Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2017-7615 | mantisbt/mantisbt | MantisBT allows arbitrary password reset | high | 8.8 | 91% |
| CVE-2017-8295 | WordPress core | WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to re | medium | 5.9 | 27% |
| CVE-2020-11027 | WordPress core | In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be | medium | 6.1 | 14% |
| CVE-2017-5594 | pagekit/pagekit | Pagekit Weak Password Recovery Mechanism for Forgotten Password | high | 7.5 | 7% |
| CVE-2014-6412 | WordPress core | WordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach. | high | 8.1 | 5% |
| CVE-2022-29933 | craftcms/cms | Improper account password reset in Craft CMS | high | 8.8 | 5% |
| CVE-2018-19488 | wp-jobhunt (WordPress plugin) | The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_reset_pass() function through the admin | critical | 9.8 | 4% |
| CVE-2020-36326 | phpmailer/phpmailer | Object injection in PHPMailer/PHPMailer | critical | 9.8 | 3% |
| CVE-2019-15929 | craftcms/cms | Craft CMS possibility of brute force attempts | critical | 9.8 | 2% |
| CVE-2021-21265 | october/backend | October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers | low | 0.0 | 2% |
| CVE-2025-64500 | symfony/http-foundation, symfony/symfony | Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass | high | 7.3 | 1% |
| CVE-2019-10641 | contao/contao, contao/core, contao/core-bundle | Contao Does Not Invalidate Existing Sessions When Password Changes | critical | 9.8 | 1% |
| CVE-2022-0777 | microweber/microweber | Rate limit missing in microweber | high | 7.5 | 1% |
| CVE-2021-41114 | typo3/cms, typo3/cms-core | HTTP Host Header Injection | medium | 4.8 | 1% |
| CVE-2019-10270 | ultimate-member (WordPress plugin) | An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible (due to lack of verificati | high | 8.8 | 1% |
| CVE-2021-25957 | dolibarr/dolibarr | Weak Password Recovery Mechanism for Forgotten Password | high | 8.8 | 1% |
| CVE-2026-26273 | idno/known | Known affected by Account Takeover via Password Reset Token Leakage | critical | 9.8 | 1% |
| CVE-2016-7038 | moodle/moodle | Moodle Weak Password Recovery Mechanism for Forgotten Password | high | 7.3 | 1% |
| CVE-2017-8385 | craftcms/cms | Craft CMS subject to URL forgery | medium | 5.3 | 1% |
| CVE-2021-36804 | akaunting/akaunting | Malicious password-reset in Akaunting | high | 8.1 | 1% |
| CVE-2024-21910 | tinymce/tinymce | Cross-site scripting vulnerability in TinyMCE plugins | medium | 6.1 | 1% |
| CVE-2023-4214 | apppresser (WordPress plugin) | The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 4.2.5. This is due to the | high | 8.1 | 1% |
| CVE-2022-24892 | shopware/shopware | Multiple valid tokens for password reset in Shopware | medium | 6.4 | 1% |
| CVE-2023-50172 | wwbn/avideo | WWBN AVideo recovery notification bypass vulnerability | medium | 5.3 | 1% |
| CVE-2024-11103 | contest-gallery (WordPress plugin) | The Contest Gallery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 24 | critical | 9.8 | 1% |
| CVE-2023-28821 | concrete5/concrete5 | Missing rate limit for password resets | medium | 5.3 | 1% |
| CVE-2024-11350 | adforest (WordPress plugin) | The AdForest theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.1.6. Thi | critical | 9.8 | 1% |
| CVE-2024-9305 | apppresser (WordPress plugin) | The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, | high | 8.1 | 1% |
| CVE-2026-55207 | pimcore/studio-backend-bundle | Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass | high | 8.8 | 1% |
| CVE-2023-7264 | build-app-online (WordPress plugin) | The Build App Online plugin for WordPress is vulnerable to account takeover due to a weak password reset mechanism in all versions up to, an | high | 8.1 | 1% |
| CVE-2024-9302 | app-builder (WordPress plugin) | The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to privilege escalation via account take | high | 8.1 | 1% |
| CVE-2021-34639 | download-manager (WordPress plugin) | Authenticated File Upload in WordPress Download Manager <= 3.1.24 allows authenticated (Author+) users to upload files with a double extensi | high | 7.5 | 1% |
| CVE-2026-27593 | statamic/cms | Statamic is vulnerable to account takeover via password reset link injection | critical | 9.3 | 1% |
| CVE-2026-42606 | azuracast/azuracast | AzuraCast has Password Reset Poisoning via Untrusted X-Forwarded-Host Header that Leads to Account Takeover and 2FA Bypass | high | 8.1 | 0% |
| CVE-2026-80196 | kimai/kimai | Kimai Password Reset Link Remains Valid After Password Change | low | 0.0 | 0% |
| CVE-2026-2895 | funadmin/funadmin | funadmin has Weak Password Recovery Mechanism for Forgotten Password | low | 3.7 | 0% |
| CVE-2025-1570 | directorist (WordPress plugin) | The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to privilege escalatio | high | 8.1 | 0% |
| CVE-2026-35675 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration | high | 8.2 | 0% |
| CVE-2026-50635 | limesurvey/limesurvey | LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. | high | 8.8 | 0% |
| CVE-2025-58449 | mahocommerce/maho | Maho is Vulnerable to Authenticated Remote Code Execution via File Upload | high | 0.0 | 0% |
| CVE-2026-35676 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token Validation | high | 8.2 | 0% |
| CVE-2026-29199 | phpbb/phpbb | phpBB has Password Reset Link Poisoning via Host Header injection | high | 8.1 | 0% |
| CVE-2025-63828 | backdrop/backdrop | Backdrop CMS Host Header Injection vulnerability | medium | 0.0 | 0% |
| CVE-2022-50807 | concrete5/concrete5 | Concrete5 CMS contains an XPath injection vulnerability | critical | 9.8 | – |
| GHSA-2w46-vq8h-98vh | shopware/core | Shopware 6's password recovery link does not expire after email change | medium | 5.0 | – |