Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.3, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-59193 | getgrav/grav | Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip() | medium | 4.9 | 1% |
| CVE-2026-59932 | phpoffice/phpspreadsheet | PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion | high | 7.5 | 0% |
| CVE-2025-60790 | processwire/processwire | ProcessWire CMS vulnerable to resource-exhaustion Denial of Service | medium | 0.0 | 0% |
| CVE-2026-61455 | getgrav/grav | Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits | medium | 6.5 | 0% |
| GHSA-xg43-5579-qw6v | adawolfa/isdoc | adawolfa/isdoc: Uncontrolled resource consumption (decompression bomb) when reading untrusted ISDOCX or PDF files | medium | 6.5 | – |