Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2009-1149 | phpmyadmin/phpmyadmin | phpMyAdmin HTTP Response Splitting Vulnerability | high | 0.0 | 1% |
| CVE-2016-3166 | drupal/core, drupal/drupal | Drupal CRLF injection vulnerability in the drupal_set_header function | medium | 5.9 | 1% |
| CVE-2011-4203 | moodle/moodle | Moodle CRLF Injection Vulnerability in Calendar Component | medium | 0.0 | 1% |
| CVE-2026-50188 | getkirby/cms | Kirby: Request header injection in `Http\Remote` | medium | 0.0 | 0% |
| CVE-2026-39971 | s9y/serendipity | Serendipity has a Host Header Injection allows SMTP header injection via unvalidated HTTP_HOST in Message-ID email header | high | 7.2 | 0% |
| CVE-2026-55766 | guzzlehttp/psr7 | guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization | medium | 4.8 | 0% |
| CVE-2026-49214 | guzzlehttp/psr7 | guzzlehttp/psr7 has CRLF Injection via URI Host Component | medium | 5.3 | 0% |