Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2010-3673 | typo3/cms-core | TYPO3 is vulnerable to Information Disclosure in the HTML mailing API | medium | 5.3 | 1% |
| CVE-2019-16409 | silverstripe/framework, symbiote/silverstripe-versionedfiles | SilverStripe Versioned Files module Unpublished files are exposed publicly | medium | 5.3 | 1% |
| CVE-2010-3664 | typo3/cms-backend | TYPO3 is vulnerable to Information Disclosure on the backend | medium | 6.5 | 1% |
| CVE-2018-19609 | showdoc/showdoc | Showdoc Forced Browsing | medium | 6.5 | 1% |
| CVE-2020-36175 | ninja-forms (WordPress plugin) | The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field. | medium | 5.3 | 1% |
| CVE-2024-8852 | all-in-one-wp-migration (WordPress plugin) | The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inclu | medium | 5.3 | 1% |
| CVE-2020-5274 | symfony/error-handler, symfony/symfony | Exceptions displayed in non-debug configurations in Symfony | medium | 4.6 | 1% |
| CVE-2017-14775 | illuminate/auth, laravel/framework | Laravel Sensitive Data Exposure | medium | 5.9 | 1% |
| CVE-2023-39999 | WordPress core | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1 | medium | 4.3 | 1% |
| CVE-2019-7951 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Information Leak | high | 7.5 | 1% |
| CVE-2023-28330 | moodle/moodle | Moodle arbitrary file read vulnerability | medium | 6.5 | 1% |
| CVE-2016-9955 | simplesamlphp/simplesamlphp | Incorrect signature verification in SimpleSAMLphp | medium | 6.3 | 1% |
| CVE-2018-0575 | baserproject/basercms | Sensitive Data Exposure in baserCMS | medium | 5.3 | 1% |
| CVE-2021-24585 | timetable-and-event-schedule (WordPress plugin) | The Timetable and Event Schedule WordPress plugin before 2.4.0 outputs the Hashed Password, Username and Email Address (along other less sen | medium | 6.5 | 1% |
| CVE-2022-24711 | codeigniter4/framework | Remote CLI Command Execution Vulnerability in CodeIgniter4 | critical | 9.4 | 1% |
| CVE-2022-1186 | be-popia-compliant (WordPress plugin) | The WordPress plugin Be POPIA Compliant exposed sensitive information to unauthenticated users consisting of site visitors emails and userna | medium | 5.3 | 1% |
| CVE-2018-19133 | flarum/framework | Flarum Core Leaks PII | medium | 5.3 | 1% |
| CVE-2019-7929 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Information Disclosure | medium | 4.9 | 1% |
| CVE-2019-19983 | minify (WordPress plugin) | In the WordPress plugin, Fast Velocity Minify before 2.7.7, the full web root path to the running WordPress application can be discovered. I | medium | 4.3 | 1% |
| CVE-2017-15110 | moodle/moodle | Moodle Exposure of Sensitive Information to an Unauthorized Actor | medium | 4.3 | 1% |
| CVE-2017-14240 | dolibarr/dolibarr | Dolibarr ERP and CRM Sensitive Data Disclosure | high | 7.5 | 1% |
| CVE-2022-0504 | microweber/microweber | Generation of Error Message Containing Sensitive Information in microweber | medium | 6.5 | 1% |
| CVE-2022-2117 | give (WordPress plugin) | The GiveWP plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.20.2 via the /donor-wa | medium | 5.3 | 1% |
| CVE-2013-4250 | typo3/cms | TYPO3 doesn't properly check file extensions | high | 0.0 | 1% |
| CVE-2010-3667 | typo3/cms-frontend | TYPO3 is vulnerable to Spam Abuse in the native form content element | medium | 5.3 | 1% |
| CVE-2021-22967 | concrete5/core | Exposure of sensitive information in concrete5/core | medium | 0.0 | 1% |
| CVE-2011-4901 | typo3/cms | Typo3 Arbitrary Information Disclosure | medium | 6.5 | 1% |
| CVE-2011-4904 | typo3/cms | Typo3 Improper Access Control | medium | 6.5 | 1% |
| CVE-2016-10899 | total-security (WordPress plugin) | The total-security plugin before 3.4.1 for WordPress has a settings-change vulnerability. | medium | 5.3 | 1% |
| CVE-2018-10189 | mautic/core | Mautic Sessions could be hijacked due to tracking contacts by an auto-incremented ID | high | 7.5 | 1% |
| CVE-2026-42613 | getgrav/grav | Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access | critical | 9.4 | 1% |
| CVE-2021-32712 | shopware/shopware | Exposure of Sensitive Information to an Unauthorized Actor | medium | 5.3 | 1% |
| CVE-2022-36032 | react/http | ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sent | medium | 5.3 | 1% |
| CVE-2018-1044 | moodle/moodle | Moodle Privilege escalation in quiz web services | medium | 4.3 | 1% |
| CVE-2009-3628 | typo3/cms-backend | TYPO3 Backend Discloses Encryption Key | medium | 0.0 | 1% |
| CVE-2017-20194 | formidable-form-builder (WordPress plugin) | The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the | medium | 5.3 | 1% |
| CVE-2022-31047 | typo3/cms, typo3/cms-core | Insertion of Sensitive Information into Log File in typo3/cms-core | medium | 5.3 | 1% |
| CVE-2021-32697 | neos/form | Form validation can be skipped | medium | 6.5 | 1% |
| CVE-2017-1000016 | phpmyadmin/phpmyadmin | phpMyAdmin Cookie attribute injection attack | high | 7.5 | 1% |
| CVE-2013-1832 | moodle/moodle | Moodle includes the WebDAV password in the configuration form | medium | 0.0 | 1% |
| CVE-2012-6099 | moodle/moodle | Moodle Arbitrary File Read via Backup Functionality | medium | 0.0 | 1% |
| CVE-2014-3946 | typo3/cms | Typo3 Information Disclosure | medium | 0.0 | 1% |
| CVE-2018-14774 | symfony/symfony | Symfony Host Header Injection | high | 7.2 | 1% |
| CVE-2021-32716 | shopware/platform, shopware/core | Exposure of Sensitive Information to an Unauthorized Actor | medium | 4.4 | 1% |
| CVE-2020-15132 | sulu/sulu | Reset Password / Login vulnerability in Sulu | medium | 5.3 | 1% |
| CVE-2022-27863 | vikbooking (WordPress plugin) | Sensitive Information Exposure in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 on WordPress allows attackers to get the | medium | 5.3 | 1% |
| CVE-2021-22951 | concrete5/core | Password exposure in concrete5/core | medium | 0.0 | 1% |
| CVE-2022-37783 | craftcms/cms | Craft CMS discloses password hashes | high | 7.5 | 1% |
| CVE-2017-12849 | silverstripe/cms | Silverstripe CMS User Enumeration | medium | 5.3 | 1% |
| CVE-2022-30598 | moodle/moodle | Exposure of Sensitive Information in moodle | medium | 4.3 | 1% |