Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2017-5491 | WordPress core | wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with th | medium | 5.3 | 3% |
| CVE-2026-52824 | kimai/kimai | Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover | critical | 0.0 | 1% |
| CVE-2024-51758 | filament/actions | Filament has exported files stored in default (`public`) filesystem if not reconfigured | low | 2.4 | 1% |
| CVE-2026-35672 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: Default Empty API Token Authentication Bypass | high | 7.5 | 0% |
| CVE-2025-32378 | shopware/core, shopware/platform | Shopware default newsletter opt-in settings allow for mass sign-up abuse | medium | 5.3 | 0% |