Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-2633 | all-in-one-video-gallery (WordPress plugin) | The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'd | high | 7.5 | 34% |
| CVE-2017-18357 | shopware/shopware | Shopware XXE Vulnerability | medium | 6.5 | 27% |
| CVE-2023-30943 | moodle/moodle | Moodle External Control of File Name or Path vulnerability | medium | 5.3 | 7% |
| CVE-2022-2431 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to i | high | 8.1 | 4% |
| CVE-2020-5296 | october/cms | Arbitrary File Deletion vulnerability in OctoberCMS | medium | 6.2 | 1% |
| CVE-2016-0796 | mb.miniaudioplayer (WordPress plugin) | WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and | high | 7.5 | 1% |
| CVE-2022-2638 | export-all-urls (WordPress plugin) | The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be t | medium | 6.5 | 1% |
| CVE-2020-5297 | october/cms | Upload whitelisted files to any directory in OctoberCMS | low | 3.4 | 1% |
| CVE-2025-6691 | sureforms (WordPress plugin) | The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient f | high | 8.1 | 1% |
| CVE-2020-8226 | phpbb/phpbb | phpBB Server-Side Request Forgery Vulnerability | medium | 5.8 | 1% |
| CVE-2024-25117 | phenx/php-svg-lib | php-svg-lib lacks path validation on font through SVG inline styles | medium | 6.8 | 1% |