Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-23984 | wpdiscuz (WordPress plugin) | Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11). | low | 3.7 | 1% |
| CVE-2019-16669 | pagekit/pagekit | Pagekit User enumeration | medium | 5.3 | 1% |
| CVE-2008-6507 | phpbb/phpbb | phpBB vulnerable to sensitive information disclosure | high | 7.5 | 1% |
| CVE-2016-5012 | moodle/moodle | Moodle Glossary search displays entries without checking user permissions to view them | medium | 5.3 | 1% |
| CVE-2022-24747 | shopware/core, shopware/platform, shopware/storefront | HTTP caching is marking private HTTP headers as public in Shopware | medium | 6.3 | 1% |
| CVE-2017-12157 | moodle/moodle | Moodle sensitive information disclosure | medium | 4.3 | 1% |
| CVE-2019-10764 | simplito/elliptic-php | Timing attacks might allow practical recovery of the long-term private key | high | 7.4 | 1% |
| CVE-2020-10195 | popup-builder (WordPress plugin) | The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege | medium | 6.3 | 1% |
| CVE-2019-14979 | paypal-checkout-payment-gateway (WordPress plugin) | cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amo | medium | 5.3 | 1% |
| CVE-2018-6591 | jcbrand/converse.js | Converse.js Exposure of Sensitive Information | medium | 5.3 | 1% |
| CVE-2016-6625 | phpmyadmin/phpmyadmin | phpMyAdmin allows to detect if user is logged in | medium | 4.3 | 1% |
| CVE-2020-35934 | advanced-access-manager (WordPress plugin) | The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object (including all metadata) upon login via th | medium | 4.3 | 1% |
| CVE-2022-0588 | librenms/librenms | Missing Authorization in librenms/librenms | medium | 6.5 | 1% |
| CVE-2023-38499 | typo3/cms-core | Information Disclosure due to Out-of-scope Site Resolution | low | 3.7 | 1% |
| CVE-2020-12742 | iubenda-cookie-law-solution (WordPress plugin) | The iubenda-cookie-law-solution plugin before 2.3.5 for WordPress does not restrict URL sanitization to http protocols. | medium | 6.1 | 1% |
| CVE-2013-4144 | swfupload (WordPress plugin) | There is an object injection vulnerability in swfupload plugin for wordpress. | critical | 9.8 | 1% |
| CVE-2019-10134 | moodle/moodle | Moodle Private files uploaded via incoming mail processing could bypass quota restrictions | medium | 4.2 | 1% |
| CVE-2026-54718 | symbiote/silverstripe-advancedworkflow | silverstripe-advancedworkflow vulnerable to remote code execution via advanced workflow email template | high | 7.2 | 1% |
| CVE-2026-40176 | composer/composer | Composer has a command injection via malicious perforce repository | high | 7.8 | 1% |
| CVE-2023-2315 | opencart/opencart | OpenCart Path Traversal vulnerability | high | 8.1 | 1% |
| CVE-2022-0569 | snipe/snipe-it | Exposure of Sensitive Information in snipe/snipe-it | medium | 4.3 | 1% |
| CVE-2023-0994 | francoisjacquet/rosariosis | RosarioSIS Improper Access Control vulnerability | high | 7.5 | 1% |
| CVE-2022-24784 | statamic/cms | Discoverability of user password hash in Statamic CMS | low | 3.7 | 1% |
| CVE-2021-32473 | moodle/moodle | Moodle Information Disclosure vulnerability | medium | 5.3 | 1% |
| CVE-2021-4377 | doneren-met-mollie (WordPress plugin) | The Doneren met Mollie plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.8.5 via the dmm_exp | medium | 6.5 | 1% |
| CVE-2021-43564 | hov/jobfair | Unrestricted access to predictable file paths in hov/jobfair | high | 7.5 | 1% |
| CVE-2026-45793 | composer/composer | Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs | high | 7.5 | 1% |
| CVE-2017-2576 | moodle/moodle | Moodle Incorrect sanitation of attributes in forums | medium | 5.3 | 1% |
| CVE-2023-29293 | magento/community-edition, magento/project-community-edition | Magento Open Source affected by Improper Input Validation | low | 2.7 | 1% |
| CVE-2024-5483 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includ | medium | 5.3 | 1% |
| CVE-2022-0384 | video-conferencing-with-zoom (WordPress plugin) | The Video Conferencing with Zoom WordPress plugin before 3.8.17 does not have authorisation in its vczapi_get_wp_users AJAX action, allowing | medium | 4.3 | 1% |
| CVE-2022-0079 | showdoc/showdoc | showdoc is vulnerable to Generation of Error Message Containing Sensitive Information | medium | 5.3 | 1% |
| CVE-2013-2633 | matomo/matomo, piwik/piwik | Piwik (now Matomo) Reveals Sensitive Information by Accepting Input from `POST` Requests | medium | 0.0 | 1% |
| CVE-2023-5192 | pimcore/demo | Pimcore Demo Allows GraphQL Introspection | medium | 6.5 | 1% |
| CVE-2022-0622 | snipe/snipe-it | Generation of Error Message Containing Sensitive Information in Snipe-IT | medium | 5.3 | 1% |
| CVE-2023-1888 | directorist (WordPress plugin) | The Directorist plugin for WordPress is vulnerable to an arbitrary user password reset in versions up to, and including, 7.5.4. This is due | high | 8.8 | 1% |
| CVE-2011-4902 | typo3/cms | Typo3 Arbitrary File Delete | medium | 6.5 | 1% |
| CVE-2018-20154 | wp-maintenance-mode (WordPress plugin) | The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses. | medium | 4.3 | 1% |
| CVE-2016-5014 | moodle/moodle | Moodle sensitive information disclosure | medium | 5.4 | 1% |
| CVE-2022-0565 | pimcore/pimcore | Cross-site Scripting in pimcore | medium | 6.4 | 1% |
| CVE-2022-2558 | simple-job-board (WordPress plugin) | The Simple Job Board WordPress plugin before 2.10.0 is susceptible to Directory Listing which allows the public listing of uploaded resumes | medium | 5.3 | 1% |
| CVE-2026-26273 | idno/known | Known affected by Account Takeover via Password Reset Token Leakage | critical | 9.8 | 1% |
| CVE-2022-2891 | wp-2fa (WordPress plugin) | The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could be abused to leak inf | medium | 5.9 | 1% |
| CVE-2023-29530 | laminas/laminas-diactoros | HTTP Multiline Header Termination | high | 7.5 | 1% |
| CVE-2025-24408 | magento/community-edition, magento/project-community-edition | Magento Information Exposure vulnerability | medium | 6.5 | 1% |
| CVE-2017-9303 | illuminate/auth, laravel/framework, laravel/laravel | Laravel does not properly constrain the host portion of a password-reset URL | medium | 6.1 | 1% |
| CVE-2022-0174 | dolibarr/dolibarr | Logic error in dolibarr | medium | 4.3 | 1% |
| CVE-2011-4627 | typo3/cms | Typo3 Information Disclosure | medium | 6.5 | 1% |
| CVE-2011-4900 | typo3/cms | Typo3 Information Disclosure | medium | 6.5 | 1% |
| CVE-2023-37260 | league/oauth2-server | league/oauth2-server key exposed in exception message when passing as a string and providing an invalid pass phrase | high | 8.2 | 1% |