Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2018-8947 | rap2hpoutre/laravel-log-viewer | Plaintext Storage of Sensitive Information in Laravel Log Viewer before v0.13.0 | high | 7.5 | 11% |
| CVE-2017-14990 | WordPress core | WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), | medium | 6.5 | 2% |
| CVE-2019-17106 | centreon/centreon | Centreon Sensitive Data Exposure | medium | 6.5 | 1% |
| CVE-2021-21339 | typo3/cms, typo3/cms-core | Cleartext storage of session identifier | medium | 5.9 | 1% |
| CVE-2023-5359 | w3-total-cache (WordPress plugin) | The W3 Total Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.5 via Google O | low | 3.7 | 1% |
| CVE-2019-8118 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Weak Cryptography | medium | 5.3 | 1% |
| CVE-2022-36101 | shopware/shopware | Shopware contains sensitive data in backend customer module | medium | 5.4 | 1% |
| CVE-2020-26228 | typo3/cms, typo3/cms-core | Cleartext storage of session identifier | high | 8.1 | 1% |
| CVE-2023-6250 | like-\&-share (WordPress plugin) | The BestWebSoft's Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthenticated users via a | high | 7.5 | 0% |
| CVE-2024-43429 | moodle/moodle | Moodle has user information visibility control issues in gradebook reports | medium | 5.3 | 0% |
| CVE-2023-48707 | codeigniter4/shield | Cleartext Storage of Sensitive Information in HMAC SHA256 Authentication | medium | 5.0 | 0% |
| CVE-2026-33512 | wwbn/avideo | AVideo has an unauthenticated decrypt oracle leaking any ciphertext | high | 7.5 | 0% |
| CVE-2026-55885 | getgrav/grav | Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets | medium | 6.8 | 0% |
| CVE-2026-6553 | typo3/cms-backend | TYPO3 CMS Stores Cleartext Password in User Settings Module | high | 7.5 | 0% |
| CVE-2026-33867 | wwbn/avideo | AVideo has Plaintext Video Password Storage | critical | 0.0 | 0% |
| CVE-2024-36119 | statamic/cms | Password confirmation stored in plain text via registration form in statamic/cms | low | 1.8 | 0% |
| CVE-2024-47056 | mautic/core | Mautic does not shield .env files from web traffic | medium | 5.1 | 0% |