Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2009-5054 | smarty/smarty | Smarty Does Not Consider Umask Values When Setting Permissions | medium | 0.0 | 2% |
| CVE-2020-36070 | tcg/voyager | Remote code execution in Voyager | critical | 9.8 | 1% |
| CVE-2022-36102 | shopware/shopware | Shopware access control list bypassed via crafted specific URLs | medium | 6.3 | 1% |
| CVE-2022-48367 | ezsystems/ezpublish-kernel | Object state limitation has no effect | critical | 9.8 | 1% |
| CVE-2026-44832 | snipe/snipe-it | Snipe-IT has Privilege Escalation via API Permissions Assignment | high | 8.8 | 0% |
| GHSA-gvj8-4cj4-h776 | ibexa/core | Object state limitation has no effect | critical | 0.0 | – |
| GHSA-w8qp-hmh5-4v9v | ezsystems/ezplatform-kernel | Object state limitation has no effect | critical | 0.0 | – |