Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-6386 | wpml (WordPress plugin) | The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Templ | critical | 9.9 | 26% |
| CVE-2025-53833 | binarytorch/larecipe | LaRecipe is vulnerable to Server-Side Template Injection attacks | critical | 10.0 | 9% |
| CVE-2024-28116 | getgrav/grav | Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass | high | 8.8 | 6% |
| CVE-2023-34448 | getgrav/grav | Grav Server-side Template Injection (SSTI) via Twig Default Filters | high | 7.2 | 5% |
| CVE-2025-66294 | getgrav/grav | Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass | high | 0.0 | 3% |
| CVE-2023-34252 | getgrav/grav | Grav Server-side Template Injection (SSTI) via Twig Default Filters | high | 7.2 | 2% |
| CVE-2023-34253 | getgrav/grav | Grav Server-side Template Injection (SSTI) via Denylist Bypass Vulnerability | high | 7.2 | 2% |
| CVE-2023-2017 | shopware/core, shopware/platform | Shopware Has Improper Control of Generation of Code in Twig rendered views | high | 8.8 | 2% |
| CVE-2018-20465 | craftcms/cms | Craft CMS Vulnerable to Server-Side Template Injection | high | 7.2 | 2% |
| CVE-2025-46731 | craftcms/cms | Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI | high | 0.0 | 2% |
| CVE-2023-46245 | kimai/kimai | Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File | high | 7.2 | 1% |
| CVE-2022-0896 | microweber/microweber | Improper Neutralization of Special Elements Used in a Template Engine in microweber | high | 8.8 | 1% |
| CVE-2026-21450 | bagisto/bagisto | Bagisto SSTI vulnerability in type parameter can lead to RCE | high | 0.0 | 1% |
| CVE-2023-29297 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Improper Neutralization of Special Elements Used | critical | 9.1 | 1% |
| CVE-2026-52889 | verbb/formie | Formie Hidden field defaults vulnerable to Server-Side Template Injection | critical | 9.8 | 1% |
| CVE-2023-6743 | unlimited-elements-for-elementor (WordPress plugin) | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Remote Code Execution in all ve | high | 8.8 | 1% |
| CVE-2026-28697 | craftcms/cms | Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates | critical | 0.0 | 1% |
| CVE-2026-54718 | symbiote/silverstripe-advancedworkflow | silverstripe-advancedworkflow vulnerable to remote code execution via advanced workflow email template | high | 7.2 | 1% |
| CVE-2025-68454 | craftcms/cms | Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI | medium | 0.0 | 1% |
| CVE-2025-57811 | craftcms/cms | Craft CMS Potential Remote Code Execution via Twig SSTI | medium | 0.0 | 1% |
| CVE-2024-36694 | opencart/opencart | openCart Server-Side Template Injection (SSTI) vulnerability | high | 8.0 | 1% |
| CVE-2026-21448 | bagisto/bagisto | Bagisto has Normal & Blind SSTI from low-privilege user when ordering product | critical | 9.8 | 1% |
| CVE-2024-42355 | shopware/core, shopware/platform | Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag | high | 8.3 | 1% |
| CVE-2025-66297 | getgrav/grav | Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection | high | 0.0 | 1% |
| CVE-2026-52762 | yeswiki/yeswiki | YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates | high | 0.0 | 1% |
| CVE-2022-0323 | mustache/mustache | Mustache remote code injection vulnerability | high | 8.8 | 1% |
| CVE-2024-42356 | shopware/core, shopware/platform | Shopware vulnerable to Server Side Template Injection in Twig using Context functions | high | 8.3 | 1% |
| CVE-2026-28695 | craftcms/cms | Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget | medium | 0.0 | 1% |
| CVE-2026-11407 | pimcore/pimcore | Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed | high | 7.2 | 1% |
| CVE-2025-66299 | getgrav/grav | Grav is Vulnerable to Security Sandbox Bypass with SSTI (Server Side Template Injection) | high | 8.8 | 1% |
| CVE-2026-9558 | mautic/core | Mautic has Server-Side Template Injection (SSTI) in Theme Templates | critical | 9.9 | 1% |
| CVE-2026-28784 | craftcms/cms | Craft CMS has potential authenticated Remote Code Execution via Twig SSTI | medium | 0.0 | 1% |
| CVE-2026-73858 | solspace/craft-freeform | Solspace Freeform: Limited Twig template injection via submitted field values | medium | 5.3 | 1% |
| CVE-2026-59989 | phalcon/cphalcon | Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE) | critical | 0.0 | 1% |
| CVE-2024-58303 | fof/pretty-mail | FoF Pretty Mail has a server-side template injection vulnerability | high | 0.0 | 1% |
| CVE-2026-21449 | bagisto/bagisto | Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users | high | 8.8 | 1% |
| CVE-2026-28783 | craftcms/cms | Craft CMS has Twig Function Blocklist Bypass | medium | 0.0 | 0% |
| CVE-2026-45697 | verbb/formie | Formie: Pre-authenticated server-side template injection in Hidden fields | critical | 9.8 | 0% |
| CVE-2026-23626 | kimai/kimai | Kimai has an Authenticated Server-Side Template Injection (SSTI) | medium | 6.8 | 0% |
| CVE-2025-62416 | bagisto/bagisto | bagisto has Server Side Template Injection (SSTI) in Product Description | medium | 5.1 | 0% |
| CVE-2026-32261 | craftcms/webhooks | RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin | high | 0.0 | 0% |
| CVE-2025-66298 | getgrav/grav | Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms | high | 0.0 | 0% |
| CVE-2026-34587 | getkirby/cms | Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering | high | 8.1 | 0% |
| CVE-2024-35191 | verbb/formie | verbb/formie Server-Side Template Injection for variable-enabled settings | medium | 4.4 | 0% |
| CVE-2026-61453 | getgrav/grav | Grav: XSS Blueprint Validation Bypass via Twig String Concatenation | medium | 0.0 | 0% |
| GHSA-83jv-4prm-34g7 | shopware/shopware | Shopware Remote Code Execution Vulnerability | critical | 9.8 | – |