Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-49113 KEV | roundcube/roundcubemail | Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization | critical | 9.9 | 99% |
| CVE-2019-6340 KEV | drupal/core, drupal/drupal | Some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in s | high | 8.1 | 92% |
| CVE-2018-15133 KEV | laravel/framework | Laravel Framework RCE Vulnerability | high | 8.1 | 77% |
| CVE-2020-15148 | yiisoft/yii2 | Unsafe deserialization in Yii 2 | high | 8.9 | 78% |
| CVE-2024-5932 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and | critical | 10.0 | 77% |
| CVE-2021-3007 | laminas/laminas-http, zendframework/zendframework | Remote code execution in zendframework and laminas-http | critical | 9.8 | 75% |
| CVE-2019-10867 | pimcore/pimcore | Pimcore Unserialize Remote Code Execution | high | 8.8 | 69% |
| CVE-2023-6933 | better-search-replace (WordPress plugin) | The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deseria | high | 8.8 | 68% |
| CVE-2019-12799 | shopware/shopware | Shopware Insecure Deserialization Vulnerability | high | 8.8 | 54% |
| CVE-2021-24307 | all-in-one-seo (WordPress plugin) | The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseo_to | high | 8.8 | 53% |
| CVE-2020-28948 | pear/archive_tar, drupal/core | Multiple vulnerabilities through filename manipulation in Archive_Tar | high | 7.8 | 47% |
| CVE-2024-3054 | wpvivid-backuprestore (WordPress plugin) | WPvivid Backup & Migration Plugin for WordPress is vulnerable to PHAR Deserialization in all versions up to, and including, 0.9.99 via deser | high | 7.2 | 42% |
| CVE-2022-21647 | codeigniter4/framework | Deserialization of Untrusted Data in Codeigniter4 | high | 7.7 | 38% |
| CVE-2023-1650 | wpbot (WordPress plugin) | The AI ChatBot WordPress plugin before 4.4.7 unserializes user input from cookies via an AJAX action available to unauthenticated users, whi | critical | 9.8 | 34% |
| CVE-2024-1651 | torrentpier/torrentpier | Deserialization of Untrusted Data in Torrentpier | critical | 10.0 | 34% |
| CVE-2024-8353 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and | critical | 9.8 | 32% |
| CVE-2020-29045 | food-and-drink-menu (WordPress plugin) | The food-and-drink-menu plugin through 2.2.0 for WordPress allows remote attackers to execute arbitrary code because of an unserialize opera | critical | 9.8 | 31% |
| CVE-2018-20148 | WordPress core | In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMedi | critical | 9.8 | 27% |
| CVE-2018-17057 | fooman/tcpdf, la-haute-societe/tcpdf, spoonity/tcpdf +3 more | TCPDF vulnerable to attackers triggering deserialization of arbitrary data | critical | 9.8 | 26% |
| CVE-2022-33107 | topthink/framework | Deserialization of Untrusted Data in topthink/framework | critical | 9.8 | 24% |
| CVE-2022-38352 | topthink/framework | ThinkPHP deserialization vulnerability | critical | 9.8 | 21% |
| CVE-2023-2288 | otter (WordPress plugin) | The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing file operations on them. This le | high | 8.8 | 18% |
| CVE-2023-1669 | seopress (WordPress plugin) | The SEOPress WordPress plugin before 6.5.0.3 unserializes user input provided via the settings, which could allow high-privilege users such | high | 7.2 | 18% |
| CVE-2023-1347 | customizer-export\/import (WordPress plugin) | The Customizer Export/Import WordPress plugin before 0.9.6 unserializes user input provided via the settings, which could allow high privile | high | 7.2 | 16% |
| CVE-2020-29047 | wp-hotel-booking (WordPress plugin) | The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operati | critical | 9.8 | 16% |
| CVE-2020-28032 | WordPress core | WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php. | critical | 9.8 | 16% |
| CVE-2020-3716 | magento/community-edition | Magento deserialization vulnerability | critical | 9.8 | 14% |
| CVE-2020-9006 | popup-builder (WordPress plugin) | The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups function in sg_popup_ajax | critical | 9.8 | 9% |
| CVE-2021-24579 | bold-page-builder (WordPress plugin) | The bt_bb_get_grid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the unserialize() function with | high | 8.8 | 8% |
| CVE-2019-11831 | drupal/core, drupal/drupal, typo3/phar-stream-wrapper | This security release fixes third-party dependencies included in or required by Drupal core. As described in [TYPO3-PSA- | critical | 9.8 | 5% |
| CVE-2018-19274 | phpbb/phpbb | phpBB Remote Code Execution | high | 7.2 | 5% |
| CVE-2020-23653 | zoujingli/thinkadmin | ThinkAdmin insecure unserialize vulnerability | critical | 9.8 | 4% |
| CVE-2024-44902 | topthink/framework | ThinkPHP deserialization vulnerability | critical | 9.8 | 4% |
| CVE-2011-4962 | silverstripe/cms | Silverstripe CMS Arbitrary Code Execution | medium | 0.0 | 4% |
| CVE-2023-26326 | buddyforms (WordPress plugin) | The BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated insecure deserialization issue. An unauthent | critical | 9.8 | 4% |
| CVE-2024-5488 | seopress (WordPress plugin) | The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injectio | critical | 9.8 | 4% |
| CVE-2022-21663 | WordPress core | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with | medium | 6.6 | 4% |
| CVE-2020-15086 | friendsoftypo3/mediace | Potential Remote Code Execution in TYPO3 with mediace extension | critical | 9.8 | 4% |
| CVE-2021-24217 | facebook (WordPress plugin) | The run_action function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects | high | 8.1 | 4% |
| CVE-2023-47130 | yiisoft/yii | yiisoft/yii deserializing untrusted user input can lead to remote code execution | high | 8.1 | 3% |
| CVE-2020-36326 | phpmailer/phpmailer | Object injection in PHPMailer/PHPMailer | critical | 9.8 | 3% |
| CVE-2023-28115 | knplabs/knp-snappy | PHAR deserialization allowing remote code execution | critical | 9.8 | 3% |
| CVE-2024-31211 | WordPress core | WordPress is an open publishing platform for the Web. Unserialization of instances of the `WP_HTML_Token` class allows for code execution vi | medium | 5.5 | 3% |
| CVE-2021-23420 | codeception/codeception | Deserialization of Untrusted Data in codeception/codeception | critical | 9.8 | 3% |
| CVE-2019-11830 | typo3/phar-stream-wrapper | PharStreamWrapper for Typo3 unsafe deserialization vulnerability | critical | 9.8 | 3% |
| CVE-2019-7743 | joomla/joomla-cms | Joomla! Object Injection Vulnerability | critical | 9.8 | 3% |
| CVE-2022-3360 | learnpress (WordPress plugin) | The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticated users, which coul | high | 8.1 | 3% |
| CVE-2018-1000527 | froxlor/froxlor | Froxlor PHP Object Injection vulnerability | high | 7.2 | 3% |
| CVE-2026-46725 | mmc/ceselector | TYPO3 Remote Code Execution in extension "Content Element Selector" (ceselector) | critical | 0.0 | 3% |
| CVE-2020-4043 | maikuolan/phpmussel, phpmussel/phpmussel | Phar unserialization vulnerability in phpMussel | high | 7.7 | 3% |