Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-32708 | league/flysystem | Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem | critical | 9.8 | 3% |
| CVE-2022-3590 | WordPress core | WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation ch | medium | 5.9 | 3% |
| CVE-2018-19370 | wordpress-seo (WordPress plugin) | A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 | medium | 6.6 | 3% |
| CVE-2024-7627 | file-manager (WordPress plugin) | The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via the 'checkSyntax' function. Th | high | 8.1 | 3% |
| CVE-2022-24800 | october/system | October CMS upload process vulnerable to RCE via Race Condition | high | 8.1 | 1% |
| CVE-2021-24377 | autoptimize (WordPress plugin) | The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Impo | high | 8.1 | 1% |
| CVE-2025-4799 | wp-downloadmanager (WordPress plugin) | The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file deletion due to lack of restriction on the directory a file can | high | 7.2 | 1% |
| CVE-2024-45291 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled | medium | 6.3 | 1% |
| CVE-2019-8232 | magento/community-edition | Magento 2 Community Edition RCE Vulnerability | medium | 6.6 | 1% |
| CVE-2025-6381 | vidmov (WordPress plugin) | The BeeTeam368 Extensions plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.4 via the hand | high | 8.8 | 1% |
| CVE-2025-5927 | everest-forms (WordPress plugin) | The Everest Forms (Pro) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete | high | 7.5 | 1% |
| CVE-2024-45290 | phpoffice/phpexcel, phpoffice/phpspreadsheet | PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file | high | 7.7 | 1% |
| CVE-2022-0279 | anycomment (WordPress plugin) | The AnyComment WordPress plugin before 0.2.18 is affected by a race condition when liking/disliking a comment/reply, which could allow any a | low | 3.1 | 0% |
| CVE-2026-27127 | craftcms/cms | Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding | high | 0.0 | 0% |
| CVE-2022-36422 | wp-postratings (WordPress plugin) | Rating increase/decrease via race condition in Lester 'GaMerZ' Chan WP-PostRatings plugin <= 1.89 at WordPress. | medium | 4.3 | 0% |
| CVE-2022-40310 | rate-my-post (WordPress plugin) | Authenticated (subscriber+) Race Condition vulnerability in Rate my Post – WP Rating System plugin <= 3.3.4 at WordPress allows attackers to | medium | 4.3 | 0% |
| CVE-2022-48366 | ezsystems/ezplatform-kernel, ezsystems/ezpublish-kernel | Timing attack in eZ Platform Ibexa | low | 3.7 | 0% |
| CVE-2023-46725 | foodcoopshop/foodcoopshop | FoodCoopShop Server-Side Request Forgery vulnerability | high | 8.1 | 0% |
| CVE-2022-40130 | wp-polls (WordPress plugin) | Auth. (subscriber+) Race Condition vulnerability in WP-Polls plugin <= 2.76.0 on WordPress. | medium | 4.3 | 0% |
| CVE-2023-4642 | kk-star-ratings (WordPress plugin) | The kk Star Ratings WordPress plugin before 5.4.6 does not implement atomic operations, allowing one user vote multiple times on a poll due | medium | 5.9 | 0% |
| CVE-2024-45120 | magento/community-edition | Magento Open Source Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability | medium | 4.3 | 0% |
| CVE-2023-37867 | yet-another-stars-rating (WordPress plugin) | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in YetAnotherStarsRating.Com YASR – Yet Another Star Rating Plugin for WordP | low | 3.7 | 0% |
| CVE-2025-49558 | magento/community-edition, magento/project-community-edition | Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability | medium | 5.9 | 0% |
| CVE-2025-24430 | magento/community-edition, magento/project-community-edition | Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability | low | 3.7 | 0% |
| CVE-2025-24432 | magento/community-edition, magento/project-community-edition | Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability | low | 3.7 | 0% |
| CVE-2025-7954 | shopware/platform | Shopware race condition bypasses voucher restrictions | medium | 0.0 | 0% |
| CVE-2023-6109 | yop-poll (WordPress plugin) | The YOP Poll plugin for WordPress is vulnerable to a race condition in all versions up to, and including, 6.5.26. This is due to improper re | medium | 5.3 | 0% |
| CVE-2023-2010 | forminator (WordPress plugin) | The Forminator WordPress plugin before 1.24.1 does not use an atomic operation to check whether a user has already voted, and then update th | low | 3.1 | 0% |
| CVE-2026-71537 | paymenter/paymenter | Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade) | medium | 6.5 | 0% |
| CVE-2026-48505 | filament/filament | Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission | high | 7.4 | 0% |
| CVE-2025-69198 | pterodactyl/panel | Pterodactyl improperly locks resources allowing raced queries to create more resources than alloted | medium | 6.5 | 0% |
| CVE-2026-47741 | shopper/cart | shopper/framework: Race condition on Discount.usage_limit allows silent over-redemption | medium | 5.9 | 0% |
| CVE-2026-34368 | wwbn/avideo | AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance | medium | 5.3 | 0% |
| CVE-2026-54242 | statamic/cms | Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding) | medium | 4.9 | 0% |
| CVE-2026-55219 | paymenter/paymenter | Paymenter has race condition in payWithCredit() that enables credit double-spend | medium | 5.3 | 0% |
| CVE-2026-35202 | pterodactyl/panel | Pterodactyl has a database resource limit bypass via race condition in Client API | low | 0.0 | 0% |
| CVE-2026-27128 | craftcms/cms | Craft CMS Race condition in Token Service potentially allows for token usage greater than the token limit | medium | 0.0 | 0% |
| CVE-2026-31824 | sylius/sylius | Sylius has a Promotion Usage Limit Bypass via Race Condition | high | 8.2 | 0% |
| CVE-2026-49262 | aimeos/pagible | Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy | low | 3.0 | 0% |
| CVE-2026-45619 | wwbn/avideo | AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD p | medium | 6.5 | 0% |
| GHSA-g7m4-839x-ch6v | spomky-labs/otphp | spomky-labs/otphp: Unbounded digits parameter in a provisioning URI triggers an uncaught DivisionByZeroError in OTP generation | high | 0.0 | – |