Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-39369 | apereo/phpcas | phpCAS vulnerable to Service Hostname Discovery Exploitation | high | 8.0 | 2% |
| CVE-2026-114509 | laravel/framework | Laravel TokenGuard authentication bypass through non-string API credentials | critical | 0.0 | 1% |
| CVE-2024-43426 | moodle/moodle | Moodle has arbitrary file read risk through pdfTeX | high | 7.5 | 1% |
| CVE-2022-51012 | pocketmine/pocketmine-mp | Insufficient type validation in pocketmine/pocketmine-mp | high | 7.5 | 1% |
| CVE-2026-52763 | yeswiki/yeswiki | YesWiki: SQL injection via the `recentchanges` action `period` argument leads to arbitrary DB read | medium | 6.5 | 0% |
| CVE-2026-29788 | miraheze/ts-portal | TSPortal: Any user can forge self-deletion requests for any account | high | 7.5 | 0% |
| CVE-2026-45069 | symfony/security-http, symfony/symfony | Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims | medium | 0.0 | 0% |
| CVE-2026-7887 | concrete5/concrete5 | Concrete CMS: OAuth 2.0 Authorization-Code Handler Bypasses Account Status | low | 0.0 | 0% |