Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-0214 | custom-popup-builder (WordPress plugin) | The Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages, as such data can be sent by unauthentica | high | 7.5 | 2% |
| CVE-2022-0414 | dolibarr/dolibarr | Dolibarr vulnerable to Improper Validation of Specified Quantity in Input | medium | 4.3 | 1% |
| CVE-2022-0174 | dolibarr/dolibarr | Logic error in dolibarr | medium | 4.3 | 1% |
| CVE-2022-4171 | demon-image-annotation (WordPress plugin) | The demon image annotation plugin for WordPress is vulnerable to improper input validation in versions up to, and including 5.0. This is due | medium | 6.5 | 1% |
| CVE-2022-0596 | microweber/microweber | Microweber vulnerable to Improper Validation of Specified Quantity in Input | medium | 4.3 | 1% |
| CVE-2025-5257 | mautic/core | Mautic's Predictable Page Indexing Might Lead to Sensitive Data Exposure | medium | 6.5 | 0% |
| GHSA-78vr-q6cf-c7p6 | craftcms/commerce | Craft Commerce: Partial Payment Amount Without Lower Bound Validation | medium | 0.0 | – |
| GHSA-g7m4-839x-ch6v | spomky-labs/otphp | spomky-labs/otphp: Unbounded digits parameter in a provisioning URI triggers an uncaught DivisionByZeroError in OTP generation | high | 0.0 | – |