Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-3465 | robrichards/xmlseclibs | Signature validation bypass in XmlSecLibs | high | 8.8 | 3% |
| CVE-2018-5387 | gogentooss/samlbase | Wizkunde SAMLBase SAML Bypass | high | 7.5 | 2% |
| CVE-2026-47212 | symfony/symfony, symfony/twilio-notifier | Symfony: Twilio SMS Notifier allows unauthenticated webhook injection due to missing X-Twilio-Signature verification | medium | 0.0 | 2% |
| CVE-2018-7644 | simplesamlphp/saml2 | SimpleSAMLphp Improper Verification of Cryptographic Signature | high | 7.5 | 1% |
| CVE-2018-7711 | simplesamlphp/saml2 | SimpleSAMLphp saml2 incorrect signature validation | high | 8.1 | 1% |
| CVE-2017-18122 | simplesamlphp/simplesamlphp | SimpleSAMLphp Signature validation bypass | high | 8.1 | 1% |
| CVE-2021-30130 | phpseclib/phpseclib | Improper Certificate Validation in phpseclib | high | 7.5 | 1% |
| CVE-2021-46743 | firebase/php-jwt | Firebase PHP-JWT key/algorithm type confusion | critical | 9.1 | 1% |
| CVE-2022-23655 | october/system | Missing server signature validation in OctoberCMS | medium | 4.8 | 1% |
| CVE-2023-50714 | yiisoft/yii2-authclient | yiisoft/yii2-authclient's Oauth2 PKCE implementation is vulnerable | medium | 6.8 | 0% |
| CVE-2024-34358 | typo3/cms-core | TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController | medium | 5.3 | 0% |
| CVE-2025-68113 | altcha-org/altcha | ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay | medium | 6.5 | 0% |
| CVE-2021-3680 | showdoc/showdoc | Inadequate Encryption Strength in showdoc | medium | 4.9 | 0% |
| CVE-2025-27773 | simplesamlphp/saml2, simplesamlphp/saml2-legacy | The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding | high | 8.6 | 0% |
| CVE-2026-52767 | yeswiki/yeswiki | YesWiki Vulnerable to Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)` | high | 8.2 | 0% |
| CVE-2024-50347 | laravel/reverb | Laravel Reverb Missing API Signature Verification | high | 0.0 | 0% |
| CVE-2026-45755 | symfony/mailtrap-mailer, symfony/symfony | Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection | medium | 0.0 | 0% |
| CVE-2026-48747 | symfony/mailomat-mailer, symfony/symfony | Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade | medium | 0.0 | 0% |
| CVE-2026-41669 | admidio/admidio | Admidio Ignores SAML Signature Validation Result, Processes Forged AuthnRequests and LogoutRequests | high | 8.2 | 0% |
| CVE-2026-54736 | phalcon/cphalcon | Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel) | high | 0.0 | 0% |
| GHSA-q3jm-v27q-jfww | titon/framework | titon/framework vulnerable to Remote Code Execution via Chosen-Ciphertext Attack | critical | 9.8 | – |
| GHSA-6vvh-pxr4-25r7 | web-token/jwt-experimental, web-token/jwt-framework, web-token/jwt-library | PHP JWT Framework: Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on decry | medium | 0.0 | – |
| GHSA-9gxv-x7rp-r2hc | gree/jose | gree/jose - "None" Algorithm treated as valid in tokens | critical | 0.0 | – |