Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-9588 | magento/community-edition, magento/core, magento/project-community-edition | Magento Signature verification bypass | high | 7.2 | 3% |
| CVE-2016-2041 | phpmyadmin/phpmyadmin | phpMyAdmin Unsafe comparison of XSRF/CSRF token | high | 7.5 | 3% |
| CVE-2020-9690 | magento/community-edition | Magento observable timing discrepancy vulnerability | medium | 4.2 | 2% |
| CVE-2021-21424 | lexik/jwt-authentication-bundle, symfony/maker-bundle, symfony/security +4 more | Prevent user enumeration using Guard or the new Authenticator-based Security | medium | 5.3 | 2% |
| CVE-2021-24651 | poll-maker (WordPress plugin) | The Poll Maker WordPress plugin before 3.4.2 allows unauthenticated users to perform SQL injection via the ays_finish_poll AJAX action. Whil | high | 7.5 | 2% |
| CVE-2019-18886 | symfony/security-http, symfony/symfony | User enumeration leak using switch user functionality in Symfony | medium | 5.3 | 2% |
| CVE-2019-1020002 | pterodactyl/panel | Pterodactyl vulnerable to 2FA Sniffing | high | 7.5 | 1% |
| CVE-2021-39189 | pimcore/pimcore | Observable Response Discrepancy in Lost Password Service | medium | 5.3 | 1% |
| CVE-2019-18887 | symfony/http-kernel, symfony/symfony | Symfony Http-Kernel has non-constant time comparison in UriSigner | high | 8.1 | 1% |
| CVE-2022-36105 | typo3/cms, typo3/cms-core | TYPO3 CMS vulnerable to User Enumeration via Response Timing | medium | 5.3 | 1% |
| CVE-2020-11063 | typo3/cms, typo3/cms-core | Information Disclosure in Password Reset | low | 3.7 | 1% |
| CVE-2019-16669 | pagekit/pagekit | Pagekit User enumeration | medium | 5.3 | 1% |
| CVE-2019-10764 | simplito/elliptic-php | Timing attacks might allow practical recovery of the long-term private key | high | 7.4 | 1% |
| CVE-2022-0569 | snipe/snipe-it | Exposure of Sensitive Information in snipe/snipe-it | medium | 4.3 | 1% |
| CVE-2022-24784 | statamic/cms | Discoverability of user password hash in Statamic CMS | low | 3.7 | 1% |
| CVE-2022-2891 | wp-2fa (WordPress plugin) | The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could be abused to leak inf | medium | 5.9 | 1% |
| CVE-2022-3907 | clerk.io (WordPress plugin) | The Clerk WordPress plugin before 4.0.0 is affected by time-based attacks in the validation function for all API requests due to the usage o | high | 7.5 | 1% |
| CVE-2020-15151 | openmage/magento-lts | Observable Timing Discrepancy in OpenMage LTS | high | 8.0 | 1% |
| CVE-2025-51586 | prestashop/prestashop | Presta Shop vulnerable to email enumeration | medium | 4.2 | 1% |
| CVE-2023-38871 | gugoan/economizzer | Economizzer user enumeration vulnerability | medium | 5.3 | 1% |
| CVE-2023-50708 | yiisoft/yii2-authclient | yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation | low | 0.0 | 1% |
| CVE-2022-44381 | snipe/snipe-it | Snipe-IT allows attackers to check whether a user account exists | medium | 5.3 | 1% |
| CVE-2016-15015 | barzahlen/barzahlen-php | Barzahlen Payment Module PHP SDK vulnerable to Observable Timing Discrepancy | medium | 5.3 | 1% |
| CVE-2024-11297 | page-and-post-restriction (WordPress plugin) | The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all vers | medium | 5.3 | 1% |
| CVE-2026-55555 | dompdf/dompdf | Dompdf: File existence oracle via font-face stylesheet declaration | low | 0.0 | 1% |
| CVE-2021-46876 | ezsystems/ezpublish-kernel | /user/sessions endpoint allows detecting valid accounts | medium | 5.3 | 1% |
| CVE-2026-25509 | ci4-cms-erp/ci4ms | CI4MS Vulnerable to User Email Enumeration via Password Reset Flow | medium | 5.3 | 0% |
| CVE-2024-47057 | mautic/core | Mautic allows user name enumeration due to response time difference on password reset form | medium | 5.3 | 0% |
| GHSA-346h-749j-r28w | mdanter/ecc | PHPECC vulnerable to multiple cryptographic side-channel attacks | critical | 9.1 | – |
| GHSA-7vwg-39h8-8qp8 | ezsystems/ezplatform-rest | /user/sessions endpoint allows detecting valid accounts | high | 0.0 | – |