Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-4990 | yiisoft/yii2 | Unsafe Reflection in base Component class in yiisoft/yii2 | high | 8.1 | 80% |
| CVE-2026-65608 | getgrav/grav | Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation | high | 8.8 | 1% |
| CVE-2026-25498 | craftcms/cms | Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior | high | 0.0 | 1% |
| CVE-2026-33157 | craftcms/cms | Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior | high | 0.0 | 1% |
| CVE-2025-68455 | craftcms/cms | Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior | high | 0.0 | 1% |
| CVE-2026-44011 | craftcms/cms | Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior | high | 0.0 | 1% |
| CVE-2026-54614 | cakephp/debug_kit | cakephp/debug_kit: MailPreview contains unsafe reflection | medium | 4.3 | 1% |
| CVE-2026-32264 | craftcms/cms | Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController | high | 0.0 | 1% |
| CVE-2026-32263 | craftcms/cms | Craft CMS vulnerable to behavior injection RCE via EntryTypesController | high | 0.0 | 1% |
| CVE-2026-44174 | getkirby/cms | Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints | high | 0.0 | 0% |
| CVE-2026-49287 | statamic/cms | Statamic CMS's unsafe method invocation via collection sorting allows data destruction | high | 7.4 | 0% |
| CVE-2026-114508 | laravel/framework | Laravel relationship inclusion can trigger unauthorized data destruction | medium | 6.5 | 0% |
| CVE-2026-64663 | statamic/cms | Statamic: Unsafe method invocation via Antlers template resolution allows data destruction | medium | 6.5 | 0% |
| CVE-2026-41175 | statamic/cms | Statamic: Unsafe method invocation via query value resolution allows data destruction | high | 8.1 | 0% |
| CVE-2026-69088 | getgrav/grav | Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure | high | 8.1 | 0% |