Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-3095 | nilsteampassnet/teampass | TeamPass vulnerable to Improper Access Control | medium | 6.5 | 0% |
| CVE-2024-45233 | in2code/powermail | Powermail TYPO3 extension Broken Access Control in the OutputController | high | 7.3 | 0% |
| CVE-2025-5257 | mautic/core | Mautic's Predictable Page Indexing Might Lead to Sensitive Data Exposure | medium | 6.5 | 0% |
| CVE-2024-0452 | chatbot (WordPress plugin) | The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_ | medium | 5.0 | 0% |
| CVE-2024-0453 | chatbot (WordPress plugin) | The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_ | medium | 5.0 | 0% |
| CVE-2024-7429 | zotpress (WordPress plugin) | The Zotpress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Zotpress_proce | medium | 4.3 | 0% |
| CVE-2026-23495 | pimcore/admin-ui-classic-bundle | Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing | medium | 4.3 | 0% |
| CVE-2026-34733 | wwbn/avideo | AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard | medium | 6.5 | 0% |
| CVE-2024-13854 | education-addon (WordPress plugin) | The Education Addon for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includin | medium | 4.3 | 0% |
| CVE-2026-23494 | pimcore/pimcore | Pimcore is Vulnerable to Broken Access Control: Missing Function Level Authorization on "Static Routes" Listing | medium | 4.3 | 0% |
| CVE-2024-13430 | pagelayer (WordPress plugin) | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Information Exposure in all versions up to | medium | 4.3 | 0% |
| CVE-2024-13855 | prime-addons-for-elementor (WordPress plugin) | The Prime Addons for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, | medium | 4.3 | 0% |
| CVE-2024-13693 | enfold (WordPress theme) | The Enfold theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check in avia-export-class.php in al | medium | 5.3 | 0% |
| CVE-2026-32699 | facturascripts/facturascripts | FacturaScripts has Insecure Parameter Handling: Unauthorized Modification of Immutable 'nick' Field | medium | 4.3 | 0% |
| CVE-2024-12370 | wp-hotel-booking (WordPress plugin) | The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check when adding r | medium | 5.3 | 0% |
| CVE-2024-13457 | event-tickets (WordPress plugin) | The Event Tickets and Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includi | medium | 5.3 | 0% |
| CVE-2026-50886 | grumpydictator/firefly-iii | Project Firefly III has incorrect access control in the webhook management component | critical | 9.1 | 0% |
| CVE-2025-4431 | featured-image-plus (WordPress plugin) | The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to unauthorized modification of data due to a m | medium | 4.3 | 0% |
| CVE-2024-48899 | moodle/moodle | Moodle IDOR when accessing list of course badges | medium | 4.3 | 0% |
| CVE-2026-21447 | bagisto/bagisto | Bagisto has IDOR in Customer Order Reorder Functionality | high | 7.1 | 0% |
| CVE-2025-48202 | in2code/femanager | The femanager TYPO3 extension allows Insecure Direct Object Reference | medium | 5.3 | 0% |
| CVE-2026-7733 | funadmin/funadmin | Funadmin has an Improper Access Control Issue | high | 7.3 | 0% |
| CVE-2024-1439 | moodle/moodle | Moodle Improper Access Control vulnerability | medium | 6.5 | 0% |
| CVE-2022-25768 | mautic/core, mautic/core-lib | Mautic vulnerable to Improper Access Control in UI upgrade process | high | 7.0 | 0% |
| CVE-2026-23496 | pimcore/web2print-tools-bundle | Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization | medium | 5.4 | 0% |
| CVE-2024-2749 | vikbooking-hotel-booking-engine-\&-pms (WordPress plugin) | The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's access control mechanism fails to properly restrict access to its | medium | 5.9 | 0% |
| CVE-2023-6491 | strong-testimonials (WordPress plugin) | The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the w | medium | 4.3 | 0% |
| CVE-2024-1376 | event-post (WordPress plugin) | The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing capability check on the save_bulkdat | medium | 4.3 | 0% |
| CVE-2026-32299 | opensource-workshop/connect-cms | Connect CMS: Information Disclosure Due to Improper Authorization through the Page Content Retrieval Feature | high | 7.5 | 0% |
| CVE-2026-46696 | october/system | October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls | low | 3.3 | 0% |
| CVE-2024-47055 | mautic/core | Mautic segment cloning doesn't have a proper permission check | medium | 4.3 | 0% |
| CVE-2024-31503 | dolibarr/dolibarr | Dolibarr vulnerable to Cross-Site Request Forgery | high | 7.5 | 0% |
| CVE-2025-57758 | contao/contao, contao/core-bundle | Contao applies improper access control in the back end voters | medium | 4.3 | 0% |
| CVE-2026-34754 | mantisbt/mantisbt | MantisBT has an Authorization Bypass that Allows Uploading Attachments to Private Issues via REST API | medium | 4.3 | 0% |
| CVE-2025-13828 | mautic/core | Mautic user without privileged access to the Marketplace can install and uninstall composer packages | critical | 0.0 | 0% |
| CVE-2025-62393 | moodle/moodle | Moodle course access permissions are not properly checked in course_output_fragment_course_overview | medium | 4.3 | 0% |
| CVE-2026-54256 | winter/wn-backend-module | Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata | medium | 5.4 | 0% |
| CVE-2024-5331 | breakdance (WordPress plugin) | The Breakdance plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, and including, 1.7.2. This makes it | medium | 4.3 | 0% |
| CVE-2024-0373 | views-for-wpforms (WordPress plugin) | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forger | medium | 4.3 | 0% |
| CVE-2024-0374 | views-for-wpforms (WordPress plugin) | The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forger | medium | 4.3 | 0% |
| CVE-2025-60799 | phppgadmin/phppgadmin | phppgadmin contains an incorrect access control vulnerability | medium | 6.1 | 0% |
| CVE-2025-6680 | tutor (WordPress plugin) | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up | medium | 4.3 | 0% |
| CVE-2023-6968 | the-moneytizer (WordPress plugin) | The The Moneytizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.6.3. This is due | high | 8.1 | 0% |
| CVE-2026-8240 | concrete5/concrete5 | Concrete CMS is vulnerable to unauthenticated page metadata disclosure | medium | 0.0 | 0% |
| GHSA-rm67-g9ch-vxff | poweradmin/poweradmin | Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own | high | 8.1 | – |
| CVE-2024-30173 | causal/oidc | OpenID Connect Authentication (oidc) Typo3 extension Authentication Bypass | medium | 6.5 | – |
| GHSA-5rjc-jc28-cwgg | opensource-workshop/connect-cms | Connect-CMS Access control vulnerability | medium | 4.3 | – |
| GHSA-68wv-g3fw-pq7q | shopware/core, shopware/platform | Shopware Broken ACL on Document retrieval to access other customers documents | medium | 4.0 | – |
| GHSA-36mj-6r7r-mqhf | ezsystems/ezplatform-rest | User can obtain JWT token even if account is disabled | high | 0.0 | – |
| GHSA-9m6v-8fxc-4r44 | sulu/sulu | Sulu: Used API Keys may be available via Admin API | low | 0.0 | – |