PHP vulnerability advisories

Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.

19,303CVEs

8,638Composer advisories

12,328WordPress advisories

35Actively exploited (KEV) →

CVE	Package	Title	Severity	CVSS	EPSS
CVE-2026-84308	phpseclib/phpseclib	phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery	medium	6.3	0%
GHSA-5739-39v2-5754	web-token/jwt-framework, web-token/jwt-library	RSA1_5 (RSAES-PKCS1-v1_5) decryption lacks implicit rejection, exposing a Bleichenbacher/Marvin padding oracle	medium	0.0	–

Severity and CVSS come from the upstream advisory (OSV.dev, NVD, FriendsOfPHP); KEV marks CVEs on CISA's Known Exploited Vulnerabilities list; EPSS is FIRST's 30-day exploitation probability. Rows sort exploitation-first: KEV, then EPSS, then CVSS.