Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-63030 KEV | WordPress core | WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the | critical | 9.8 | 11% |
| CVE-2023-24813 | dompdf/dompdf | URI validation failure on SVG parsing. Bypass of CVE-2023-23924 | critical | 10.0 | 2% |
| CVE-2019-19589 | pdf-embedder (WordPress plugin) | The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives. Note: | critical | 9.8 | 2% |
| CVE-2023-29197 | guzzlehttp/psr7 | Improper header name validation in guzzlehttp/psr7 | medium | 5.3 | 1% |
| CVE-2023-30536 | slim/psr7 | Insecure header validation in slim/psr7 | medium | 6.5 | 1% |
| CVE-2026-47767 | symfony/runtime, symfony/symfony | SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch | medium | 0.0 | 1% |
| CVE-2022-29254 | silverstripe/silverstripe-omnipay | Failed payment recorded has completed in Silverstripe Omnipay | low | 3.7 | 1% |
| CVE-2024-24754 | bref/bref | Bref vulnerable to Body Parsing Inconsistency in Event-Driven Functions | low | 3.7 | 1% |
| CVE-2025-24013 | codeigniter4/framework | Missing validation of header name and value in codeigniter4/framework | medium | 5.3 | 1% |
| CVE-2024-24753 | bref/bref | Bref Doesn't Support Multiple Value Headers in ApiGatewayFormatV2 | medium | 4.8 | 0% |
| CVE-2023-52892 | phpseclib/phpseclib | Name confusion in x509 Subject Alternative Name fields | high | 7.5 | 0% |
| CVE-2026-69246 | guzzlehttp/guzzle | Guzzle: Noncanonical host can bypass host-based checks | high | 7.2 | 0% |
| CVE-2026-42551 | flightphp/core | Flight: HTTP method override enabled by default, facilitating CSRF escalation and middleware bypass | high | 7.5 | 0% |
| CVE-2026-45066 | symfony/html-sanitizer, symfony/symfony | Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification | medium | 0.0 | 0% |
| CVE-2026-59882 | guzzlehttp/psr7 | guzzlehttp/psr7: Host Confusion via Weak URI Host Validation | medium | 4.2 | 0% |
| GHSA-9jxr-mwpp-w643 | httpsoft/http-message | Improper header validation in httpsoft/http-message | medium | 5.3 | – |
| GHSA-wjfc-pgfp-pv9c | nyholm/psr7 | Improper Input Validation in nyholm/psr7 | medium | 5.3 | – |