Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-38312 | gutenberg-template-library-\&-redux-framework (WordPress plugin) | The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoi | high | 7.1 | 1% |
| CVE-2024-25108 | pixelfed/pixelfed | Pixelfed doesn't check OAuth Scopes in API routes, giving elevated permissions | critical | 9.9 | 1% |
| CVE-2024-6660 | bookingpress-appointment-booking (WordPress plugin) | The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized modif | high | 8.8 | 1% |
| CVE-2026-32639 | winter/wn-cms-module | Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads | medium | 6.8 | 0% |
| CVE-2025-67848 | moodle/moodle | Moodle authentication bypass vulnerability | high | 8.1 | 0% |
| CVE-2022-25776 | mautic/core | Mautic Sensitive Data Exposure due to inadequate user permission settings | high | 8.3 | 0% |
| CVE-2024-4468 | salon-booking-system (WordPress plugin) | The Salon booking system plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability chec | medium | 4.3 | 0% |