Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-25838 | laravel/fortify | Multi-Factor Authentication issue in Laravel Fortify | high | 8.1 | 1% |
| CVE-2023-1886 | thorsten/phpmyfaq | thorsten/phpmyfaq vulnerable to authentication bypass | high | 7.3 | 1% |
| CVE-2022-31158 | packbackbooks/lti-1-3-php-library | LTI 1.3 Tool Library's Nonce Claim Value not validated against nonce value sent in Authentication Request before v5.0 | high | 7.5 | 1% |
| CVE-2026-84306 | filament/filament | Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used | medium | 6.5 | 0% |
| CVE-2026-72780 | craftcms/cms | Craft CMS: Passkey login accepts replayed WebAuthn assertions | critical | 0.0 | 0% |