Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-3850 | adodb/adodb-php | Authentication Bypass in ADOdb/ADOdb | critical | 9.1 | 2% |
| CVE-2026-30849 | mantisbt/mantisbt | MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL | critical | 0.0 | 2% |
| CVE-2022-2818 | cockpit-hq/cockpit | Cockpit Content Platform vulnerable to 2FA bypass | high | 8.8 | 2% |
| CVE-2024-34077 | mantisbt/mantisbt | Mantis Bug Tracker (MantisBT) allows user account takeover in the signup/reset password process | high | 7.3 | 1% |
| CVE-2023-1307 | froxlor/froxlor | Froxlor is vulnerable to authentication bypass | critical | 9.8 | 1% |
| CVE-2023-4939 | salesmanago (WordPress plugin) | The SALESmanago plugin for WordPress is vulnerable to Log Injection in versions up to, and including, 3.2.4. This is due to the use of a wea | medium | 5.3 | 1% |
| CVE-2024-39899 | privatebin/privatebin | PrivateBin allows shortening of URLs for other domains | medium | 5.3 | 1% |
| CVE-2024-6637 | woocommerce-social-login (WordPress plugin) | The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and includi | high | 7.3 | 0% |
| CVE-2025-47776 | mantisbt/mantisbt | MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling | critical | 9.1 | 0% |