Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-7995 | dolibarr/dolibarr | Dolibarr Improper Restriction of Excessive Authentication Attempts | critical | 9.8 | 5% |
| CVE-2020-35590 | limit-login-attempts-reloaded (WordPress plugin) | LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limi | critical | 9.8 | 4% |
| CVE-2020-25827 | mediawiki/core | OATHAuth extension in MediaWiki is not implementing rate limit | high | 7.5 | 2% |
| CVE-2019-18985 | pimcore/pimcore | Pimcore 2FA Vulnerable to Brute Forcing | critical | 9.8 | 1% |
| CVE-2019-18986 | pimcore/pimcore | Pimcore Discloses Usernames In Use | high | 7.5 | 1% |
| CVE-2023-3173 | froxlor/froxlor | Froxlor vulnerable to Improper Restriction of Excessive Authentication Attempts | critical | 9.8 | 1% |
| CVE-2023-35039 | password-reset-with-code-for-wordpress-rest-api (WordPress plugin) | Improper Restriction of Excessive Authentication Attempts vulnerability in Be Devious Web Development Password Reset with Code for WordPress | critical | 9.8 | 1% |
| CVE-2025-52392 | soosyze/soosyze | Soosyze CMS's /user/login endpoint missing rate-limiting and lockout mechanisms | medium | 5.4 | 1% |
| CVE-2023-6272 | 2fa (WordPress plugin) | The Theme My Login 2FA WordPress plugin before 1.2 does not rate limit 2FA validation attempts, which may allow an attacker to brute-force a | critical | 9.8 | 1% |
| CVE-2024-39398 | magento/community-edition, magento/project-community-edition | Magento does not properly restrict excessive authentication attempts | high | 7.4 | 1% |
| CVE-2024-57602 | alextselegidis/easyappointments | Easy!Appointments Improper Restriction of Excessive Authentication Attempts | critical | 9.8 | 1% |
| CVE-2023-2531 | azuracast/azuracast | AzuraCast missing brute force prevention | critical | 9.8 | 1% |
| CVE-2021-3663 | grumpydictator/firefly-iii | No Restriction of Excessive Authentication Attempts in Firefly III | medium | 5.3 | 1% |
| CVE-2023-49810 | wwbn/avideo | WWBN AVideo Improper Restriction of Excessive Authentication Attempts vulnerability | high | 7.3 | 1% |
| CVE-2023-46745 | librenms/librenms | LibreNMS vulnerable to rate limiting bypass on login page | medium | 5.3 | 1% |
| CVE-2026-55795 | craftcms/commerce | Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass | medium | 0.0 | 1% |
| CVE-2023-34001 | hide-my-wp-ghost (WordPress plugin) | Improper Restriction of Excessive Authentication Attempts vulnerability in WPPlugins – WordPress Security Plugins Hide My WP Ghost allows Fu | medium | 5.3 | 0% |
| CVE-2025-67853 | moodle/moodle | Moodle Affected by Improper Restriction of Excessive Authentication Attempts | high | 7.5 | 0% |
| CVE-2026-45010 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id | critical | 9.1 | 0% |
| CVE-2022-39314 | getkirby/cms | Kirby CMS vulnerable to user enumeration in the code-based login and password reset forms | medium | 4.8 | 0% |
| CVE-2026-35675 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration | high | 8.2 | 0% |
| CVE-2025-62399 | moodle/moodle | Moodle vulnerable to brute-force password guesses | high | 7.5 | 0% |
| CVE-2026-33763 | wwbn/avideo | AVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean Oracle | medium | 5.3 | 0% |
| CVE-2025-10928 | drupal/access_code | This module enables users to sign in with an access code instead of entering user names and passwords. When users are al | medium | 6.3 | 0% |
| GHSA-8v6m-7f5v-hhx6 | silverstripe/framework | Silverstripe Brute force bypass on default admin | critical | 9.1 | – |
| GHSA-cg84-55jx-4237 | ezsystems/ezplatform-admin-ui | eZ Platform Password reset vulnerability | high | 0.0 | – |
| GHSA-hfpp-2vhw-qq43 | ezsystems/ezplatform-user | eZ Platform Admin UI Password reset vulnerability | high | 0.0 | – |