Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-55889 | thorsten/phpmyfaq | thorsten/phpmyfaq Unintended File Download Triggered by Embedded Frames | medium | 4.9 | 2% |
| CVE-2026-45064 | symfony/html-sanitizer, symfony/symfony | Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing | medium | 0.0 | 0% |
| CVE-2026-48760 | symfony/html-sanitizer, symfony/symfony | Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defens | medium | 0.0 | 0% |
| CVE-2025-13082 | drupal/core | By generating and tricking a user into visiting a malicious URL, an attacker can perform site defacement. The defacemen | low | 0.0 | 0% |