Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2018-19370 | wordpress-seo (WordPress plugin) | A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 | medium | 6.6 | 3% |
| CVE-2024-7627 | file-manager (WordPress plugin) | The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via the 'checkSyntax' function. Th | high | 8.1 | 3% |
| CVE-2022-24800 | october/system | October CMS upload process vulnerable to RCE via Race Condition | high | 8.1 | 1% |
| CVE-2021-24377 | autoptimize (WordPress plugin) | The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Impo | high | 8.1 | 1% |
| CVE-2019-8232 | magento/community-edition | Magento 2 Community Edition RCE Vulnerability | medium | 6.6 | 1% |
| CVE-2022-0279 | anycomment (WordPress plugin) | The AnyComment WordPress plugin before 0.2.18 is affected by a race condition when liking/disliking a comment/reply, which could allow any a | low | 3.1 | 0% |
| CVE-2022-36422 | wp-postratings (WordPress plugin) | Rating increase/decrease via race condition in Lester 'GaMerZ' Chan WP-PostRatings plugin <= 1.89 at WordPress. | medium | 4.3 | 0% |
| CVE-2022-40310 | rate-my-post (WordPress plugin) | Authenticated (subscriber+) Race Condition vulnerability in Rate my Post – WP Rating System plugin <= 3.3.4 at WordPress allows attackers to | medium | 4.3 | 0% |
| CVE-2022-48366 | ezsystems/ezplatform-kernel, ezsystems/ezpublish-kernel | Timing attack in eZ Platform Ibexa | low | 3.7 | 0% |
| CVE-2022-40130 | wp-polls (WordPress plugin) | Auth. (subscriber+) Race Condition vulnerability in WP-Polls plugin <= 2.76.0 on WordPress. | medium | 4.3 | 0% |
| CVE-2023-4642 | kk-star-ratings (WordPress plugin) | The kk Star Ratings WordPress plugin before 5.4.6 does not implement atomic operations, allowing one user vote multiple times on a poll due | medium | 5.9 | 0% |
| CVE-2025-7954 | shopware/platform | Shopware race condition bypasses voucher restrictions | medium | 0.0 | 0% |
| CVE-2023-6109 | yop-poll (WordPress plugin) | The YOP Poll plugin for WordPress is vulnerable to a race condition in all versions up to, and including, 6.5.26. This is due to improper re | medium | 5.3 | 0% |
| CVE-2023-2010 | forminator (WordPress plugin) | The Forminator WordPress plugin before 1.24.1 does not use an atomic operation to check whether a user has already voted, and then update th | low | 3.1 | 0% |
| CVE-2026-71537 | paymenter/paymenter | Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade) | medium | 6.5 | 0% |
| CVE-2026-48505 | filament/filament | Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission | high | 7.4 | 0% |
| CVE-2025-69198 | pterodactyl/panel | Pterodactyl improperly locks resources allowing raced queries to create more resources than alloted | medium | 6.5 | 0% |
| CVE-2026-47741 | shopper/cart | shopper/framework: Race condition on Discount.usage_limit allows silent over-redemption | medium | 5.9 | 0% |
| CVE-2026-34368 | wwbn/avideo | AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance | medium | 5.3 | 0% |
| CVE-2026-55219 | paymenter/paymenter | Paymenter has race condition in payWithCredit() that enables credit double-spend | medium | 5.3 | 0% |
| CVE-2026-31824 | sylius/sylius | Sylius has a Promotion Usage Limit Bypass via Race Condition | high | 8.2 | 0% |