Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-38557 | billz/raspap-webgui | raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. | high | 8.8 | 2% |
| CVE-2011-4285 | moodle/moodle | Moodle Incorrect Default Settings | medium | 0.0 | 2% |
| CVE-2020-24402 | magento/community-edition, magento/project-community-edition | Magento incorrect permissions vulnerability in the Integrations component | medium | 4.9 | 2% |
| CVE-2020-9392 | pricing-table-by-supsystic (WordPress plugin) | An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. Because there is no permission check on the Imp | high | 7.3 | 2% |
| CVE-2015-9474 | simpolio (WordPress theme) | The Simpolio theme 1.3.2 for WordPress has insufficient restrictions on option updates. | high | 8.8 | 1% |
| CVE-2015-9475 | pont (WordPress theme) | The Pont theme 1.5 for WordPress has insufficient restrictions on option updates. | high | 8.8 | 1% |
| CVE-2015-9476 | teardrop (WordPress theme) | The Teardrop theme 1.8.1 for WordPress has insufficient restrictions on option updates. | high | 8.8 | 1% |
| CVE-2015-9477 | vernissage (WordPress theme) | The Vernissage theme 1.2.8 for WordPress has insufficient restrictions on option updates. | high | 8.8 | 1% |
| CVE-2012-1157 | moodle/moodle | Moodle default permissions too permissive | medium | 4.3 | 1% |
| CVE-2014-8327 | co-stack/fal_sftp, vertexvaar/falsftp | fal_sftp extension for TYPO3 uses weak permissions for sFTP driver files and folders | medium | 0.0 | 1% |
| CVE-2020-6166 | minimal-coming-soon-maintenance-mode (WordPress plugin) | A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.15, allows authenticated users with basic access to export | medium | 5.4 | 1% |
| CVE-2020-6165 | silverstripe/graphql, silverstripe/recipe-cms | Silverstripe has Incorrect Default Permissions | medium | 5.3 | 1% |
| CVE-2020-12075 | data-tables-generator (WordPress plugin) | The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks capability checks for AJAX actions. | high | 8.8 | 1% |
| CVE-2020-13667 | drupal/core, drupal/drupal | The experimental Workspaces module allows you to create multiple workspaces on your site in which draft content can be e | medium | 5.3 | 1% |
| CVE-2019-19712 | contao/contao, contao/core-bundle | Information disclosure in the Contao backend | medium | 5.3 | 1% |
| CVE-2023-1809 | download-manager (WordPress plugin) | The Download Manager WordPress plugin before 6.3.0 leaks master key information without the need for a password, allowing attackers to downl | high | 7.5 | 1% |
| CVE-2011-1762 | WordPress core | A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This | medium | 6.5 | 1% |
| CVE-2020-13240 | dolibarr/dolibarr | Dolibarr Stored Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2022-0179 | snipe/snipe-it | Incorrect Default Permissions and Improper Access Control in snipe-it | medium | 5.4 | 1% |
| CVE-2024-11088 | simple-membership (WordPress plugin) | The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.5 via t | medium | 5.3 | 1% |
| CVE-2021-36397 | moodle/moodle | Moodle has Incorrect Default Permissions | medium | 5.3 | 1% |
| CVE-2026-52766 | yeswiki/yeswiki | YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action | critical | 9.1 | 1% |
| CVE-2024-11089 | anonymous-restricted-content (WordPress plugin) | The Anonymous Restricted Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 5.3 | 1% |
| CVE-2024-9947 | profilepress (WordPress plugin) | The ProfilePress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.11.1. This is due t | high | 8.1 | 1% |
| CVE-2021-36400 | moodle/moodle | Moodle has Incorrect Default Permissions | medium | 5.3 | 1% |
| CVE-2022-25776 | mautic/core | Mautic Sensitive Data Exposure due to inadequate user permission settings | high | 8.3 | 0% |
| CVE-2024-45690 | moodle/moodle | Moodle IDOR when deleting OAuth2 linked accounts | high | 7.5 | 0% |
| CVE-2024-43430 | moodle/moodle | Moodle has insufficient access control | medium | 5.3 | 0% |