Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2006-6016 | WordPress core | wp-admin/user-edit.php in WordPress before 2.0.5 allows remote authenticated users to read the metadata of an arbitrary user via a modified | medium | 6.5 | 2% |
| CVE-2026-54593 | pterodactyl/panel | Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions | high | 8.1 | 1% |
| CVE-2024-21549 | spatie/browsershot | Browsershot Improper Input Validation vulnerability | high | 8.6 | 1% |
| CVE-2026-33183 | saloonphp/saloon | Saloon has a Fixture Name Path Traversal Vulnerability | medium | 0.0 | 1% |
| CVE-2026-34570 | ci4-cms-erp/ci4ms | CI4MS: Account Deletion Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw) | high | 8.8 | 1% |
| CVE-2026-34572 | ci4-cms-erp/ci4ms | CI4MS: Account Deactivation Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw) | high | 8.8 | 1% |
| CVE-2025-63523 | feehi/feehicms | FeehiCMS fails to enforce server-side immutability | medium | 6.5 | 0% |