phpwarden
FeaturesComparePricingAdvisoriesBlogDocsChangelogLog in
Log inStart free

PHP vulnerability advisories

Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.

19,303CVEs
8,638Composer advisories
12,328WordPress advisories
35Actively exploited (KEV) →
CVEPackageTitleSeverityCVSSEPSS
CVE-2026-52882mantisbt/mantisbtMantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updatersmedium0.0–
GHSA-32wx-4gxx-h48fflarum/tagsUsers can edit the tags of any discussionmedium0.0–
GHSA-7vfx-4246-jcfhsolidinvoice/solidinvoiceSolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API tokens and notification transport settingshigh0.0–
Page 7 of 7 · 303 advisories
Severity and CVSS come from the upstream advisory (OSV.dev, NVD, FriendsOfPHP); KEV marks CVEs on CISA's Known Exploited Vulnerabilities list; EPSS is FIRST's 30-day exploitation probability. Rows sort exploitation-first: KEV, then EPSS, then CVSS.