Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.3, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-40476 | webonyx/graphql-php | graphql-php is affected by a Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation | high | 7.5 | 1% |
| CVE-2026-71488 | league/commonmark | league/commonmark: Quadratic-time denial of service when parsing crafted Markdown | high | 7.5 | 1% |
| CVE-2026-86429 | league/commonmark | league/commonmark: Denial of service in the SmartPunct and Attributes extensions | high | 7.5 | 1% |
| CVE-2026-86434 | league/commonmark | league/commonmark: Denial of service via colliding heading slugs | high | 7.5 | 1% |
| CVE-2026-86428 | league/commonmark | league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension | high | 7.5 | 0% |
| CVE-2026-86430 | league/commonmark | league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters | high | 7.5 | 0% |
| CVE-2024-58382 | league/commonmark | league/commonmark's quadratic complexity bugs may lead to a denial of service | high | 7.5 | 0% |
| CVE-2026-105830 | league/commonmark | league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan | high | 7.5 | 0% |
| GHSA-fc86-6rv6-2jpm | webonyx/graphql-php | webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments | high | 7.5 | – |
| GHSA-g2gp-3wwq-f4ph | league/commonmark | league/commonmark: Denial of service via adjacent inline attribute blocks | high | 7.5 | – |
| GHSA-jfm3-95jq-q3rf | league/commonmark | league/commonmark: Denial of service via duplicate footnote definitions | high | 7.5 | – |