Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-6421 | download-manager (WordPress plugin) | The Download Manager WordPress plugin before 3.2.83 does not protect file download's passwords, leaking it upon receiving an invalid one. | high | 7.5 | 2% |
| CVE-2019-1000001 | nilsteampassnet/teampass | TeamPass Storing Passwords in a Recoverable Format vulnerability | critical | 9.8 | 2% |
| CVE-2022-4693 | user-verification (WordPress plugin) | The User Verification WordPress plugin before 1.0.94 was affected by an Auth Bypass security vulnerability. To bypass authentication, we onl | critical | 9.8 | 2% |
| CVE-2022-1715 | facturascripts/facturascripts | Account takeover in facturascripts | critical | 9.8 | 1% |
| CVE-2022-37783 | craftcms/cms | Craft CMS discloses password hashes | high | 7.5 | 1% |
| CVE-2024-5657 | born05/craft-twofactorauthentication | Password hash exposed in CraftCMS two factor authentication plugin | low | 3.7 | 1% |
| CVE-2024-0368 | wordpress-popup (WordPress plugin) | The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Information Exposure in all ve | high | 8.6 | 1% |
| CVE-2021-39342 | credova-financial (WordPress plugin) | The Credova_Financial WordPress plugin discloses a site's associated Credova API account username and password in plaintext via an AJAX acti | medium | 5.3 | 1% |
| CVE-2024-7389 | forminator (WordPress plugin) | The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-f | high | 7.5 | 1% |
| CVE-2022-3206 | passster (WordPress plugin) | The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encoding method which is ea | medium | 5.9 | 1% |
| CVE-2023-2881 | pimcore/customer-management-framework-bundle | Pimcore customers' list user password hash is disclosed | medium | 6.7 | 1% |
| CVE-2025-27192 | magento/community-edition, magento/project-community-edition | Magento does not properly protect credentials | low | 2.7 | 0% |
| CVE-2026-33182 | saloonphp/saloon | Saloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URL | medium | 0.0 | 0% |
| CVE-2026-71293 | statamic/cms | Statamic CMS exposes two-factor recovery codes through dynamic Antlers rendering | medium | 6.2 | 0% |
| CVE-2026-67339 | guzzlehttp/guzzle | Guzzle: Proxy-Authorization headers can be sent to origin servers | medium | 5.3 | 0% |
| CVE-2026-76839 | getgrav/grav | Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via | high | 7.7 | 0% |
| CVE-2026-76846 | getgrav/grav | Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when co | high | 7.5 | 0% |
| CVE-2026-55885 | getgrav/grav | Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets | medium | 6.8 | 0% |
| GHSA-7wh8-jrq7-p27f | simplesamlphp/simplesamlphp | SimpleSAMLphp exposes credentials in session storage | medium | 5.3 | – |
| GHSA-h6w8-27ph-c385 | leantime/leantime | Leantime has Insufficiently Protected Credentials | medium | 0.0 | – |