Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-39341 | optinmonster (WordPress plugin) | The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient aut | high | 8.2 | 22% |
| CVE-2022-21829 | concrete5/core | Code injection in concrete CMS | high | 8.0 | 2% |
| CVE-2017-6370 | typo3/cms | TYPO3 Information Disclosure Vulnerability | medium | 5.3 | 1% |
| CVE-2022-2083 | simple-sign-on (WordPress plugin) | The Simple Single Sign On WordPress plugin through 4.1.0 leaks its OAuth client_secret, which could be used by attackers to gain unauthorize | high | 7.5 | 1% |
| CVE-2021-39342 | credova-financial (WordPress plugin) | The Credova_Financial WordPress plugin discloses a site's associated Credova API account username and password in plaintext via an AJAX acti | medium | 5.3 | 1% |
| CVE-2022-31046 | typo3/cms, typo3/cms-core | Information Disclosure via Export Module | medium | 4.3 | 1% |
| CVE-2022-3206 | passster (WordPress plugin) | The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encoding method which is ea | medium | 5.9 | 1% |
| CVE-2022-43691 | concrete5/concrete5 | Concrete CMS vulnerable to Cleartext Transmission of Sensitive Information | medium | 5.3 | 0% |
| CVE-2022-4409 | thorsten/phpmyfaq | phpMyFAQ has insecure HTTP cookies | high | 7.5 | 0% |
| CVE-2024-43432 | moodle/moodle | Moodle authorization headers preserved between "emulated redirects" | medium | 5.3 | 0% |
| CVE-2024-7713 | chatgpt-assistant (WordPress plugin) | The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 discloses the Open AI API Key, allowing unauthenticat | high | 7.5 | 0% |
| CVE-2026-55568 | guzzlehttp/guzzle | guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext | medium | 5.9 | 0% |