Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-39189 | pimcore/pimcore | Observable Response Discrepancy in Lost Password Service | medium | 5.3 | 1% |
| CVE-2020-11063 | typo3/cms, typo3/cms-core | Information Disclosure in Password Reset | low | 3.7 | 1% |
| CVE-2022-39315 | getkirby/cms | Kirby CMS vulnerable to user enumeration in the brute force protection | medium | 6.5 | 1% |
| CVE-2023-39343 | sulu/sulu | Sulu Observable Response Discrepancy on Admin Login | medium | 4.3 | 1% |
| CVE-2025-24980 | pimcore/admin-ui-classic-bundle | Pimcore Admin Classic Bundle allows user enumeration | medium | 0.0 | 1% |
| CVE-2026-84307 | filament/filament | Filament: Password validity disclosure for accounts denied panel access on login page | low | 3.7 | 0% |
| CVE-2026-54768 | wp-graphql/wp-graphql | WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeratio | medium | 0.0 | 0% |
| CVE-2022-39314 | getkirby/cms | Kirby CMS vulnerable to user enumeration in the code-based login and password reset forms | medium | 4.8 | 0% |
| CVE-2025-30150 | shopware/core, shopware/platform | Shopware 6 allows attackers to check for registered accounts through the store-api | medium | 5.3 | 0% |
| CVE-2026-25509 | ci4-cms-erp/ci4ms | CI4MS Vulnerable to User Email Enumeration via Password Reset Flow | medium | 5.3 | 0% |
| CVE-2024-39912 | web-auth/webauthn-framework, web-auth/webauthn-lib | The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames | medium | 5.3 | 0% |
| CVE-2024-47059 | mautic/core | Mautic allows users enumeration due to weak password login | medium | 4.3 | 0% |
| CVE-2024-47057 | mautic/core | Mautic allows user name enumeration due to response time difference on password reset form | medium | 5.3 | 0% |
| CVE-2025-66307 | getgrav/grav | Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure | medium | 6.5 | 0% |
| CVE-2025-9824 | mautic/core | Mautic Vulnerable to User Enumeration via Response Timing | medium | 5.9 | 0% |
| CVE-2026-33688 | wwbn/avideo | AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint | medium | 5.3 | 0% |
| CVE-2026-107843 | contao/core-bundle | Contao: The registration module re-sends activation mails | medium | 5.3 | 0% |
| CVE-2026-31888 | shopware/core, shopware/platform | Shopware has user enumeration via distinct error codes on Store API login endpoint | medium | 5.3 | 0% |
| CVE-2026-44306 | statamic/cms | Statamic CMS vulnerable to email enumeration via forgot password endpoint | medium | 5.3 | 0% |
| CVE-2026-45620 | wwbn/avideo | AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration sibling that survives `d9cdc7024 | medium | 5.3 | 0% |
| GHSA-256q-hx8w-xcqx | silverstripe/framework | Silverstripe Framework user enumeration via timing attack on login and password reset forms | medium | 5.3 | – |
| GHSA-gq4g-fpc9-vjfq | web-auth/webauthn-lib | Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protectio | low | 0.0 | – |
| GHSA-j7f5-gfqm-pcx3 | pterodactyl/panel | Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system | medium | 0.0 | – |