Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-36193 KEV | pear/archive_tar | Directory Traversal in Archive_Tar | high | 7.5 | 71% |
| CVE-2021-32610 | pear/archive_tar, drupal/core | Directory Traversal in Archive_Tar | high | 7.1 | 73% |
| CVE-2014-8585 | download-manager (WordPress plugin) | Directory traversal vulnerability in the WordPress Download Manager plugin for WordPress allows remote attackers to read arbitrary files via | medium | 5.0 | 3% |
| CVE-2008-6762 | WordPress core | Open redirect vulnerability in wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to redirect users to arbitrary web | medium | 4.3 | 2% |
| CVE-2014-9508 | typo3/cms | Typo3 Open Redirect In Frontend Rendering | medium | 0.0 | 2% |
| CVE-2008-3227 | joomla/framework | Joomla! Open Redirect vulnerability | high | 0.0 | 1% |
| CVE-2023-6069 | froxlor/froxlor | Froxlor Improper Input Validation vulnerability | critical | 9.9 | 1% |
| CVE-2026-50157 | auth0/symfony | Auth0 Symfony SDK Accepted Bearer Tokens via URL Query Parameter | medium | 6.5 | 1% |
| CVE-2026-59944 | composer/composer | Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path | medium | 6.1 | 0% |
| CVE-2026-41231 | froxlor/froxlor | Froxlor has Incomplete Symlink Validation in DataDump.add() Allows Arbitrary Directory Ownership Takeover via Cron | high | 7.5 | 0% |
| CVE-2008-5153 | moodle/moodle | Moodle vulnerable to symlink attack | medium | 0.0 | 0% |
| CVE-2026-55375 | jleehr/canto-saas-api | canto-saas-api: OAuth credentials exposed in URL query string and exception messages | medium | 5.3 | 0% |
| CVE-2025-3637 | moodle/moodle | Moodle's mod_data edit/delete pages pass CSRF token in GET parameter | low | 3.1 | 0% |
| CVE-2026-41236 | froxlor/froxlor | Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` path | high | 8.8 | 0% |
| CVE-2026-43875 | wwbn/avideo | AVideo: Password Hash Leak in MobileManager OAuth Redirect URL Enables Account Takeover | medium | 6.8 | 0% |