Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-59713 | snipe/snipe-it | Snipe-IT allows unsafe deserialization | medium | 6.8 | 0% |
| CVE-2025-13081 | drupal/core | Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the | medium | 5.9 | 0% |
| CVE-2026-52777 | yeswiki/yeswiki | YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize | critical | 0.0 | 0% |
| CVE-2026-2898 | funadmin/funadmin | funadmin: Deserialization Vulnerability in Backend Endpoint via AuthCloudService getMember Function | medium | 5.5 | 0% |
| CVE-2026-49400 | october/system | October CMS: PHP Object Injection via Backend Widget Session Storage | low | 3.3 | 0% |
| CVE-2026-7317 | getgrav/grav | Grav has Insecure Deserialization in File Cache | medium | 5.0 | 0% |
| CVE-2026-1323 | cpsit/typo3-mailqueue | The mailqueue TYPO3 extension has Insecure Deserialization in `TransportFailure` class | high | 8.8 | 0% |
| CVE-2026-49740 | typo3/cms-core | TYPO3 CMS has Insecure Deserialization via Core API | medium | 0.0 | 0% |
| CVE-2026-0859 | typo3/cms-core | TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool | medium | 0.0 | 0% |
| CVE-2026-7888 | concrete5/concrete5 | Concrete CMS is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components | high | 0.0 | 0% |
| CVE-2026-0895 | cpsit/typo3-mailqueue | mailqueue TYPO3 extension affected by Insecure Deserialization in QueueableFileTransport | medium | 0.0 | 0% |
| CVE-2026-10721 | concrete5/concrete5 | Concrete CMS: PHP Object Injection via unserialize() calls | high | 0.0 | 0% |
| GHSA-97m3-52wr-xvv2 | phenx/php-svg-lib | Dompdf's usage of vulnerable version of phenx/php-svg-lib leads to restriction bypass and potential RCE | critical | 10.0 | – |
| CVE-2019-9081 | laravel/framework | Laravel Framework Deserialization Vulnerability | critical | 9.8 | – |
| GHSA-mmcv-fvq8-r9x3 | symfony/symfony | Symfony XML decoding attack vector through external entities | critical | 9.8 | – |
| GHSA-5h5v-m596-r6rf | typo3/cms-core | TYPO3 Possible Insecure Deserialization in Extbase Request Handling | high | 8.1 | – |
| GHSA-96jg-pmc4-cx39 | typo3/cms-core | TYPO3 CMS Insecure Deserialization | high | 7.5 | – |
| GHSA-2867-6rrm-38gr | illuminate/cookie | Laravel Cookie serialization vulnerability | high | 0.0 | – |
| GHSA-4v5g-8pq2-32m2 | typo3/phar-stream-wrapper | By-passing Protection of PharStreamWrapper Interceptor | medium | 0.0 | – |
| GHSA-6jvx-8ch9-j2jr | laravel/framework | Laravel Cookie serialization vulnerability | high | 0.0 | – |
| GHSA-862m-5253-832r | auth0/wordpress | Auth0 Wordpress Plugin vulnerable to Deserialization of Untrusted Data | critical | 0.0 | – |
| GHSA-8h28-f46f-m87h | typo3/cms | Insecure Deserialization in TYPO3 CMS | high | 0.0 | – |
| GHSA-98j6-67v3-mw34 | auth0/symfony | Auth0 Symfony SDK Deserialization of Untrusted Data vulnerability | critical | 0.0 | – |
| GHSA-c42h-56wx-h85q | auth0/login | laravel-auth0 SDK Deserialization of Untrusted Data vulnerability | critical | 0.0 | – |
| GHSA-h29g-c9cx-c73q | torrentpier/torrentpier | torrentpier has PHP Serialize Injections | critical | 0.0 | – |
| GHSA-ppgf-8745-8pgx | typo3/cms | Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS | high | 0.0 | – |