Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24602 | hm-multiple-roles (WordPress plugin) | The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin | high | 8.8 | 2% |
| CVE-2026-35542 | roundcube/roundcubemail | Roundcube: Bypass of remote image blocking via crafted BODY background attribute | medium | 5.3 | 0% |
| CVE-2026-35543 | roundcube/roundcubemail | Roundcube Webmail: Bypass of remote image blocking via SVG content (with animate attributes) in an e-mail message | medium | 5.3 | 0% |
| CVE-2026-35545 | roundcube/roundcubemail | Roundcube Webmail: Remote image blocking feature can be bypassed via SVG content in an e-mail message | medium | 5.3 | 0% |
| CVE-2026-35540 | roundcube/roundcubemail | Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages | medium | 5.4 | 0% |
| CVE-2026-35544 | roundcube/roundcubemail | Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages | medium | 5.3 | 0% |