Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-32708 | league/flysystem | Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem | critical | 9.8 | 3% |
| CVE-2022-3590 | WordPress core | WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation ch | medium | 5.9 | 3% |
| CVE-2026-27127 | craftcms/cms | Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding | high | 0.0 | 0% |
| CVE-2023-46725 | foodcoopshop/foodcoopshop | FoodCoopShop Server-Side Request Forgery vulnerability | high | 8.1 | 0% |
| CVE-2024-45120 | magento/community-edition | Magento Open Source Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability | medium | 4.3 | 0% |
| CVE-2023-37867 | yet-another-stars-rating (WordPress plugin) | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in YetAnotherStarsRating.Com YASR – Yet Another Star Rating Plugin for WordP | low | 3.7 | 0% |
| CVE-2025-49558 | magento/community-edition, magento/project-community-edition | Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability | medium | 5.9 | 0% |
| CVE-2025-24430 | magento/community-edition, magento/project-community-edition | Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability | low | 3.7 | 0% |
| CVE-2025-24432 | magento/community-edition, magento/project-community-edition | Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability | low | 3.7 | 0% |
| CVE-2026-54242 | statamic/cms | Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding) | medium | 4.9 | 0% |
| CVE-2026-35202 | pterodactyl/panel | Pterodactyl has a database resource limit bypass via race condition in Client API | low | 0.0 | 0% |
| CVE-2026-27128 | craftcms/cms | Craft CMS Race condition in Token Service potentially allows for token usage greater than the token limit | medium | 0.0 | 0% |
| CVE-2026-31824 | sylius/sylius | Sylius has a Promotion Usage Limit Bypass via Race Condition | high | 8.2 | 0% |
| CVE-2026-49262 | aimeos/pagible | Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy | low | 3.0 | 0% |
| CVE-2026-45619 | wwbn/avideo | AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD p | medium | 6.5 | 0% |