Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2009-0815 | typo3/cms | TYPO3 leaks a hash secret in an error message | medium | 0.0 | 42% |
| CVE-2024-45440 | drupal/core, drupal/core-recommended, drupal/drupal | Drupal Full Path Disclosure | medium | 5.3 | 9% |
| CVE-2022-0660 | microweber/microweber | Generation of Error Message Containing Sensitive Information in microweber | high | 7.5 | 7% |
| CVE-2020-13997 | shopware/core, shopware/platform | Shopware database password is leaked to an unauthenticated users | high | 7.5 | 1% |
| CVE-2022-31140 | cuyz/valinor | Valinor error messages leading to potential data exfiltration before v0.12.0 | high | 7.5 | 1% |
| CVE-2020-5274 | symfony/error-handler, symfony/symfony | Exceptions displayed in non-debug configurations in Symfony | medium | 4.6 | 1% |
| CVE-2022-0504 | microweber/microweber | Generation of Error Message Containing Sensitive Information in microweber | medium | 6.5 | 1% |
| CVE-2021-32712 | shopware/shopware | Exposure of Sensitive Information to an Unauthorized Actor | medium | 5.3 | 1% |
| CVE-2022-31047 | typo3/cms, typo3/cms-core | Insertion of Sensitive Information into Log File in typo3/cms-core | medium | 5.3 | 1% |
| CVE-2020-15132 | sulu/sulu | Reset Password / Login vulnerability in Sulu | medium | 5.3 | 1% |
| CVE-2022-0079 | showdoc/showdoc | showdoc is vulnerable to Generation of Error Message Containing Sensitive Information | medium | 5.3 | 1% |
| CVE-2022-0622 | snipe/snipe-it | Generation of Error Message Containing Sensitive Information in Snipe-IT | medium | 5.3 | 1% |
| CVE-2023-37260 | league/oauth2-server | league/oauth2-server key exposed in exception message when passing as a string and providing an invalid pass phrase | high | 8.2 | 1% |
| CVE-2022-0083 | remdex/livehelperchat | User enumeration in livehelperchat | medium | 0.0 | 1% |
| CVE-2022-23794 | joomla/filesystem | Path Disclosure within joomla/filesystem class | medium | 5.3 | 1% |
| CVE-2015-10012 | sumocoders/framework-user-bundle | FrameworkUserBundle Generates Error Message Containing Sensitive Information | high | 7.5 | 1% |
| CVE-2022-39315 | getkirby/cms | Kirby CMS vulnerable to user enumeration in the brute force protection | medium | 6.5 | 1% |
| CVE-2019-16768 | sylius/sylius | Internal exception message exposure for login action in Sylius | low | 3.5 | 1% |
| CVE-2023-47636 | pimcore/admin-ui-classic-bundle | pimcore/admin-ui-classic-bundle Full Path Disclosure via re-export document | medium | 5.3 | 1% |
| CVE-2024-13538 | bigbuy-wc-dropshipping-connector (WordPress plugin) | The BigBuy Dropshipping Connector for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and incl | medium | 5.3 | 1% |
| CVE-2023-46240 | codeigniter4/framework | CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment | high | 7.5 | 1% |
| CVE-2024-13535 | actionwear-products-sync (WordPress plugin) | The Actionwear products sync plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.3.2. This is | medium | 5.3 | 1% |
| CVE-2025-32238 | online-booking-\&-scheduling-calendar (WordPress plugin) | Generation of Error Message Containing Sensitive Information vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vc | medium | 4.3 | 1% |
| CVE-2024-54141 | thorsten/phpmyfaq | phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available | high | 8.6 | 0% |
| CVE-2024-7426 | peepso-core (WordPress plugin) | The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Full Path Disclosure | medium | 5.3 | 0% |
| CVE-2024-7415 | remember-me-controls (WordPress plugin) | The Remember Me Controls plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.1. This is due | medium | 5.3 | 0% |
| CVE-2026-59943 | dompdf/dompdf | Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem | medium | 0.0 | 0% |
| CVE-2024-13540 | byconsole-woo-order-delivery-time (WordPress plugin) | The WooODT Lite – Delivery & pickup date time location for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all ver | medium | 5.3 | 0% |
| CVE-2024-13539 | aforms-eats (WordPress plugin) | The AForms Eats plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.3.1. This is due the /ven | medium | 5.3 | 0% |
| CVE-2024-6544 | custom-post-limits (WordPress plugin) | The Custom Post Limits plugin for WordPress is vulnerable to full path disclosure in all versions up to, and including, 4.4.1. This is due t | medium | 5.3 | 0% |
| CVE-2023-47639 | api-platform/core | API Platform Core can leak exceptions message that may contain sensitive information | medium | 5.3 | 0% |
| CVE-2026-55375 | jleehr/canto-saas-api | canto-saas-api: OAuth credentials exposed in URL query string and exception messages | medium | 5.3 | 0% |
| CVE-2024-48896 | moodle/moodle | Moodle leaks user names | medium | 4.3 | 0% |
| CVE-2024-13537 | c9-blocks (WordPress plugin) | The C9 Blocks plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.7.7. This is due the plugin | medium | 5.3 | 0% |
| CVE-2024-6551 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and | medium | 5.3 | 0% |
| CVE-2026-42552 | flightphp/core | Flight vulnerable to sensitive information disclosure via default error handler | high | 7.5 | 0% |
| CVE-2026-43873 | wwbn/avideo | AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configure | high | 7.5 | 0% |
| CVE-2025-59016 | typo3/cms-core | TYPO3 CMS exposes sensitive information in an error message | medium | 0.0 | 0% |
| GHSA-m2hh-2m46-x6j5 | silverstripe/framework | silverstripe/framework may disclose database credentials during connection failure | medium | 6.5 | – |
| GHSA-f5pp-pmq8-gp46 | passbolt/passbolt_api | Passbolt Api Retrieval of HTTP-only cookies | low | 3.7 | – |
| GHSA-9vxv-wpv4-f52p | shopware/shopware | Information leakage in Error Handler | medium | 0.0 | – |
| GHSA-q3x8-6898-23g3 | ibexa/user | ibexa/user login enumerates user accounts | medium | 0.0 | – |