendor (WordPress plugin) | The MultiVendorX – WooCommerce Multivendor Marketplace Solutions plugin for WordPress is vulnerable to unauthorized loss of data due to a mi | medium | 4.3 | 0% |
| CVE-2026-46362 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has an Authorization Bypass in All Admin Pages Due to Non-Terminating Permission Check | medium | 6.5 | 0% |
| CVE-2026-54244 | statamic/cms | Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors | low | 3.5 | 0% |
| CVE-2026-42137 | getkirby/cms | Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API | high | 0.0 | 0% |
| CVE-2024-47780 | typo3/cms-backend | Information Disclosure in TYPO3 Page Tree | low | 3.1 | 0% |
| CVE-2025-47937 | typo3/cms-core | TYPO3 Allows Information Disclosure via DBAL Restriction Handling | low | 3.7 | 0% |
| CVE-2026-8350 | concrete5/concrete5 | Concrete CMS is vulnerable to missing authorization in the bulk_user_assignment.php | high | 0.0 | 0% |
| CVE-2026-47230 | admidio/admidio | Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders | medium | 6.5 | 0% |
| CVE-2025-26531 | moodle/moodle | Moodle has an IDOR in badges allows disabling of arbitrary badges | low | 3.1 | 0% |
| CVE-2026-55643 | snipe/snipe-it | Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode | high | 0.0 | 0% |
| CVE-2026-41660 | admidio/admidio | Admidio has Inverted 2FA Reset Authorization Check that Lets Group Leaders Strip Admin TOTP | high | 7.1 | 0% |
| CVE-2024-48897 | moodle/moodle | moodle: IDOR in edit/delete RSS feed | medium | 6.5 | 0% |
| CVE-2026-42610 | getgrav/grav | Grav Vulnerable to Sensitive Information Disclosure via Accounts Service Bypass | medium | 6.5 | 0% |
| CVE-2024-7836 | themify-builder (WordPress plugin) | The Themify Builder plugin for WordPress is vulnerable to unauthorized post duplication due to missing checks on the duplicate_page_ajaxify | medium | 4.3 | 0% |