Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2007-6013 | WordPress core | Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication | critical | 9.8 | 3% |
| CVE-2022-0377 | learnpress (WordPress plugin) | Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. After this process th | medium | 4.3 | 3% |
| CVE-2020-15098 | typo3/cms, typo3/cms-core | Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS | high | 8.8 | 2% |
| CVE-2025-2539 | file-away (WordPress plugin) | The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() function in | high | 7.5 | 2% |
| CVE-2016-5431 | gree/jose | PHP JOSE Library by Gree Inc. Uses a Broken or Risky Cryptographic Algorithm | high | 7.5 | 1% |
| CVE-2022-31158 | packbackbooks/lti-1-3-php-library | LTI 1.3 Tool Library's Nonce Claim Value not validated against nonce value sent in Authentication Request before v5.0 | high | 7.5 | 1% |
| CVE-2016-6485 | magento/community-edition, magento/project-community-edition, magento/product-community-edition | Unauthenticated crypto and weak IV in Magento\Framework\Encryption | high | 7.5 | 1% |
| CVE-2021-43808 | illuminate/view, laravel/framework | Laravel Framework XSS in Blade templating engine | medium | 6.1 | 1% |
| CVE-2019-7858 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Cryptographic Flaw | high | 7.5 | 1% |
| CVE-2020-15128 | october/rain | Reliance on Cookies without validation in OctoberCMS | medium | 6.1 | 1% |
| CVE-2021-27913 | mautic/core | Use of a Broken or Risky Cryptographic Algorithm | low | 3.5 | 0% |
| CVE-2022-31157 | packbackbooks/lti-1-3-php-library | LTI 1.3 Tool Library's function used to generate random nonces not sufficiently cryptographically complex before v5.0 | high | 7.5 | 0% |
| CVE-2024-51478 | yeswiki/yeswiki | YesWiki Uses a Broken or Risky Cryptographic Algorithm | critical | 9.9 | 0% |
| CVE-2024-34914 | php-censor/php-censor | PHP Censor uses a weak hashing algorithm for the remember me key | medium | 6.5 | 0% |
| CVE-2026-33512 | wwbn/avideo | AVideo has an unauthenticated decrypt oracle leaking any ciphertext | high | 7.5 | 0% |
| CVE-2026-45701 | sulu/sulu | Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens | medium | 0.0 | 0% |
| CVE-2025-14761 | aws/aws-sdk-php | AWS SDK for PHP's S3 Encryption Client has a Key Commitment Issue | medium | 5.3 | 0% |
| GHSA-87mp-xc4x-x8rh | asymmetricrypt/asymmetricrypt | asymmetricrypt/asymmetricrypt Padding Oracle Vulnerability in RSA Encryption | medium | 0.0 | – |
| GHSA-9gxv-x7rp-r2hc | gree/jose | gree/jose - "None" Algorithm treated as valid in tokens | critical | 0.0 | – |
| GHSA-fgrx-4637-fcf5 | fuel/core | fuel/core Crypt encryption compromised. | medium | 0.0 | – |