Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-34646 | woocommerce-jetpack (WordPress plugin) | Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the proces | critical | 9.8 | 51% |
| CVE-2024-21518 | opencart/opencart | Zip slip in opencart | high | 7.2 | 14% |
| CVE-2022-3180 | wpgateway (WordPress plugin) | The WPGateway Plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.5. This allows unauthenticated | critical | 9.8 | 9% |
| CVE-2019-20203 | postie (WordPress plugin) | The Authorized Addresses feature in the Postie plugin 1.9.40 for WordPress allows remote attackers to publish posts by spoofing the From inf | medium | 5.3 | 2% |
| CVE-2026-55584 | phpsysinfo/phpsysinfo | phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers | high | 7.5 | 2% |
| CVE-2021-29504 | wp-cli/wp-cli | Improper Certificate Validation in WP-CLI framework | critical | 9.1 | 1% |
| CVE-2022-2368 | microweber/microweber | Microweber before 1.2.21 allows attacker to bypass IP detection to brute-force password | medium | 6.5 | 1% |
| CVE-2021-30130 | phpseclib/phpseclib | Improper Certificate Validation in phpseclib | high | 7.5 | 1% |
| CVE-2019-20455 | globalpayments/php-sdk | Improper Certificate Validation in Heartland & Global Payments PHP SDK | medium | 5.9 | 1% |
| CVE-2022-25838 | laravel/fortify | Multi-Factor Authentication issue in Laravel Fortify | high | 8.1 | 1% |
| CVE-2023-1886 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable to authentication bypass | high | 7.3 | 1% |
| CVE-2022-31158 | packbackbooks/lti-1-3-php-library | LTI 1.3 Tool Library's Nonce Claim Value not validated against nonce value sent in Authentication Request before v5.0 | high | 7.5 | 1% |
| CVE-2023-2984 | pimcore/pimcore | Pimcore vulnerable to Pre-Auth Path Traversal in pimcore_log parameter | medium | 6.3 | 1% |
| CVE-2024-56521 | tecnickcom/tcpdf | TCPDF missing certificate validation | high | 0.0 | 1% |
| CVE-2023-0316 | froxlor/froxlor | Froxlor is vulnerable to path traversal | medium | 5.5 | 1% |
| CVE-2022-4746 | fluentauth (WordPress plugin) | The FluentAuth WordPress plugin before 1.0.2 prioritizes getting a visitor's IP address from certain HTTP headers over PHP's REMOTE_ADDR, wh | high | 7.5 | 1% |
| CVE-2022-4303 | wp-limit-login-attempts (WordPress plugin) | The WP Limit Login Attempts WordPress plugin through 2.6.4 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_AD | high | 7.5 | 1% |
| CVE-2022-4550 | user-activity (WordPress plugin) | The User Activity WordPress plugin through 1.0.1 checks headers such as the X-Forwarded-For to retrieve the IP address of the request, which | high | 7.5 | 1% |
| CVE-2026-64665 | statamic/cms | Statamic: Account takeover via OAuth email matching without email-verification check | high | 8.1 | 1% |
| CVE-2026-33661 | yansongda/pay | WeChat Pay callback signature verification bypassed when Host header is localhost | high | 8.6 | 1% |
| CVE-2023-0816 | formidable-form-builder (WordPress plugin) | The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leadi | medium | 6.5 | 0% |
| CVE-2026-45074 | symfony/security-http, symfony/symfony | Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay | medium | 0.0 | 0% |
| CVE-2026-49283 | simplesamlphp/saml2, simplesamlphp/saml2-legacy | SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass | high | 8.7 | 0% |
| CVE-2026-84306 | filament/filament | Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used | medium | 6.5 | 0% |
| CVE-2026-48016 | shopware/core, shopware/platform | Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment | medium | 4.3 | 0% |
| CVE-2026-72780 | craftcms/cms | Craft CMS: Passkey login accepts replayed WebAuthn assertions | critical | 0.0 | 0% |
| CVE-2026-45063 | symfony/security-http, symfony/symfony | Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator | high | 0.0 | 0% |
| CVE-2024-13685 | admin-and-site-enhancements (WordPress plugin) | The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 retrieves client IP addresses from potentially untrusted headers, allow | medium | 5.3 | 0% |
| CVE-2026-31889 | shopware/core, shopware/platform | Shopware vulnerable to a potential take over of app credentials | high | 8.9 | 0% |
| CVE-2025-60868 | alt-design/alt-redirect | Alt Redirect: Potential Authentication Bypass by Spoofing through query-string stripping logic flaw | medium | 6.5 | 0% |
| GHSA-gcfg-hmwx-wq5h | nategood/httpful | Httpful is Missing Certificate Validation | high | 7.4 | – |
| GHSA-hx53-jchx-cr52 | symfony/symfony | Symfony2 improper IP based access control | medium | 5.9 | – |
| GHSA-6v6p-g8cg-2hgg | ezsystems/ezplatform-admin-ui | Improper Certificate Validation in node-sass affects eZ Platform | medium | 5.3 | – |