Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-3024 | simple-bitcoin-faucets (WordPress plugin) | The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authentic | medium | 5.4 | 0% |
| CVE-2024-48901 | moodle/moodle | moodle: IDOR when fetching report schedules | medium | 4.3 | 0% |
| CVE-2025-3880 | social-polls-by-opinionstage (WordPress plugin) | The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to unauthorized modification of data due to a misco | medium | 4.3 | 0% |
| CVE-2024-34434 | wordpress-meta-data-and-taxonomies-filter (WordPress plugin) | Incorrect Authorization vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Code Inclusion, Functionality Mi | medium | 6.5 | 0% |
| CVE-2026-53638 | sylius/sylius | Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint | medium | 4.3 | 0% |
| CVE-2024-1803 | embedpress (WordPress plugin) | The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor pl | medium | 4.3 | 0% |
| CVE-2024-5860 | tickera-event-ticketing-system (WordPress plugin) | The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on | medium | 4.3 | 0% |
| CVE-2026-40099 | getkirby/cms | Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter | medium | 0.0 | 0% |
| CVE-2026-49288 | statamic/cms | Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources | medium | 4.3 | 0% |
| CVE-2026-72785 | craftcms/cms | Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element | medium | 0.0 | 0% |
| CVE-2026-41233 | froxlor/froxlor | Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add() | medium | 5.4 | 0% |
| CVE-2025-26532 | moodle/moodle | Moodle allows teachers to evade trusttext config when restoring glossary entries | low | 3.1 | 0% |
| CVE-2026-42070 | mantisbt/mantisbt | MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API | medium | 0.0 | 0% |
| CVE-2026-31887 | shopware/core, shopware/platform | Shopware: Unauthenticated data extraction possible through store-api.order endpoint | high | 0.0 | 0% |
| CVE-2026-33650 | wwbn/avideo | AVideo: Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion | high | 7.6 | 0% |
| CVE-2026-48507 | snipe/snipe-it | Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users | high | 7.1 | 0% |
| CVE-2026-41232 | froxlor/froxlor | Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index Allows Cross-Customer Email Spoofing | medium | 5.0 | 0% |
| CVE-2026-21896 | getkirby/cms | Kirby is missing permission checks in the content changes API | medium | 0.0 | 0% |
| CVE-2026-26274 | october/october | October CMS has Safe Mode Bypass via Twig Database Write Operations | medium | 6.6 | 0% |
| CVE-2026-41235 | froxlor/froxlor | Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement | high | 8.8 | 0% |
| CVE-2025-62394 | moodle/moodle | Moodle sends quiz-related messages to inactive/suspended users | medium | 4.3 | 0% |
| CVE-2026-108360 | phpoffice/phpspreadsheet | PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading | medium | 6.4 | 0% |
| CVE-2026-45009 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: Ordinary Authenticated User Can Access Admin-Only API Endpoints Due to Insufficient Authorization Check in phpMyFAQ | medium | 4.3 | 0% |
| CVE-2026-9808 | mautic/core | Mautic has an Authorization Bypass in API v2 Endpoints | high | 7.1 | 0% |
| CVE-2026-107851 | contao/core-bundle | Contao: Improper access control in the table access voter | medium | 4.3 | 0% |
| CVE-2026-33884 | statamic/cms | Statamic's live preview token bypasses content protection for unrelated entries | medium | 4.3 | 0% |
| CVE-2026-29179 | october/system | October CMS: Editor Sub-Permission Bypass for Asset and Blueprint File Operations | low | 3.3 | 0% |
| GHSA-fm29-4mq3-phg6 | winter/wn-backend-module | Winter: ImportExportController AJAX handlers bypass granular import/export permission gate | high | 8.3 | – |
| GHSA-3mm9-2p44-rw39 | silverstripe/cms | Silverstripe SiteTree Creation Permission Vulnerability | high | 7.5 | – |
| GHSA-7hh9-gp72-wh7h | auth0/login | Auth0 Laravel SDK has Improper Audience Validation via Auth0-PHP SDK dependency | medium | 6.8 | – |
| GHSA-f3r2-88mq-9v4g | auth0/symfony | Auth0 Symfony SDK has Improper Audience Validation via Auth0-PHP SDK | medium | 6.8 | – |
| GHSA-vvg7-8rmq-92g7 | auth0/wordpress | Auth0 WordPress has Improper Audience Validation via Auth0-PHP SDK Dependency | medium | 6.8 | – |
| GHSA-mhf7-xp6r-6qrc | livewire/livewire | Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order | medium | 6.5 | – |
| GHSA-m895-2hj3-8cg9 | shopware/core, shopware/platform | Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually | medium | 5.3 | – |
| GHSA-g776-759r-pf6x | typo3/cms-core | TYPO3 Broken Access Control in Import Module | medium | 4.3 | – |
| GHSA-h4fw-6r7f-w494 | web-auth/webauthn-framework | Webauthn has a User Verification Downgrade via Default-Open ClientOverridePolicy | low | 2.1 | – |
| GHSA-5q58-x5h2-v5rx | shopware/core, shopware/platform | Authenticated Privilege Escalation | low | 0.0 | – |
| GHSA-5q8v-j673-m5v4 | grumpydictator/firefly-iii | Firefly III user API endpoints expose all users' information to any authenticated user (IDOR) | medium | 0.0 | – |