Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-41267 | symfony/http-kernel, symfony/symfony | Webcache Poisoning in symfony/http-kernel | medium | 6.5 | 1% |
| CVE-2023-29141 | mediawiki/core | X-Forwarded-For header allows brute-forcing autoblocked IP addresses | critical | 9.8 | 1% |
| CVE-2023-27238 | lavalite/cms | LavaLite vulnerable to web cache poisoning | critical | 9.8 | 1% |
| CVE-2025-22871 | spiral/roadrunner | RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency | critical | 9.1 | 1% |
| CVE-2019-19326 | silverstripe/framework | SilverStripe Web Cache Poisoning through HTTPRequestBuilder | medium | 5.9 | 1% |
| CVE-2020-5218 | sylius/resource-bundle, sylius/sylius | Ability to expose data in Sylius by using an unintended serialisation group | medium | 4.4 | 1% |
| CVE-2024-29643 | croogo/croogo | croogo Host header injection | medium | 0.0 | 1% |
| CVE-2026-48979 | php-standard-library/h2, php-standard-library/php-standard-library | PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling | high | 7.5 | 0% |
| GHSA-r64m-qchj-hrjp | shopware/core, shopware/platform | Webcache Poisoning in shopware/platform and shopware/core | critical | 0.0 | – |