Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-45332 | automad/automad | Automad has Broken Access Control: Unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint | high | 7.5 | 1% |
| CVE-2023-1263 | cmp-coming-soon-maintenance (WordPress plugin) | The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 4.1.6 via | medium | 5.3 | 1% |
| CVE-2019-9942 | twig/twig | Twig Sandbox Information Disclosure | low | 3.7 | 1% |
| CVE-2011-4279 | moodle/moodle | Moodle does not use the forceloginforprofiles setting for course-profiles access control | medium | 0.0 | 1% |
| CVE-2018-20980 | ninja-forms (WordPress plugin) | The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering. | high | 7.5 | 1% |
| CVE-2021-31567 | download-monitor (WordPress plugin) | Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6). The plugin | medium | 6.8 | 1% |
| CVE-2015-9345 | link-log (WordPress plugin) | The link-log plugin before 2.0 for WordPress has HTTP Response Splitting. | high | 7.5 | 1% |
| CVE-2020-5680 | ec-cube/ec-cube | EC-CUBE Improper input validation vulnerability | high | 7.5 | 1% |
| CVE-2005-4875 | typo3/cms | TYPO3 Reveals Sensitive Information via Direct Request to `misc/phpcheck/` | high | 0.0 | 1% |
| CVE-2012-2353 | moodle/moodle | Moodle Exposes Sensitive User Information | medium | 0.0 | 1% |
| CVE-2011-3744 | ezyang/htmlpurifier | HTML Purifier allows remote attackers to obtain sensitive information | medium | 5.3 | 1% |
| CVE-2012-5890 | sjbr/sr-feuser-register | Front End User Registration (sr_feuser_register) extension for TYPO3 allows remote attackers to obtain user names, passwords | medium | 0.0 | 1% |
| CVE-2021-39189 | pimcore/pimcore | Observable Response Discrepancy in Lost Password Service | medium | 5.3 | 1% |
| CVE-2022-29248 | guzzlehttp/guzzle, drupal/core | Cross-domain cookie leakage in Guzzle | high | 8.0 | 1% |
| CVE-2012-1589 | drupal/drupal | Drupal Open Redirect | medium | 0.0 | 1% |
| CVE-2021-20281 | moodle/moodle | Moodle allowed some users without permission to view other users' full names | medium | 5.3 | 1% |
| CVE-2021-32711 | shopware/platform | Exposure of Sensitive Information to an Unauthorized Actor | critical | 9.1 | 1% |
| CVE-2015-7503 | zendframework/zend-crypt, zendframework/zendframework | Zend Framework Information Disclosure | high | 7.5 | 1% |
| CVE-2014-3542 | moodle/moodle | Moodle allows remote attackers to read arbitrary files | medium | 0.0 | 1% |
| CVE-2018-10363 | booking-calendar (WordPress plugin) | An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress. Multiple parameters allow | high | 7.5 | 1% |
| CVE-2020-26138 | silverstripe/framework | FormField with square brackets in field name skips validation | medium | 5.3 | 1% |
| CVE-2016-3124 | simplesamlphp/simplesamlphp | SimpleSAMLphp Information leakage issue in the sanitycheck module | medium | 5.3 | 1% |
| CVE-2019-18887 | symfony/http-kernel, symfony/symfony | Symfony Http-Kernel has non-constant time comparison in UriSigner | high | 8.1 | 1% |
| CVE-2021-32759 | openmage/magento-lts | Data Flow Sanitation Issue Fix | high | 0.0 | 1% |
| CVE-2014-10388 | wp-support-plus-responsive-ticket-system (WordPress plugin) | The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has full path disclosure. | medium | 5.3 | 1% |
| CVE-2017-18545 | invite-anyone (WordPress plugin) | The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input. | high | 7.5 | 1% |
| CVE-2022-42344 | magento/community-edition | Magento Improper input validation vulnerability | high | 8.8 | 1% |
| CVE-2022-25602 | responsive-menu (WordPress plugin) | Nonce token leak vulnerability leading to arbitrary file upload, theme deletion, plugin settings change discovered in Responsive Menu WordPr | high | 8.3 | 1% |
| CVE-2020-15005 | mediawiki/core | img_auth.php may leak private extension images into the public cache | medium | 0.0 | 1% |
| CVE-2022-0813 | phpmyadmin/phpmyadmin | Exposure of Sensitive Information to an Unauthorized Actor in PhpMyAdmin | high | 7.5 | 1% |
| CVE-2018-1135 | moodle/moodle | Moodle Portfolio forum caller class allows a user to download any file | medium | 6.5 | 1% |
| CVE-2015-5340 | moodle/moodle | Moodle sensitive information disclosure | medium | 4.3 | 1% |
| CVE-2019-5884 | studio-42/elfinder | Sensitive Data Exposure in elFinder | medium | 5.9 | 1% |
| CVE-2017-12874 | simplesamlphp/simplesamlphp-module-infocard | SimpleSAMLphp InfoCard module Incorrect signature verification | high | 7.5 | 1% |
| CVE-2022-25271 | drupal/core | Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to impro | high | 7.5 | 1% |
| CVE-2013-7073 | typo3/cms | TYPO3 vulnerable to Information Disclosure via Content Editing Wizards component | medium | 6.5 | 1% |
| CVE-2022-36105 | typo3/cms, typo3/cms-core | TYPO3 CMS vulnerable to User Enumeration via Response Timing | medium | 5.3 | 1% |
| CVE-2024-1247 | concrete5/concrete5 | Concrete CMS vulnerable to stored XSS via the Role Name field | low | 2.0 | 1% |
| CVE-2017-2642 | moodle/moodle | Moodle User fullname disclosure on user preferences page | medium | 6.5 | 1% |
| CVE-2017-13761 | fastly/magento2 | Fastly Magento2 sensitive information disclosure | medium | 6.5 | 1% |
| CVE-2021-41114 | typo3/cms, typo3/cms-core | HTTP Host Header Injection | medium | 4.8 | 1% |
| CVE-2019-10667 | librenms/librenms | Exposure of Sensitive Information to an Unauthorized Actor in LibreNMS | medium | 5.3 | 1% |
| CVE-2020-11063 | typo3/cms, typo3/cms-core | Information Disclosure in Password Reset | low | 3.7 | 1% |
| CVE-2019-14978 | payu-india-payment-gateway (WordPress plugin) | /payu/icpcheckout/ in the WooCommerce PayU India Payment Gateway plugin 2.1.1 for WordPress allows Parameter Tampering in the purchaseQuanti | medium | 5.3 | 1% |
| CVE-2019-10911 | symfony/security, symfony/security-http, symfony/symfony | Improper authentication in Symfony | high | 7.5 | 1% |
| CVE-2022-23982 | perfect-woocommerce-brands (WordPress plugin) | The vulnerability discovered in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4) allows server information exposure. | medium | 4.3 | 1% |
| CVE-2017-6926 | drupal/core, drupal/drupal | Drupal Comment reply form allows access to restricted content | high | 8.1 | 1% |
| CVE-2013-6389 | drupal/drupal | Drupal has open redirect vulnerability in the Overlay module | high | 7.5 | 1% |
| CVE-2013-7079 | friendsoftypo3/openid | TYPO3 OpenID extension Open redirect vulnerability | medium | 0.0 | 1% |
| CVE-2009-4160 | jweiland/kk-downloader | TYPO3 Simple Download-System with Counter and Categories Vulnerable to Information Disclosure | medium | 0.0 | 1% |