Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2015-8125 | symfony/form, symfony/security, symfony/security-http +1 more | Symfony Vulnerable to Timing Attack | high | 0.0 | 3% |
| CVE-2016-15015 | barzahlen/barzahlen-php | Barzahlen Payment Module PHP SDK vulnerable to Observable Timing Discrepancy | medium | 5.3 | 1% |
| CVE-2026-32935 | phpseclib/phpseclib | phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack | high | 0.0 | 0% |
| CVE-2026-40194 | phpseclib/phpseclib | phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals() | low | 3.7 | 0% |
| CVE-2026-48166 | filament/filament | Filament: Timing-based user enumeration on login page | medium | 5.3 | 0% |
| CVE-2026-84308 | phpseclib/phpseclib | phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery | medium | 6.3 | 0% |
| CVE-2026-25597 | prestashop/prestashop | PrestaShop affected by time based enumeration in FO login form | medium | 5.3 | 0% |
| CVE-2026-80199 | kimai/kimai | Kimai: Username enumeration via timing on X-AUTH-USER | low | 3.7 | 0% |
| CVE-2026-48011 | shopware/core, shopware/platform | Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames | low | 3.7 | 0% |
| CVE-2026-72701 | getgrav/grav | Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection | low | 3.7 | 0% |
| CVE-2026-54736 | phalcon/cphalcon | Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel) | high | 0.0 | 0% |
| GHSA-2x4v-g8cx-jxrq | ibexa/core | Login timing attack in ibexa/core | critical | 0.0 | – |
| GHSA-342c-vcff-2ff2 | ezsystems/ezplatform-kernel | Login timing attack in ezsystems/ezplatform-kernel | critical | 0.0 | – |
| GHSA-5739-39v2-5754 | web-token/jwt-framework, web-token/jwt-library | RSA1_5 (RSAES-PKCS1-v1_5) decryption lacks implicit rejection, exposing a Bleichenbacher/Marvin padding oracle | medium | 0.0 | – |
| GHSA-xfqg-p48g-hh94 | ezsystems/ezpublish-kernel | Login timing attack in ezsystems/ezpublish-kernel | critical | 0.0 | – |