Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2018-19784 | athlon1600/php-proxy | Weak Cryptography in PHP-Proxy | high | 7.5 | 1% |
| CVE-2012-6707 | WordPress core | WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values | high | 7.5 | 1% |
| CVE-2017-7888 | dolibarr/dolibarr | Dolibarr ERP and CRM Insecure Encryption | critical | 9.8 | 1% |
| CVE-2022-24784 | statamic/cms | Discoverability of user password hash in Statamic CMS | low | 3.7 | 1% |
| CVE-2010-3670 | typo3/cms-frontend | TYPO3 is vulnerable to insecure randomness during hash generation in forgot password function | medium | 4.8 | 1% |
| CVE-2017-12871 | simplesamlphp/simplesamlphp | SimpleSAMLphp Incorrect IV generation for encryption | medium | 5.9 | 0% |
| CVE-2022-4036 | appointment-hour-booking (WordPress plugin) | The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.3.72. This is due to t | medium | 5.3 | 0% |
| CVE-2021-3680 | showdoc/showdoc | Inadequate Encryption Strength in showdoc | medium | 4.9 | 0% |
| CVE-2026-33488 | wwbn/avideo | AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin | high | 7.4 | 0% |
| CVE-2026-33512 | wwbn/avideo | AVideo has an unauthenticated decrypt oracle leaking any ciphertext | high | 7.5 | 0% |
| CVE-2024-38277 | moodle/moodle | Moodle uses the same key for QR login and auto-login | medium | 6.5 | 0% |
| CVE-2025-45769 | firebase/php-jwt | php-jwt contains weak encryption | medium | 6.5 | 0% |