Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| GHSA-6mgp-v5cm-ghg5 | drupal/core | Drupal core Remote Code Execution | critical | 0.0 | – |
| GHSA-7v68-3pr5-h3cr | drupal/core | Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution | critical | 0.0 | – |
| GHSA-7vcx-v65q-9wpg | phpxmlrpc/phpxmlrpc | XML-RPC for PHP's `Wrapper::buildClientWrapperCode` method allows code injection via malicious `$client` argument | medium | 0.0 | – |
| GHSA-9895-26wr-4fgv | ezsystems/ezpublish-legacy | EZsystems Remote code execution in file uploads | high | 0.0 | – |
| GHSA-g4pf-3jvq-2gcw | typo3/cms | TYPO3 Remote Code Execution in third party library swiftmailer | high | 0.0 | – |
| GHSA-jf8c-36vw-98x4 | drupal/drupal | Drupal core Remote Code Execution | critical | 0.0 | – |
| GHSA-pqjm-xcp8-wgmm | ezsystems/ezpublish-legacy | Ez Platform and Legacy are prone to an insecure interpretation of PHP/PHAR uploads | medium | 0.0 | – |