Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-3818 | getgrav/grav | Reliance on Cookies without Validation and Integrity Checking in getgrav/grav | medium | 6.3 | 2% |
| CVE-2019-17104 | centreon/centreon | Centreon Does Not Set HTTPOnly Flag | high | 7.5 | 2% |
| CVE-2022-29248 | guzzlehttp/guzzle, drupal/core | Cross-domain cookie leakage in Guzzle | high | 8.0 | 1% |
| CVE-2022-36032 | react/http | ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sent | medium | 5.3 | 1% |
| CVE-2020-15128 | october/rain | Reliance on Cookies without validation in OctoberCMS | medium | 6.1 | 1% |
| CVE-2024-9820 | two-factor-login-telegram (WordPress plugin) | The WP 2FA with Telegram plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 3.0. This | medium | 6.5 | 0% |
| CVE-2026-39963 | s9y/serendipity | Serendipity has a Host Header Injection allows authentication cookie scoping to attacker-controlled domain in functions_config.inc.php | medium | 6.9 | 0% |
| CVE-2026-8337 | concrete5/concrete5 | Concrete CMS is vulnerable to IDOR in surveys | medium | 0.0 | 0% |