Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-41129 | craftcms/cms | Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations | medium | 0.0 | 0% |
| CVE-2025-47936 | typo3/cms-webhooks | TYPO3 CMS Webhooks Server Side Request Forgery | low | 3.3 | 0% |
| CVE-2026-27732 | wwbn/avideo | AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php | high | 8.1 | 0% |
| CVE-2024-13834 | responsive-add-ons (WordPress plugin) | The Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme plugin for WordPress is vulnerable t | medium | 5.4 | 0% |
| CVE-2024-0677 | pz-linkcard (WordPress plugin) | The Pz-LinkCard WordPress plugin through 2.5.1 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could a | medium | 5.1 | 0% |
| CVE-2024-2090 | remote-content-shortcode (WordPress plugin) | The Remote Content Shortcode plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5 via | medium | 6.4 | 0% |
| CVE-2024-13695 | enfold (WordPress theme) | The Enfold theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.9 via the 'attachment_ | medium | 6.4 | 0% |
| CVE-2025-5817 | import-products-to-wc (WordPress plugin) | The Amazon Products to WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1 | high | 7.2 | 0% |
| CVE-2024-13845 | gravity-forms-webhooks (WordPress plugin) | The Gravity Forms WebHooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.0 via | medium | 5.5 | 0% |
| CVE-2026-33347 | league/commonmark | league/commonmark has an embed extension allowed_domains bypass | medium | 0.0 | 0% |
| CVE-2026-38527 | krayin/laravel-crm | Webkul Krayin CRM has Server-Side Request Forgery (SSRF) | high | 8.5 | 0% |
| CVE-2026-46683 | knplabs/knp-snappy | Snappy : SSRF and local file read via the xsl-style-sheet option | medium | 0.0 | 0% |
| CVE-2026-50888 | koillection/koillection | Koillection has an authenticated Server-Side Request Forgery issue | high | 8.1 | 0% |
| CVE-2026-48555 | spatie/laravel-medialibrary | Spatie Laravel Media Library contains a server-side request forgery vulnerability | high | 7.4 | 0% |
| CVE-2024-13360 | aipower (WordPress plugin) | The AI Power: Complete AI Pack plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.8.9 | medium | 5.4 | 0% |
| CVE-2026-33766 | wwbn/avideo | AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints | medium | 0.0 | 0% |
| CVE-2024-11913 | bp-activity-plus-reloaded (WordPress plugin) | The Activity Plus Reloaded for BuddyPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and | medium | 5.4 | 0% |
| CVE-2026-42194 | admidio/admidio | Admidio has an incomplete fix for CVE-2026-32812 (SSRF) | medium | 6.8 | 0% |
| CVE-2026-52840 | alextselegidis/easyappointments | Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network | low | 2.7 | 0% |
| CVE-2025-28094 | shopxo/shopxo | ShopXO Vulnerable to Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS) | medium | 6.5 | 0% |
| CVE-2026-54242 | statamic/cms | Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding) | medium | 4.9 | 0% |
| CVE-2025-6729 | woocommerce-paymaster-gateway-019 (WordPress plugin) | The PayMaster for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.4.31 | medium | 6.4 | 0% |
| CVE-2026-108360 | phpoffice/phpspreadsheet | PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading | medium | 6.4 | 0% |
| CVE-2026-55599 | phpseclib/phpseclib | phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information | medium | 5.8 | 0% |
| CVE-2026-39368 | wwbn/avideo | WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services | medium | 6.5 | 0% |
| CVE-2026-39370 | wwbn/avideo | WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix | high | 7.1 | 0% |
| CVE-2026-6744 | bagisto/bagisto | Bagisto affected by Server-Side Request Forgery | medium | 6.3 | 0% |
| CVE-2026-48998 | guzzlehttp/psr7 | guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation | medium | 5.3 | 0% |
| CVE-2026-43879 | wwbn/avideo | AVideo has Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass | medium | 5.4 | 0% |
| CVE-2026-50552 | phanan/koel | Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail | medium | 6.3 | 0% |
| CVE-2026-49262 | aimeos/pagible | Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy | low | 3.0 | 0% |
| CVE-2026-7890 | concrete5/concrete5 | Concrete CMS's RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation | low | 0.0 | 0% |
| CVE-2026-45660 | statamic/cms | Statamic CMS: Server-Side Request Forgery via Glide | medium | 5.4 | 0% |
| CVE-2026-9557 | mautic/core | Mautic Focus component Vulnerable to SSRF | medium | 6.4 | 0% |
| CVE-2026-45619 | wwbn/avideo | AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD p | medium | 6.5 | 0% |
| CVE-2025-15611 | popup-box (WordPress plugin) | The Popup Box WordPress plugin before 5.5.0 does not properly validate nonces in the add_or_edit_popupbox() function before saving popup da | medium | 5.4 | 0% |
| CVE-2026-45262 | facturascripts/facturascripts | FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn` | critical | 9.9 | – |
| CVE-2026-55372 | nukeviet/nukeviet | NukeViet: Pre-authentication SSRF via X-Forwarded-Host | high | 7.2 | – |
| CVE-2026-40500 | processwire/processwire | ProcessWire: server-side request forgery vulnerability in the admin panel's 'Add Module From URL' feature | medium | 6.8 | – |
| GHSA-8q6q-m837-fv64 | phanan/koel | Koel has SSRF through Authenticated Subsonic podcast feed URLs | medium | 6.4 | – |
| GHSA-wxjx-r2j2-96fx | wwbn/avideo | AVideo: Full-Read SSRF Through Unvalidated statsURL Parameter in plugin/Live/test.php | medium | 4.9 | – |
| GHSA-3cpp-fv95-mpr5 | shopware/core, shopware/platform | Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice | low | 2.7 | – |
| CVE-2021-30492 | zendesk/zendesk_api_client_php | Lack of Input Validation in zendesk_api_client_php for Zendesk Subdomain | critical | 0.0 | – |
| GHSA-8pfh-mm2g-hmc3 | shopware/core, shopware/platform | Authenticated Server Side Request Forgery | low | 0.0 | – |