Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-15094 | symfony/http-kernel, symfony/symfony | RCE in Symfony | high | 8.0 | 3% |
| CVE-2022-31042 | guzzlehttp/guzzle, drupal/core | Failure to strip the Cookie header on change in host or HTTP downgrade | high | 7.5 | 2% |
| CVE-2022-31090 | guzzlehttp/guzzle | Authorization header leaked to a different origin on cross-origin redirect (curl handler) | high | 7.7 | 2% |
| CVE-2022-2818 | cockpit-hq/cockpit | Cockpit Content Platform vulnerable to 2FA bypass | high | 8.8 | 2% |
| CVE-2026-67354 | guzzlehttp/guzzle | Guzzle: URI fragments disclosed in redirect Referer headers | medium | 5.9 | 0% |
| CVE-2025-57757 | contao/contao, contao/core-bundle | Contao can disclose sensitive information in the news module | medium | 5.3 | 0% |
| CVE-2026-27892 | facturascripts/facturascripts | FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download | medium | 6.5 | 0% |
| GHSA-27c9-vp3w-6ww8 | shopware/core, shopware/platform | Shopware exposes sensitive user information via CSV export mapping | medium | 4.9 | – |