Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-45411 | twig/twig | Twig has a possible sandbox bypass | high | 8.5 | 1% |
| CVE-2026-79774 | winter/wn-system-module | Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149) | high | 8.4 | 1% |
| CVE-2026-72781 | craftcms/cms | Craft CMS: Authenticated RCE through Twig sandbox escape | high | 0.0 | 1% |
| CVE-2014-125107 | corveda/phpsandbox | Corveda PHPSandbox Protection Mechanism Failure vulnerability | medium | 4.3 | 1% |
| CVE-2026-24425 | twig/twig | Twig: Possible sandbox bypass when using a source policy | high | 8.8 | 1% |
| CVE-2023-0085 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to reCaptcha Bypass in versions up to, and including, 3.2.1. T | medium | 5.3 | 1% |
| CVE-2026-46634 | twig/twig | Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name | medium | 0.0 | 1% |
| CVE-2024-0681 | page-and-post-restriction (WordPress plugin) | The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to information disclosure in all versions up | medium | 5.3 | 1% |
| CVE-2024-0680 | wp-private-content-plus (WordPress plugin) | The WP Private Content Plus plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 3.6. This is | medium | 5.3 | 1% |
| CVE-2024-0682 | pagerestrict (WordPress plugin) | The Page Restrict plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 2.5.5. This is due to t | medium | 5.3 | 0% |
| CVE-2026-48805 | twig/twig | Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php` | low | 0.0 | 0% |
| CVE-2026-45697 | verbb/formie | Formie: Pre-authenticated server-side template injection in Hidden fields | critical | 9.8 | 0% |
| CVE-2026-46638 | twig/twig | Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411) | medium | 0.0 | 0% |
| CVE-2024-13794 | hide-my-wp (WordPress plugin) | The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Login Page Dislcosure in all versions up to, and | medium | 5.3 | 0% |
| CVE-2026-80198 | kimai/kimai | Kimai's Twig function config() leaks server-wide secrets (LDAP bind password, SAML SP private key) via invoice/export templates | medium | 0.0 | 0% |
| CVE-2026-48806 | twig/twig | Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys | medium | 0.0 | 0% |
| CVE-2026-48808 | twig/twig | Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface` | medium | 0.0 | 0% |
| CVE-2026-22692 | october/rain | October Rain has a Twig Sandbox Bypass via Collection Methods | medium | 4.9 | 0% |
| CVE-2026-46639 | twig/twig | Twig: Sandbox property and method bypass via object-destructuring assignment | high | 0.0 | 0% |
| CVE-2026-48807 | twig/twig | Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters | medium | 0.0 | 0% |
| CVE-2026-49981 | twig/twig | Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template` | high | 0.0 | 0% |
| CVE-2022-4100 | wp-cerber (WordPress plugin) | The WP Cerber Security plugin for WordPress is vulnerable to IP Protection bypass in versions up to, and including 9.4 due to the plugin imp | medium | 5.3 | 0% |
| CVE-2024-38874 | jweiland/events2 | events2 TYPO3 extension insecure direct object reference (IDOR) vulnerability | medium | 5.4 | 0% |