Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-8819 | cardgate/woocommerce | CardGate Payments plugin for WooCommerce does not validate request origin | high | 8.1 | 5% |
| CVE-2020-8818 | cardgate/magento2 | Origin Validation Error in Magento 2 | high | 8.1 | 4% |
| CVE-2020-11069 | typo3/cms, typo3/cms-core | Backend Same-Site Request Forgery in TYPO3 CMS | high | 8.0 | 1% |
| CVE-2020-26253 | getkirby/cms, getkirby/panel | Kirby .dev domains and some reverse proxy setups were treated as local | medium | 6.8 | 1% |
| CVE-2018-20745 | yiisoft/yii2 | Yii Incorrectly Implements CORS | medium | 5.9 | 1% |
| CVE-2026-55791 | craftcms/cms | Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs | critical | 0.0 | 0% |
| CVE-2026-19418 | typo3/cms-backend, typo3/cms-core | TYPO3 CMS - Broken Access Control in Backend and Install Tool | high | 0.0 | 0% |
| CVE-2026-55767 | guzzlehttp/guzzle | guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts | medium | 5.8 | 0% |
| CVE-2026-30964 | web-auth/webauthn-framework, web-auth/webauthn-lib, web-auth/webauthn-symfony-bundle | Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation | medium | 5.4 | 0% |
| CVE-2026-69245 | guzzlehttp/guzzle | Guzzle: Noncanonical cookie domain keeps subdomain scope | medium | 6.5 | 0% |
| CVE-2026-59883 | guzzlehttp/guzzle | Guzzle: Cookie Disclosure and Injection via IP-Address Domains | medium | 4.7 | 0% |
| CVE-2026-72702 | getgrav/grav | Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match | low | 0.0 | 0% |
| CVE-2026-41057 | wwbn/avideo | WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated API Responses | high | 7.1 | 0% |
| GHSA-hhw9-35p2-q2c5 | socialiteproviders/steam | Steam Socialite Provider v1 does not correctly validate openid server | critical | 0.0 | – |