Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-29504 | wp-cli/wp-cli | Improper Certificate Validation in WP-CLI framework | critical | 9.1 | 1% |
| CVE-2021-30130 | phpseclib/phpseclib | Improper Certificate Validation in phpseclib | high | 7.5 | 1% |
| CVE-2019-20455 | globalpayments/php-sdk | Improper Certificate Validation in Heartland & Global Payments PHP SDK | medium | 5.9 | 1% |
| CVE-2024-56521 | tecnickcom/tcpdf | TCPDF missing certificate validation | high | 0.0 | 1% |
| CVE-2026-49283 | simplesamlphp/saml2, simplesamlphp/saml2-legacy | SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass | high | 8.7 | 0% |
| GHSA-gcfg-hmwx-wq5h | nategood/httpful | Httpful is Missing Certificate Validation | high | 7.4 | – |
| GHSA-6v6p-g8cg-2hgg | ezsystems/ezplatform-admin-ui | Improper Certificate Validation in node-sass affects eZ Platform | medium | 5.3 | – |