Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-36394 | moodle/moodle | Moodle Session Fixation vulnerability | critical | 9.8 | 7% |
| CVE-2015-8124 | symfony/security, symfony/security-http, symfony/symfony | Symfony Session Fixation Vulnerability | low | 3.1 | 3% |
| CVE-2017-12868 | simplesamlphp/simplesamlphp | SimpleSAMLphp Session fixation issue and authentication bypass in the authcrypt module | critical | 9.8 | 2% |
| CVE-2018-11385 | symfony/security, symfony/security-http, symfony/symfony +1 more | Symfony Session Fixation Vulnerability | high | 8.1 | 2% |
| CVE-2010-1613 | moodle/moodle | Moodle Session Fixation vulnerability | medium | 0.0 | 2% |
| CVE-2009-0256 | typo3/cms | Authentication library in TYPO3 vulnerable to session fixation | high | 0.0 | 2% |
| CVE-2017-12873 | simplesamlphp/simplesamlphp | Incorrect persistent NameID generation in SimpleSAMLphp | critical | 9.8 | 2% |
| CVE-2010-3671 | typo3/cms-install | TYPO3 is vulnerable to Session Fixation | medium | 6.5 | 2% |
| CVE-2018-12071 | codeigniter/framework | CodeIgniter Session Fixation Vulnerability | critical | 9.8 | 2% |
| CVE-2016-9851 | phpmyadmin/phpmyadmin | phpMyAdmin Bypass logout timeout | medium | 5.3 | 1% |
| CVE-2021-41268 | symfony/security-bundle, symfony/symfony | Cookie persistence after password changes in symfony/security-bundle | medium | 6.5 | 1% |
| CVE-2019-7849 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition Session Fixation Check | high | 7.5 | 1% |
| CVE-2020-12467 | intelliants/subrion | Session Fixation in Subrion CMS | medium | 6.5 | 1% |
| CVE-2022-2997 | snipe/snipe-it | Insufficient Session Expiration in snipe/snipe-it | medium | 4.6 | 1% |
| CVE-2022-24444 | silverstripe/hybridsessions | Hybridsessions does not expire session id on logout | medium | 6.5 | 1% |
| CVE-2022-24895 | symfony/security-bundle, symfony/symfony | Symfony vulnerable to Session Fixation of CSRF tokens | medium | 6.3 | 1% |
| CVE-2022-1849 | filegator/filegator | Improper user session handling in filegator | medium | 4.3 | 1% |
| CVE-2023-46733 | symfony/security-http, symfony/symfony | Symfony possible session fixation vulnerability | medium | 6.5 | 1% |
| CVE-2023-2105 | alextselegidis/easyappointments | alextselegidis/easyappointments Session Fixation vulnerability | medium | 5.4 | 1% |
| CVE-2022-43687 | concrete5/concrete5 | Concrete CMS vulnerable to Session Fixation | medium | 5.4 | 1% |
| CVE-2022-24745 | shopware/platform, shopware/storefront | Shopware guest session is shared between customers | medium | 4.8 | 1% |
| CVE-2024-30262 | contao/core-bundle | Contao: Remember-me tokens will not be cleared after a password change | medium | 5.9 | 0% |
| CVE-2022-4231 | tribalsystems/zenario | Tribal Systems Zenario CMS vulnerable to Session Fixation | medium | 5.4 | 0% |
| CVE-2023-3192 | froxlor/froxlor | Froxlor Session Fixation vulnerability | medium | 5.4 | 0% |
| CVE-2019-12203 | silverstripe/framework | Session fixation in change password form | medium | 6.3 | 0% |
| CVE-2025-53021 | moodle/moodle | Moodle Session Fixation allows unauthenticated users to hijack sessions via sesskey parameter | medium | 4.2 | 0% |
| CVE-2026-33492 | wwbn/avideo | AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration | high | 7.3 | 0% |
| CVE-2026-69245 | guzzlehttp/guzzle | Guzzle: Noncanonical cookie domain keeps subdomain scope | medium | 6.5 | 0% |
| CVE-2026-59883 | guzzlehttp/guzzle | Guzzle: Cookie Disclosure and Injection via IP-Address Domains | medium | 4.7 | 0% |
| GHSA-4qx8-j9vh-2628 | silverstripe/framework | silverstripe/framework's User-Agent header not correctly invalidating user session | high | 7.5 | – |
| GHSA-r9vc-jfmh-6j48 | typo3/cms | TYPO3 frontend login vulnerable to Session Fixation | high | 7.1 | – |
| GHSA-62f6-h68r-3jpw | zendframework/zendframework | Zendframework session validation vulnerability | medium | 6.5 | – |
| GHSA-96c6-m98x-hxjx | zendframework/zend-session | Zend-Session session validation vulnerability | medium | 6.5 | – |
| GHSA-xmgr-jff3-fcfv | typo3/cms-core | TYPO3 Security Misconfiguration in User Session Handling | medium | 6.5 | – |
| GHSA-p62r-7637-3wwc | laravel/framework | Laravel Hijacked authentication cookies vulnerability | medium | 0.0 | – |
| GHSA-q4xf-7fw5-4x8v | illuminate/auth | Laravel Hijacked authentication cookies vulnerability | medium | 0.0 | – |