Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2017-5493 | WordPress core | wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, whic | high | 7.5 | 3% |
| CVE-2015-9435 | oauth2-provider (WordPress plugin) | The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers. | critical | 9.8 | 2% |
| CVE-2021-3692 | yiisoft/yii2-dev | Use of Cryptographically Weak Pseudo-Random Number Generator in yiisoft/yii2-dev | medium | 5.3 | 2% |
| CVE-2022-0828 | download-manager (WordPress plugin) | The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a download, allowing an atta | high | 7.5 | 2% |
| CVE-2019-7860 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Weak PRNG | high | 7.5 | 1% |
| CVE-2021-3678 | showdoc/showdoc | Use of Cryptographically Weak Pseudo-Random Number Generator in showdoc | medium | 5.9 | 1% |
| CVE-2019-7855 | magento/community-edition, magento/product-community-edition | Magento 2 Community Cryptographic Flaw | medium | 5.3 | 1% |
| CVE-2019-8113 | magento/community-edition, magento/product-community-edition | Magento 2 Community Weak PRNG | medium | 5.3 | 1% |
| CVE-2021-3990 | showdoc/showdoc | showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | medium | 6.5 | 1% |
| CVE-2024-7315 | migration\,-backup\,-staging (WordPress plugin) | The Migration, Backup, Staging WordPress plugin before 0.9.106 does not use sufficient randomness in the filename that is created when gene | high | 7.5 | 1% |
| CVE-2025-21617 | guzzlehttp/oauth-subscriber | Guzzle OAuth Subscriber has insufficient nonce entropy | medium | 0.0 | 0% |
| CVE-2026-42155 | openmage/magento-lts | Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs | critical | 0.0 | 0% |
| GHSA-q8fc-v85f-78pw | stormpath/sdk | stormpath/sdk uses Insecure Random Number Generator | medium | 5.3 | – |