Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-17228 | motors-car-dealership-classified-listings (WordPress plugin) | includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for Wo | medium | 6.5 | 1% |
| CVE-2016-9450 | drupal/core, drupal/drupal | Drupal Incorrect cache context on password reset page | high | 7.5 | 1% |
| CVE-2019-8124 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Insufficient Logging | medium | 4.9 | 1% |
| CVE-2015-8371 | composer/composer | Composer allows cache poisoning from other projects built on the same host | high | 8.8 | 1% |
| CVE-2022-4539 | web-application-firewall (WordPress plugin) | The Web Application Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1.2. This is due | medium | 5.3 | 1% |
| CVE-2019-8112 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition Security Bypass | high | 7.5 | 1% |
| CVE-2023-3325 | cms-commander-client (WordPress plugin) | The CMS Commander plugin for WordPress is vulnerable to authorization bypass due to the use of an insufficiently unique cryptographic signat | high | 8.1 | 1% |
| CVE-2023-2987 | wordapp (WordPress plugin) | The Wordapp plugin for WordPress is vulnerable to authorization bypass due to an use of insufficiently unique cryptographic signature on the | critical | 9.8 | 1% |
| CVE-2021-24825 | custom-content-shortcode (WordPress plugin) | The Custom Content Shortcode WordPress plugin before 4.0.2 does not validate the data passed to its load shortcode, which could allow Contri | medium | 4.3 | 0% |
| CVE-2022-23556 | codeigniter4/framework | CodeIgniter4 allows spoofing of IP address when using proxy | high | 7.0 | 0% |
| CVE-2024-50347 | laravel/reverb | Laravel Reverb Missing API Signature Verification | high | 0.0 | 0% |
| CVE-2023-5548 | moodle/moodle | Moodle Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability | medium | 5.3 | 0% |
| CVE-2022-4537 | hide-my-wp (WordPress plugin) | The Hide My WP Ghost – Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.0.18. T | medium | 6.5 | 0% |
| CVE-2023-23941 | swag/paypal | Payment information sent to PayPal not necessarily identical to created order | high | 7.5 | 0% |
| CVE-2023-2897 | brizy (WordPress plugin) | The Brizy Page Builder plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.4.18. This is due to an | low | 3.7 | 0% |
| CVE-2026-92161 | fof/oauth | FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider | critical | 9.8 | 0% |
| CVE-2024-1321 | eventprime-event-calendar-management (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to payment bypass in all versions up to, and inclu | medium | 5.3 | 0% |
| CVE-2026-45069 | symfony/security-http, symfony/symfony | Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims | medium | 0.0 | 0% |
| CVE-2026-1195 | mineadmin/mineadmin | MineAdmin improperly refreshes tokens | medium | 5.0 | 0% |
| CVE-2026-49212 | symfony/ux-live-component | symfony/ux-live-component: LiveComponentHydrator HMAC checksum lacks component and slot binding | low | 0.0 | 0% |
| CVE-2026-49284 | simplesamlphp/simplesamlphp | SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking | high | 7.1 | 0% |
| CVE-2022-4533 | limit-login-attempts-plus (WordPress plugin) | The Limit Login Attempts Plus plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.1.0. This is due | medium | 5.3 | 0% |
| CVE-2021-41106 | lcobucci/jwt | File reference keys leads to incorrect hashes on HMAC algorithms | medium | 4.4 | 0% |
| CVE-2023-49087 | simplesamlphp/saml2, simplesamlphp/xml-security | Validation of SignedInfo | high | 7.5 | 0% |
| CVE-2026-39366 | wwbn/avideo | WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php | medium | 6.5 | 0% |
| CVE-2026-33731 | wwbn/avideo | AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data | medium | 6.5 | 0% |
| CVE-2025-55155 | mantisbt/mantisbt | MantisBT lacks verification when changing a user's email address | medium | 5.4 | 0% |
| CVE-2024-43428 | moodle/moodle | Moodle vulnerable to cache poisoning via injection into storage | high | 7.7 | 0% |
| CVE-2026-42206 | roadiz/openid | OpenID Connect nonce generated but never validated — ID token replay attack | medium | 0.0 | 0% |
| CVE-2026-7689 | dolibarr/dolibarr | Dolibarr has Insufficient Verification of Data Authenticity | low | 3.7 | 0% |
| CVE-2026-47696 | wwbn/avideo | WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint | medium | 4.3 | 0% |
| GHSA-f3r2-88mq-9v4g | auth0/symfony | Auth0 Symfony SDK has Improper Audience Validation via Auth0-PHP SDK | medium | 6.8 | – |
| GHSA-jc38-x7x8-2xc8 | web-token/jwt-bundle, web-token/jwt-experimental, web-token/jwt-framework +1 more | PHP JWT Framework: JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks | high | 0.0 | – |