Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-35939 KEV | craftcms/cms | Craft CMS stores arbitrary content provided by unauthenticated users in session files | medium | 5.3 | 1% |
| CVE-2022-30597 | moodle/moodle | External Control of Assumed-Immutable Web Parameter in moodle | medium | 5.3 | 1% |
| CVE-2025-29788 | sylius/paypal-plugin | Sylius PayPal Plugin Payment Amount Manipulation Vulnerability | medium | 6.5 | 1% |
| CVE-2024-50703 | nilsteampassnet/teampass | TeamPass privileges issue | medium | 5.4 | 0% |
| CVE-2024-6010 | cost-calculator-builder (WordPress plugin) | The Cost Calculator Builder PRO plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.2.1. This i | medium | 5.3 | 0% |
| CVE-2025-30152 | sylius/paypal-plugin | Sylius PayPal Plugin has an Order Manipulation Vulnerability after PayPal Checkout | medium | 6.5 | 0% |
| CVE-2026-32699 | facturascripts/facturascripts | FacturaScripts has Insecure Parameter Handling: Unauthorized Modification of Immutable 'nick' Field | medium | 4.3 | 0% |