Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.3, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-27917 | shopware/platform, shopware/storefront | Shopware's session is persistent in Cache for 404 pages | high | 7.5 | 1% |
| CVE-2024-12314 | rapid-cache (WordPress plugin) | The Rapid Cache plugin for WordPress is vulnerable to Cache Poisoning in all versions up to, and including, 1.2.3. This is due to plugin sto | high | 7.2 | 0% |
| CVE-2026-49858 | api-platform/core, api-platform/hal, api-platform/json-api | API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate | medium | 5.9 | 0% |
| CVE-2026-107851 | contao/core-bundle | Contao: Improper access control in the table access voter | medium | 4.3 | 0% |