PHP vulnerability advisories

Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.

19,303CVEs

8,638Composer advisories

12,328WordPress advisories

35Actively exploited (KEV) →

CVE	Package	Title	Severity	CVSS	EPSS
CVE-2025-25286	islandora/crayfish	Crayfish allows Remote Code Execution via Homarus Authorization header	critical	9.8	1%
CVE-2026-102601	league/flysystem	Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting	low	3.5	0%
GHSA-27qh-8cxx-2cr5	aws/aws-sdk-php	AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters	high	0.0	–
GHSA-c2p2-hgjg-9r3f	islandora/crayfish	Crayfish Allows Remote Code Execution via hypercube X-Islandora-Args Header	critical	0.0	–

Severity and CVSS come from the upstream advisory (OSV.dev, NVD, FriendsOfPHP); KEV marks CVEs on CISA's Known Exploited Vulnerabilities list; EPSS is FIRST's 30-day exploitation probability. Rows sort exploitation-first: KEV, then EPSS, then CVSS.