Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-34646 | woocommerce-jetpack (WordPress plugin) | Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the proces | critical | 9.8 | 51% |
| CVE-2017-17091 | WordPress core | wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from the user ID, which al | high | 8.8 | 7% |
| CVE-2021-22968 | concrete5/core | Improper file handling in concrete5/core | high | 7.2 | 3% |
| CVE-2020-7241 | wp-database-backup (WordPress plugin) | The WP Database Backup plugin through 5.5 for WordPress stores downloads by default locally in the directory wp-content/uploads/db-backup/. | high | 7.5 | 2% |
| CVE-2016-5100 | froxlor/froxlor | Froxlor guessable password reset token | critical | 9.8 | 2% |
| CVE-2021-3689 | yiisoft/yii2-dev | Use of Insufficiently Random Values in yiisoft/yii2-dev | high | 7.5 | 2% |
| CVE-2021-3692 | yiisoft/yii2-dev | Use of Cryptographically Weak Pseudo-Random Number Generator in yiisoft/yii2-dev | medium | 5.3 | 2% |
| CVE-2023-41879 | openmage/magento-lts | Magento LTS's guest order "protect code" can be brute-forced too easily | high | 7.5 | 1% |
| CVE-2021-24998 | simple-jwt-login (WordPress plugin) | The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The | high | 7.5 | 1% |
| CVE-2010-3666 | typo3/cms-install | TYPO3 is vulnerable to Insecure randomness in uniqid function | medium | 5.3 | 1% |
| CVE-2019-7886 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Cryptographic Flaw | high | 7.5 | 1% |
| CVE-2024-0761 | wp-file-manager (WordPress plugin) | The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.1 due to ins | high | 8.1 | 1% |
| CVE-2021-4240 | phpservermon/phpservermon | Insufficient Entropy in PHPServerMon PRNG | medium | 5.3 | 1% |
| CVE-2021-4241 | phpservermon/phpservermon | PHPServerMon PRNG has Insufficient Entropy | medium | 5.3 | 1% |
| CVE-2021-28055 | centreon/centreon | Predictable CSRF tokens in centreon/centreon | medium | 6.5 | 1% |
| CVE-2023-6799 | wp-reset (WordPress plugin) | The WP Reset – Most Advanced WordPress Reset Tool plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to | medium | 5.9 | 1% |
| CVE-2022-31157 | packbackbooks/lti-1-3-php-library | LTI 1.3 Tool Library's function used to generate random nonces not sufficiently cryptographically complex before v5.0 | high | 7.5 | 0% |
| CVE-2024-5149 | buddyforms (WordPress plugin) | The BuddyForms plugin for WordPress is vulnerable to Email Verification Bypass in all versions up to, and including, 2.8.9 via the use of an | medium | 6.5 | 0% |
| CVE-2026-42155 | openmage/magento-lts | Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs | critical | 0.0 | 0% |
| CVE-2024-5868 | woocommerce-social-login (WordPress plugin) | The WooCommerce - Social Login plugin for WordPress is vulnerable to Email Verification in all versions up to, and including, 2.6.2 via the | medium | 6.5 | 0% |
| GHSA-xg9w-r469-m455 | zendframework/zendframework | ZendFramework Potential Information Disclosure and Insufficient Entropy vulnerabilities | high | 7.4 | – |
| GHSA-gq4g-fpc9-vjfq | web-auth/webauthn-lib | Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protectio | low | 0.0 | – |