Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-3311 | october/rain | October CMS Session ID not invalidated after logout | critical | 9.8 | 3% |
| CVE-2021-21031 | magento/community-edition, magento/project-community-edition | Magento Insufficient Session Expiration | medium | 5.6 | 2% |
| CVE-2018-11386 | symfony/http-foundation, symfony/symfony | Symfony DoS | medium | 5.9 | 2% |
| CVE-2021-21032 | magento/community-edition, magento/project-community-edition | Magento Insufficient Session Expiration | medium | 5.6 | 2% |
| CVE-2022-31050 | typo3/cms, typo3/cms-core | Insufficient Session Expiration in TYPO3's Admin Tool | medium | 6.0 | 1% |
| CVE-2022-2713 | aheinze/cockpit | Cockpit before 2.2.0 vulnerable to Insufficient Session Expiration | critical | 9.8 | 1% |
| CVE-2022-24743 | sylius/sylius | Insufficient Session Expiration in Sylius | high | 7.1 | 1% |
| CVE-2017-12867 | simplesamlphp/simplesamlphp | SimpleSAMLphp Invalid token creation and validation | medium | 5.9 | 1% |
| CVE-2022-0991 | admidio/admidio | Insufficient Session Expiration in Admidio | high | 8.2 | 1% |
| CVE-2022-1155 | snipe/snipe-it | Old sessions not blocked by login enable function in Snipe-IT | high | 7.4 | 1% |
| CVE-2021-32710 | shopware/platform | Potential Session Hijacking | low | 0.0 | 1% |
| CVE-2009-20001 | mantisbt/mantisbt | MantisBT Insufficient Session Expiration cookie string not reset after logout | high | 8.1 | 1% |
| CVE-2022-21652 | shopware/shopware | Insufficient Session Expiration in shopware | low | 3.5 | 1% |
| CVE-2023-38489 | getkirby/cms | Insufficient Session Expiration after a password change | high | 7.3 | 1% |
| CVE-2022-24895 | symfony/security-bundle, symfony/symfony | Symfony vulnerable to Session Fixation of CSRF tokens | medium | 6.3 | 1% |
| CVE-2023-22732 | shopware/core, shopware/platform | Shopware has Insufficient Session Expiration in Administration | low | 3.7 | 1% |
| CVE-2022-4070 | librenms/librenms | Insufficient Session Expiration in librenms/librenms | critical | 9.8 | 1% |
| CVE-2023-4190 | admidio/admidio | Admidio Insufficient Session Expiration vulnerability | medium | 6.5 | 1% |
| CVE-2023-28472 | concrete5/concrete5 | Concrete CMS missing secure cookie parameters | medium | 5.3 | 1% |
| CVE-2023-5865 | thorsten/phpmyfaq | Insufficient Session Expiration in thorsten/phpmyfaq | high | 7.6 | 1% |
| CVE-2026-34570 | ci4-cms-erp/ci4ms | CI4MS: Account Deletion Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw) | high | 8.8 | 1% |
| CVE-2026-34572 | ci4-cms-erp/ci4ms | CI4MS: Account Deactivation Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw) | high | 8.8 | 1% |
| CVE-2024-30262 | contao/core-bundle | Contao: Remember-me tokens will not be cleared after a password change | medium | 5.9 | 0% |
| CVE-2024-31447 | shopware/core, shopware/platform | Shopware Improper Session Handling in store-api account logout | medium | 5.3 | 0% |
| CVE-2022-24744 | shopware/core, shopware/platform | Shopware user session is not logged out if the password is reset via password recovery | low | 2.6 | 0% |
| CVE-2022-47406 | derhansen/fe_change_pwd, typo3/cms | TYPO3 vulnerable to Insufficient Session Expiration | critical | 9.8 | 0% |
| CVE-2023-1788 | grumpydictator/firefly-iii | Firefly III insufficiently expires sessions | medium | 4.2 | 0% |
| CVE-2022-23502 | typo3/cms, typo3/cms-core | TYPO3 CMS vulnerable to Insufficient Session Expiration after Password Reset | medium | 5.4 | 0% |
| CVE-2020-23136 | microweber/microweber | Microweber Insufficient Session Expiry | medium | 5.5 | 0% |
| CVE-2026-41891 | ci4-cms-erp/ci4ms | CI4MS has a Deactivated User Session Bypass (active=0) | medium | 0.0 | 0% |
| CVE-2026-34362 | wwbn/avideo | AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket() | medium | 5.4 | 0% |
| CVE-2025-68954 | pterodactyl/panel | Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced | high | 0.0 | 0% |
| CVE-2024-31556 | reportico-web/reportico | Reportico Web fails to invalidate cookies upon logout | medium | 6.5 | 0% |
| GHSA-rcm4-jv5g-wccm | zfr/zfr-oauth2-server-module | zfr authentication adapter did not verify validity of tokens | high | 7.5 | – |
| GHSA-7v3x-h7r2-34jv | pterodactyl/panel | Insufficient Session Expiration in Pterodactyl API | medium | 6.0 | – |
| GHSA-5r8w-66hq-rc39 | silverstripe/framework | silverstripe/framework's pre-existing alc_enc cookies log users in if remember me is disabled | low | 3.1 | – |
| GHSA-hr7j-63v7-vj7g | pterodactyl/panel | Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change | high | 0.0 | – |