Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-22871 | spiral/roadrunner | RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency | critical | 9.1 | 1% |
| GHSA-7hh9-gp72-wh7h | auth0/login | Auth0 Laravel SDK has Improper Audience Validation via Auth0-PHP SDK dependency | medium | 6.8 | – |
| GHSA-f3r2-88mq-9v4g | auth0/symfony | Auth0 Symfony SDK has Improper Audience Validation via Auth0-PHP SDK | medium | 6.8 | – |
| GHSA-vvg7-8rmq-92g7 | auth0/wordpress | Auth0 WordPress has Improper Audience Validation via Auth0-PHP SDK Dependency | medium | 6.8 | – |
| GHSA-534c-hcr7-67jg | kimai/kimai | Kimai has an XXE Leading to Local File Read | medium | 6.5 | – |
| GHSA-vjwg-28gv-pm8h | pimcore/pimcore | Pimcore TinyMCE Bundle - tinymce CVE-2024-29203, CVE-2024-29881 | medium | 6.1 | – |
| GHSA-52cw-pvq9-9m5v | silverstripe/framework | Silverstripe uses TinyMCE which allows svg files linked in object tags | medium | 5.4 | – |
| GHSA-5j8p-438x-rgg5 | onelogin/php-saml | SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475 | critical | 0.0 | – |
| GHSA-c42h-56wx-h85q | auth0/login | laravel-auth0 SDK Deserialization of Untrusted Data vulnerability | critical | 0.0 | – |
| GHSA-vrpv-vw92-328g | rudloff/rtmpdump-bin | Multiple rtmpdump vulnerabilities | critical | 0.0 | – |