Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24501 | workreap (WordPress plugin) | The Workreap WordPress theme before 2.2.2 had several AJAX actions missing authorization checks to verify that a user was authorized to perf | high | 8.1 | 1% |
| CVE-2021-24500 | workreap (WordPress plugin) | Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct obj | high | 8.1 | 1% |
| CVE-2025-47940 | typo3/cms-core | TYPO3 Allows Privilege Escalation to System Maintainer | high | 7.2 | 0% |
| CVE-2026-26016 | pterodactyl/panel | Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization | critical | 0.0 | 0% |
| CVE-2026-29788 | miraheze/ts-portal | TSPortal: Any user can forge self-deletion requests for any account | high | 7.5 | 0% |
| CVE-2025-9822 | mautic/core | Mautic vulnerable to secret data extraction via elfinder | medium | 5.5 | 0% |