Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2018-6389 | WordPress core | In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of regist | high | 7.5 | 73% |
| CVE-2013-4701 | openid/php-openid, typo3/cms | PHP OpenID Library Denial of Service vulnerability | high | 0.0 | 3% |
| CVE-2016-5706 | phpmyadmin/phpmyadmin | phpMyAdmin Denial Of Service (DOS) attack | high | 7.5 | 3% |
| CVE-2006-6017 | WordPress core | WordPress before 2.0.5 does not properly store a profile containing a string representation of a serialized object, which allows remote auth | medium | 6.5 | 2% |
| CVE-2019-12473 | mediawiki/core | Wikimedia Potential DOS due to slow WatchedItemStore::countVisitingWatchersMultiple | high | 7.5 | 2% |
| CVE-2021-24893 | stars-rating (WordPress plugin) | The Stars Rating WordPress plugin before 3.5.1 does not validate the submitted rating, allowing submission of long integer, causing a Denial | high | 7.5 | 2% |
| CVE-2021-20185 | moodle/moodle | Moodle Client side denial of service via personal message | medium | 5.3 | 1% |
| CVE-2020-25630 | moodle/moodle | Moodle Denial of Service | high | 7.5 | 1% |
| CVE-2013-5750 | friendsofsymfony/user-bundle | FriendsOfSymfony FOSUserBundle denial of service via login form | medium | 0.0 | 1% |
| CVE-2014-5012 | dompdf/dompdf | DOMPDF denial of service vulnerability | medium | 6.5 | 1% |
| CVE-2022-33142 | bp-better-messages (WordPress plugin) | Authenticated (subscriber+) Denial Of Service (DoS) vulnerability in WordPlus WordPress Better Messages plugin <= 1.9.10.57 at WordPress. | high | 7.7 | 1% |
| CVE-2023-40180 | silverstripe/graphql | Silverstripe GraphQL has DDOS Vulnerability due to lack of protection against recursive queries | high | 7.5 | 1% |
| CVE-2021-32476 | moodle/moodle | Moodle denial-of-service risk in the draft files area | high | 7.5 | 1% |
| CVE-2024-0842 | backuply (WordPress plugin) | The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Denial of Service in all versions up to, and includi | high | 7.5 | 1% |
| CVE-2024-25978 | moodle/moodle | Uncontrolled Resource Consumption in moodle | high | 7.5 | 1% |
| CVE-2026-59942 | dompdf/dompdf | Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps | medium | 0.0 | 1% |
| CVE-2024-20716 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Uncontrolled Resource Consumption | medium | 4.9 | 1% |
| CVE-2026-49289 | simplesamlphp/saml2, simplesamlphp/saml2-legacy | SimpleSAMLphp has Possible DoS via XPath Transform | high | 7.5 | 1% |
| CVE-2023-49316 | phpseclib/phpseclib | Phpseclib needs guardrails on large binaryfield integers | high | 7.5 | 1% |
| CVE-2023-34620 | laktak/hjson | hjson stack exhaustion vulnerability | high | 7.5 | 1% |
| CVE-2023-35909 | ninja-forms (WordPress plugin) | Uncontrolled Resource Consumption vulnerability in Saturday Drive Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress le | medium | 5.3 | 1% |
| CVE-2023-38251 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Uncontrolled Resource Consumption | medium | 5.3 | 1% |
| CVE-2024-24752 | bref/bref | Bref's Uploaded Files Not Deleted in Event-Driven Functions | medium | 6.5 | 1% |
| CVE-2021-36395 | moodle/moodle | Moodle vulnerable to Uncontrolled Resource Consumption | high | 7.5 | 1% |
| CVE-2023-26044 | react/http | ReactPHP's HTTP server continues parsing unused multipart parts after reaching input field and file upload limits | medium | 5.3 | 1% |
| CVE-2024-29186 | bref/bref | Slow String Operations via MultiPart Requests in Event-Driven Functions | medium | 5.3 | 1% |
| CVE-2026-59941 | dompdf/dompdf | Dompdf: Uncontrolled resource consumption based on declared BMP dimensions | medium | 0.0 | 1% |
| CVE-2026-45756 | symfony/json-path, symfony/symfony | Symfony's JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS | low | 0.0 | 1% |
| CVE-2026-53965 | mcp/sdk | MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter | high | 0.0 | 1% |
| CVE-2026-86201 | pocketmine/pocketmine-mp | PocketMine-MP: LogDoS by large complex unknown property logging in clientData in LoginPacket | high | 7.5 | 1% |
| CVE-2024-27354 | phpseclib/phpseclib | phpseclib: guardrails needed on isPrime and randomPrime | high | 7.5 | 1% |
| CVE-2024-12601 | calculated-fields-form (WordPress plugin) | The Calculated Fields Form plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 5.2.63. This is due | medium | 5.3 | 1% |
| CVE-2024-6434 | premium-addons-for-elementor (WordPress plugin) | The Premium Addons for Elementor plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, a | low | 3.1 | 1% |
| CVE-2024-27355 | phpseclib/phpseclib | phpseclib guardrails needed on OID length | high | 7.5 | 1% |
| CVE-2023-54394 | pocketmine/pocketmine-mp | PocketMine MP vulnerable to uncontrolled resource consumption via mismatched type of 'InventoryTransactionPacket' | medium | 5.3 | 1% |
| CVE-2020-37277 | pocketmine/pocketmine-mp | Exploitable inventory component chaining in PocketMine-MP | high | 0.0 | 1% |
| CVE-2026-26047 | moodle/moodle | Moodle TeX formula editor is vulnerable to DoS through lack of execution time limits | medium | 6.5 | 1% |
| CVE-2026-33204 | kelvinmo/simplejwt | SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering | high | 7.5 | 0% |
| CVE-2024-34358 | typo3/cms-core | TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController | medium | 5.3 | 0% |
| CVE-2026-107381 | enshrined/svg-sanitize | svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences | medium | 6.5 | 0% |
| CVE-2026-59932 | phpoffice/phpspreadsheet | PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion | high | 7.5 | 0% |
| CVE-2026-59933 | phpoffice/phpspreadsheet | PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion | high | 7.5 | 0% |
| CVE-2025-60790 | processwire/processwire | ProcessWire CMS vulnerable to resource-exhaustion Denial of Service | medium | 0.0 | 0% |
| CVE-2026-108359 | phpoffice/phpspreadsheet | PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS) | high | 0.0 | 0% |
| CVE-2026-40863 | phpoffice/phpspreadsheet | PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader | high | 7.5 | 0% |
| CVE-2026-40902 | phpoffice/phpspreadsheet | PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions | high | 7.5 | 0% |
| CVE-2026-61816 | zbateson/mail-mime-parser | zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME | high | 7.5 | 0% |
| CVE-2025-66303 | getgrav/grav | Grav is vulnerable to a DOS on the admin panel | medium | 4.9 | 0% |
| CVE-2026-105830 | league/commonmark | league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan | high | 7.5 | 0% |
| CVE-2026-6409 | google/protobuf | Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion | high | 0.0 | 0% |