Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-50888 | koillection/koillection | Koillection has an authenticated Server-Side Request Forgery issue | high | 8.1 | 0% |
| CVE-2026-48555 | spatie/laravel-medialibrary | Spatie Laravel Media Library contains a server-side request forgery vulnerability | high | 7.4 | 0% |
| CVE-2025-49597 | handcraftedinthealps/goodby-csv | handcraftedinthealps/goodby-csv has Potential Gadget Chain allowing Remote Code Execution | low | 3.9 | 0% |
| CVE-2024-13360 | aipower (WordPress plugin) | The AI Power: Complete AI Pack plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.8.9 | medium | 5.4 | 0% |
| CVE-2026-33766 | wwbn/avideo | AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints | medium | 0.0 | 0% |
| CVE-2024-11913 | bp-activity-plus-reloaded (WordPress plugin) | The Activity Plus Reloaded for BuddyPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and | medium | 5.4 | 0% |
| CVE-2026-42194 | admidio/admidio | Admidio has an incomplete fix for CVE-2026-32812 (SSRF) | medium | 6.8 | 0% |
| CVE-2026-52840 | alextselegidis/easyappointments | Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network | low | 2.7 | 0% |
| CVE-2025-28094 | shopxo/shopxo | ShopXO Vulnerable to Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS) | medium | 6.5 | 0% |
| CVE-2026-54242 | statamic/cms | Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding) | medium | 4.9 | 0% |
| CVE-2025-6729 | woocommerce-paymaster-gateway-019 (WordPress plugin) | The PayMaster for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.4.31 | medium | 6.4 | 0% |
| CVE-2026-108360 | phpoffice/phpspreadsheet | PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading | medium | 6.4 | 0% |
| CVE-2026-53723 | guzzlehttp/guzzle-services | guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA Terminator | medium | 5.8 | 0% |
| CVE-2026-55599 | phpseclib/phpseclib | phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information | medium | 5.8 | 0% |
| CVE-2026-39368 | wwbn/avideo | WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services | medium | 6.5 | 0% |
| CVE-2026-39370 | wwbn/avideo | WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix | high | 7.1 | 0% |
| CVE-2026-6744 | bagisto/bagisto | Bagisto affected by Server-Side Request Forgery | medium | 6.3 | 0% |
| CVE-2026-48998 | guzzlehttp/psr7 | guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation | medium | 5.3 | 0% |
| CVE-2026-43879 | wwbn/avideo | AVideo has Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass | medium | 5.4 | 0% |
| CVE-2026-50552 | phanan/koel | Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail | medium | 6.3 | 0% |
| CVE-2026-49262 | aimeos/pagible | Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy | low | 3.0 | 0% |
| CVE-2026-7890 | concrete5/concrete5 | Concrete CMS's RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation | low | 0.0 | 0% |
| CVE-2026-45660 | statamic/cms | Statamic CMS: Server-Side Request Forgery via Glide | medium | 5.4 | 0% |
| CVE-2026-9557 | mautic/core | Mautic Focus component Vulnerable to SSRF | medium | 6.4 | 0% |
| CVE-2026-45619 | wwbn/avideo | AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD p | medium | 6.5 | 0% |
| CVE-2025-15611 | popup-box (WordPress plugin) | The Popup Box WordPress plugin before 5.5.0 does not properly validate nonces in the add_or_edit_popupbox() function before saving popup da | medium | 5.4 | 0% |
| CVE-2026-45262 | facturascripts/facturascripts | FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn` | critical | 9.9 | – |
| GHSA-2g98-f9jv-w8c5 | robrichards/xmlseclibs | robrichards/xmlseclibs XPath injection | high | 7.5 | – |
| CVE-2026-55372 | nukeviet/nukeviet | NukeViet: Pre-authentication SSRF via X-Forwarded-Host | high | 7.2 | – |
| CVE-2026-40500 | processwire/processwire | ProcessWire: server-side request forgery vulnerability in the admin panel's 'Add Module From URL' feature | medium | 6.8 | – |
| GHSA-8q6q-m837-fv64 | phanan/koel | Koel has SSRF through Authenticated Subsonic podcast feed URLs | medium | 6.4 | – |
| GHSA-wxjx-r2j2-96fx | wwbn/avideo | AVideo: Full-Read SSRF Through Unvalidated statsURL Parameter in plugin/Live/test.php | medium | 4.9 | – |
| GHSA-3cpp-fv95-mpr5 | shopware/core, shopware/platform | Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice | low | 2.7 | – |
| CVE-2021-30492 | zendesk/zendesk_api_client_php | Lack of Input Validation in zendesk_api_client_php for Zendesk Subdomain | critical | 0.0 | – |
| GHSA-2jx3-65f3-xr8r | spomky-labs/otphp | spomky-labs/otphp: Mass-assignment in Factory::loadFromProvisioningUri lets a hostile provisioning URI corrupt OTP state or leak an uncaught | medium | 0.0 | – |
| GHSA-3p7g-wrgg-wq45 | ibexa/graphql | GraphQL queries can expose password hashes | critical | 0.0 | – |
| GHSA-8pfh-mm2g-hmc3 | shopware/core, shopware/platform | Authenticated Server Side Request Forgery | low | 0.0 | – |