Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.3, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-22640 | tecnickcom/tcpdf | TCPDF vulnerable to Regular Expression Denial of Service | medium | 0.0 | 1% |
| CVE-2026-52778 | yeswiki/yeswiki | YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service | critical | 9.8 | 1% |
| CVE-2026-45305 | symfony/symfony, symfony/yaml | Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex | low | 0.0 | 1% |
| CVE-2026-45133 | symfony/symfony, symfony/yaml | Symfony hardened the parser when handling untrusted input | low | 0.0 | 1% |
| CVE-2026-45756 | symfony/json-path, symfony/symfony | Symfony's JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS | low | 0.0 | 1% |
| CVE-2024-6434 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, a | low | 3.1 | 1% |
| CVE-2026-57584 | phalcon/cphalcon | Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS | high | 0.0 | 1% |
| CVE-2024-13926 | wp-syntax (WordPress plugin) | The WP-Syntax WordPress plugin through 1.2 does not properly handle input, allowing an attacker to create a post containing a large number o | high | 7.5 | 1% |
| CVE-2026-86430 | league/commonmark | league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters | high | 7.5 | 0% |
| CVE-2026-108082 | symfony/http-foundation, symfony/symfony | Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header | high | 0.0 | 0% |
| CVE-2024-13896 | wp-geshi-highlight (WordPress plugin) | The WP-GeSHi-Highlight — rock-solid syntax highlighting for 259 languages WordPress plugin through 1.4.3 processes user-supplied input as a | medium | 6.5 | 0% |
| CVE-2024-28864 | ilicmiljan/secure-props | [TagAwareCipher] - Decryption Failure (Regex Match) | low | 2.6 | 0% |
| CVE-2026-62237 | getgrav/grav | Grav: Authenticated ReDoS via regex_replace in Twig Sandbox | medium | 0.0 | 0% |
| CVE-2014-5244 | symfony/http-foundation, symfony/symfony | Symfony vulnerable to denial of service via a malicious HTTP Host header | high | 7.5 | – |
| GHSA-78hm-5hjw-58mh | ua-parser/uap-php | ua-parser/uap-php ReDoS vulnerability | medium | 0.0 | – |