Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-21424 | lexik/jwt-authentication-bundle, symfony/maker-bundle, symfony/security +4 more | Prevent user enumeration using Guard or the new Authenticator-based Security | medium | 5.3 | 2% |
| CVE-2021-24651 | poll-maker (WordPress plugin) | The Poll Maker WordPress plugin before 3.4.2 allows unauthenticated users to perform SQL injection via the ays_finish_poll AJAX action. Whil | high | 7.5 | 2% |
| CVE-2024-13609 | 1-click-migration (WordPress plugin) | The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure i | medium | 5.9 | 2% |
| CVE-2018-15601 | elefant/cms | Elefant CMS Improper Input Validation | critical | 9.8 | 2% |
| CVE-2022-0709 | booking-package (WordPress plugin) | The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this | high | 7.5 | 2% |
| CVE-2011-1028 | smarty/smarty | Smarty3 Arbitrary PHP Code Execution | critical | 9.8 | 2% |
| CVE-2020-36723 | listingpro (WordPress plugin) | The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Sensitive Data Exposure in versions before 2.6.1 via the | medium | 5.3 | 2% |
| CVE-2021-21357 | typo3/cms, typo3/cms-core, typo3/cms-form | Broken Access Control in Form Framework | high | 8.3 | 2% |
| CVE-2021-24893 | stars-rating (WordPress plugin) | The Stars Rating WordPress plugin before 3.5.1 does not validate the submitted rating, allowing submission of long integer, causing a Denial | high | 7.5 | 2% |
| CVE-2013-1831 | moodle/moodle | Moodle reveals absolute path in exception message | medium | 0.0 | 2% |
| CVE-2014-8328 | t3/dce | DCE extension for Typo3 Discloses Environment Information | medium | 5.3 | 2% |
| CVE-2011-3712 | cakephp/cakephp | CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php file | medium | 0.0 | 2% |
| CVE-2016-2151 | moodle/moodle | Moodle allows attackers to discover student e-mail addresses | medium | 4.3 | 2% |
| CVE-2021-28585 | magento/community-edition, magento/project-community-edition | Magento Improper input validation vulnerability | medium | 5.3 | 2% |
| CVE-2017-2643 | moodle/moodle | Moodle Global search displays user names for unauthenticated users | medium | 5.3 | 2% |
| CVE-2017-16790 | symfony/form, symfony/symfony | Symfony SSRF Vulnerability via Form Component | medium | 6.5 | 2% |
| CVE-2022-31091 | guzzlehttp/guzzle | Change in port not treated as a change in origin; sensitive headers leaked on redirect | high | 8.1 | 2% |
| CVE-2011-0986 | phpmyadmin/phpmyadmin | phpMyAdmin allows remote attackers to obtain installation path via direct request for nonexistent file | medium | 0.0 | 2% |
| CVE-2019-18886 | symfony/security-http, symfony/symfony | User enumeration leak using switch user functionality in Symfony | medium | 5.3 | 2% |
| CVE-2016-3732 | moodle/moodle | Moodle sensitive information disclosure | medium | 4.3 | 2% |
| CVE-2021-41120 | sylius/paypal-plugin | Sylius PayPal Plugin allows unauthorized access to Credit card form, exposing payer name and not requiring 3DS | high | 7.5 | 2% |
| CVE-2020-25703 | moodle/moodle | Exposure of Sensitive Information to an Unauthorized Actor in Moodle | medium | 5.3 | 2% |
| CVE-2013-4522 | moodle/moodle | Moodle vulnerable to Exposure of Sensitive Information to an Unauthorized Actor | medium | 0.0 | 2% |
| CVE-2011-3127 | WordPress core | WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 does not prevent rendering for (1) admin or (2) login pages inside a frame in a third-party | medium | 5.8 | 2% |
| CVE-2019-14800 | fv-wordpress-flowplayer (WordPress plugin) | The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via | medium | 5.3 | 2% |
| CVE-2016-6613 | phpmyadmin/phpmyadmin | phpMyAdmin Local file exposure through symlinks with UploadDir | medium | 5.3 | 2% |
| CVE-2022-24093 | magento/community-edition, magento/project-community-edition | Magento Open Source affected by Improper Input Validation | high | 7.2 | 2% |
| CVE-2018-20156 | wp-maintenance-mode (WordPress plugin) | The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated "site administrator" users to execute arbitrary PHP co | high | 7.2 | 2% |
| CVE-2006-4936 | moodle/moodle | Moodle does not properly validate module instance id | medium | 0.0 | 2% |
| CVE-2014-9509 | typo3/cms | Typo3 Vulnerable to Cache Poisoning | high | 0.0 | 1% |
| CVE-2014-5011 | dompdf/dompdf | DOMPDF Information Disclosure | medium | 6.5 | 1% |
| CVE-2020-13997 | shopware/core, shopware/platform | Shopware database password is leaked to an unauthenticated users | high | 7.5 | 1% |
| CVE-2022-31140 | cuyz/valinor | Valinor error messages leading to potential data exfiltration before v0.12.0 | high | 7.5 | 1% |
| CVE-2021-24894 | reviews-plus (WordPress plugin) | The Reviews Plus WordPress plugin before 1.2.14 does not validate the submitted rating, allowing submission of long integer, causing a Denia | medium | 6.5 | 1% |
| CVE-2019-1020002 | pterodactyl/panel | Pterodactyl vulnerable to 2FA Sniffing | high | 7.5 | 1% |
| CVE-2023-50262 | dompdf/dompdf | Denial of service caused by infinite recursion when parsing SVG images | medium | 5.3 | 1% |
| CVE-2021-32717 | shopware/core, shopware/platform | Private files publicly accessible with Cloud Storage providers | high | 7.5 | 1% |
| CVE-2026-6826 | concrete5/concrete5 | Concrete CMS is vulnerable to unauthenticated file usage disclosure | medium | 0.0 | 1% |
| CVE-2017-12872 | simplesamlphp/simplesamlphp | SimpleSAMLphp allows timing side-channel attacks | medium | 5.9 | 1% |
| CVE-2023-5070 | ultimate-social-media-icons (WordPress plugin) | The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to | medium | 6.5 | 1% |
| CVE-2013-4751 | symfony/symfony, symfony/validator | Symfony collectionCascaded and collectionCascadedDeeply fields security bypass | high | 8.1 | 1% |
| CVE-2021-24163 | ninja-forms (WordPress plugin) | The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protect | high | 8.8 | 1% |
| CVE-2022-41876 | ezsystems/ezplatform-graphql | ezplatform-graphql GraphQL queries can expose password hashes | high | 7.5 | 1% |
| CVE-2015-8760 | typo3/cms | TYPO3 allows remote attackers to embed Flash videos from external domain | medium | 6.1 | 1% |
| CVE-2009-1149 | phpmyadmin/phpmyadmin | phpMyAdmin HTTP Response Splitting Vulnerability | high | 0.0 | 1% |
| CVE-2021-28566 | magento/community-edition | Magento Information Disclosure vulnerability | low | 3.7 | 1% |
| CVE-2012-1159 | moodle/moodle | Moodle included private user files in course backups | medium | 4.3 | 1% |
| CVE-2017-14231 | genix/cms | GeniXCMS denial of service (account blockage) | medium | 5.3 | 1% |
| CVE-2019-11633 | honeypress (WordPress plugin) | HoneyPress through 2016-09-27 can be fingerprinted by attackers because of the ingrained unique www.atxsec.com and ayylmao.wpengine.com host | high | 7.5 | 1% |
| CVE-2024-20758 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Improper Input Validation | critical | 9.0 | 1% |