Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-48736 | symfony/http-client, symfony/http-foundation, symfony/symfony | Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpCli | medium | 0.0 | 1% |
| CVE-2026-25525 | openmage/magento-lts | OpenMage LTS has a Path Traversal Filter Bypass in Dataflow Module | medium | 4.9 | 1% |
| CVE-2026-28783 | craftcms/cms | Craft CMS has Twig Function Blocklist Bypass | medium | 0.0 | 0% |
| CVE-2026-48557 | spatie/laravel-medialibrary | Spatie Laravel Media Library contains a file upload restriction bypass | high | 8.8 | 0% |
| CVE-2024-54149 | winter/wn-cms-module | Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion | high | 8.4 | 0% |
| CVE-2026-72779 | craftcms/cms | Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts | medium | 0.0 | 0% |
| CVE-2026-45066 | symfony/html-sanitizer, symfony/symfony | Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification | medium | 0.0 | 0% |
| CVE-2026-45753 | symfony/html-sanitizer, symfony/symfony | Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS) | low | 0.0 | 0% |
| CVE-2025-61924 | prestashop/ps_checkout | PrestaShop Checkout Target PayPal merchant account hijacking from backoffice | low | 3.8 | 0% |
| CVE-2026-26067 | october/system | October CMS has Safe Mode Bypass via CSS Preprocessor Compilers | medium | 4.9 | 0% |
| CVE-2026-33628 | invoiceninja/invoiceninja | Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items | medium | 5.4 | 0% |
| CVE-2026-26274 | october/october | October CMS has Safe Mode Bypass via Twig Database Write Operations | medium | 6.6 | 0% |
| CVE-2026-80201 | kimai/kimai | Kimai leaks API Token Hash via Invoice Twig Template | low | 2.0 | 0% |
| CVE-2026-61453 | getgrav/grav | Grav: XSS Blueprint Validation Bypass via Twig String Concatenation | medium | 0.0 | 0% |
| CVE-2025-69277 | paragonie/sodium_compat | libsodium has Incomplete List of Disallowed Inputs | medium | 4.5 | 0% |