Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-2916 | iwp-client (WordPress plugin) | The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the | high | 7.5 | 24% |
| CVE-2021-37704 | phpfastcache/phpfastcache | Exposed phpinfo() leadked via documentation files | medium | 5.4 | 6% |
| CVE-2022-25481 | topthink/framework | Exposure of Resource to Wrong Sphere in ThinkPHP Framework | high | 7.5 | 5% |
| CVE-2016-11007 | wp-invoice (WordPress plugin) | The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_user_id for invoice retrieval. | medium | 5.3 | 2% |
| CVE-2020-15877 | librenms/librenms | Exposure of Resource to Wrong Sphere in LibreNMS | high | 8.8 | 2% |
| CVE-2016-11006 | wp-invoice (WordPress plugin) | The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes. | medium | 5.3 | 2% |
| CVE-2016-11008 | wp-invoice (WordPress plugin) | The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates. | medium | 5.3 | 2% |
| CVE-2016-11009 | wp-invoice (WordPress plugin) | The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates. | medium | 5.3 | 2% |
| CVE-2016-11010 | wp-invoice (WordPress plugin) | The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata updates. | medium | 5.3 | 2% |
| CVE-2021-24374 | automattic/jetpack, jetpack (WordPress plugin) | JetPack Exposure of Resource to Wrong Sphere | medium | 5.3 | 1% |
| CVE-2021-24775 | document-embedder (WordPress plugin) | The Document Embedder WordPress plugin before 1.7.5 contains a REST endpoint, which could allow unauthenticated users to enumerate the title | medium | 5.3 | 1% |
| CVE-2021-43560 | moodle/moodle | Moodle Insecure direct object reference (IDOR) in a calendar web service | medium | 5.3 | 1% |
| CVE-2020-13670 | drupal/core, drupal/drupal | A vulnerability exists in the File module which allows an attacker to gain access to the file metadata of a permanent pr | high | 7.5 | 1% |
| CVE-2022-24747 | shopware/core, shopware/platform, shopware/storefront | HTTP caching is marking private HTTP headers as public in Shopware | medium | 6.3 | 1% |
| CVE-2017-7490 | moodle/moodle | Moodle Unauthorized searching of arbitrary blogs by typing full url | medium | 5.3 | 1% |
| CVE-2021-36793 | lms/routes | CSRF token exposure in TYPO3 extension | medium | 6.8 | 1% |
| CVE-2021-24868 | document-embedder (WordPress plugin) | The Document Embedder WordPress plugin before 1.7.9 contains a AJAX action endpoint, which could allow any authenticated user, such as subsc | medium | 4.3 | 1% |
| CVE-2022-24742 | sylius/sylius | Sensitive Information Exposure in Sylius | medium | 5.0 | 1% |
| CVE-2022-39315 | getkirby/cms | Kirby CMS vulnerable to user enumeration in the brute force protection | medium | 6.5 | 1% |
| CVE-2022-34867 | wp-libre-form (WordPress plugin), libreform/libreform | Unauthenticated Sensitive Information Disclosure vulnerability in WP Libre Form 2 plugin <= 2.0.8 at WordPress allows attackers to list and | high | 7.3 | 1% |
| CVE-2023-1402 | moodle/moodle | Moodle may display roles to users who don't have access to them | medium | 4.3 | 1% |
| CVE-2023-28336 | moodle/moodle | Moodle may allow teachers to access the names of users they could not otherwise access | medium | 4.3 | 1% |
| CVE-2023-44394 | mantisbt/mantisbt | MantisBT may disclose project names to unauthorized users | medium | 4.3 | 1% |
| CVE-2022-47410 | fixpunkt/fp-newsletter | "Newsletter subscriber management" (fp_newsletter) TYPO3 extension leaks subscriber data | high | 7.5 | 1% |
| CVE-2022-47411 | fixpunkt/fp-newsletter | "Newsletter subscriber management" (fp_newsletter) TYPO3 extension leaks subscriber data | high | 7.5 | 1% |
| CVE-2022-0334 | moodle/moodle | Insufficient user authorization in Moodle | medium | 4.3 | 1% |
| CVE-2022-25336 | ezsystems/ezplatform-kernel | Exposure of Resource to Wrong Sphere in ezsystems/ezplatform-kernel | medium | 5.3 | 1% |
| CVE-2021-4194 | ssddanbrown/bookstack | bookstack is vulnerable to Improper Access Control | medium | 4.3 | 1% |
| CVE-2020-13240 | dolibarr/dolibarr | Dolibarr Stored Cross-site Scripting | medium | 5.4 | 1% |
| CVE-2026-45077 | symfony/monolog-bridge, symfony/symfony | Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener | high | 0.0 | 1% |
| CVE-2022-40316 | moodle/moodle | Moodle No groups filtering in H5P activity attempts report | medium | 4.3 | 1% |
| CVE-2022-0762 | microweber/microweber | Exposure of Resource to Wrong Sphere in microweber | medium | 4.3 | 1% |
| CVE-2023-7014 | molongui-authorship (WordPress plugin) | The Author Box, Guest Author and Co-Authors for Your Posts – Molongui plugin for WordPress is vulnerable to Sensitive Information Exposure i | medium | 5.3 | 1% |
| CVE-2023-7204 | wp-staging (WordPress plugin) | The WP STAGING WordPress Backup plugin before 3.2.0 allows access to cache files during the cloning process which provides | high | 7.5 | 1% |
| CVE-2023-5545 | moodle/moodle | Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability | medium | 5.3 | 1% |
| CVE-2026-29093 | wwbn/avideo | AVideo: Unauthenticated PHP session store exposed to host network via published memcached port | high | 8.1 | 1% |
| CVE-2023-5542 | moodle/moodle | Moodle Improper Access Control vulnerability | medium | 4.3 | 0% |
| CVE-2024-51754 | twig/twig | Twig has unguarded calls to `__toString()` when nesting an object into an array | low | 2.2 | 0% |
| CVE-2024-51755 | twig/twig | Twig has unguarded calls to `__isset()` and to array-accesses when the sandbox is enabled | low | 2.2 | 0% |
| CVE-2026-72782 | craftcms/cms | Craft CMS: Authenticated leak of secret environment variables | medium | 0.0 | 0% |
| CVE-2026-46723 | tpwd/ke_search | TYPO3 ke_search path traversal from arbitrary table configuration input | medium | 0.0 | 0% |
| GHSA-88rc-3p98-rgvx | shopware/core, shopware/platform | After order payment process manipulation in shopware/platform and shopware/core | critical | 0.0 | – |
| GHSA-qg7c-q3vq-rgxr | shopware/core, shopware/platform | Leak of information via Store-API aggregations in shopware/platform and shopware/core | critical | 0.0 | – |