Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-66304 | getgrav/grav | Grav Exposes Password Hashes Leading to privilege escalation | medium | 6.2 | 0% |
| CVE-2026-67354 | guzzlehttp/guzzle | Guzzle: URI fragments disclosed in redirect Referer headers | medium | 5.9 | 0% |
| CVE-2026-67339 | guzzlehttp/guzzle | Guzzle: Proxy-Authorization headers can be sent to origin servers | medium | 5.3 | 0% |
| CVE-2026-67355 | guzzlehttp/guzzle | Guzzle: Host-only cookie scope is not preserved | medium | 5.9 | 0% |
| CVE-2025-67857 | moodle/moodle | Moodle Inserts Sensitive Information Into Sent Data | medium | 4.3 | 0% |
| CVE-2026-34579 | mantisbt/mantisbt | MantisBT has an authorization bypass in private issue monitoring | medium | 0.0 | 0% |
| CVE-2025-55155 | mantisbt/mantisbt | MantisBT lacks verification when changing a user's email address | medium | 5.4 | 0% |