Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24347 | sp-project-\&-document-manager (WordPress plugin) | The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and | high | 8.8 | 54% |
| CVE-2021-25036 | all-in-one-seo-pack (WordPress plugin) | The All in One SEO WordPress plugin before 4.1.5.3 is affected by a Privilege Escalation issue, which was discovered during an internal audi | high | 8.8 | 3% |
| CVE-2020-5301 | simplesamlphp/simplesamlphp | Information disclosure of source code in SimpleSAMLphp | low | 3.0 | 1% |
| CVE-2026-107381 | enshrined/svg-sanitize | svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences | medium | 6.5 | 0% |
| CVE-2024-55634 | drupal/core, drupal/core-recommended, drupal/drupal | Drupal's uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation. | medium | 0.0 | 0% |
| CVE-2026-62230 | getgrav/grav | Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems | high | 0.0 | 0% |
| CVE-2026-47346 | typo3/cms-core, typo3/cms-form | TYPO3 CMS has Broken Access Control in its Form Framework | high | 0.0 | 0% |