Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-13485 | verbb/knock-knock | Knock Knock plugin IP Whitelist bypass via an X-Forwarded-For HTTP header | critical | 9.1 | 1% |
| CVE-2020-23355 | codiad/codiad | Codiad Vulnerable to PHP Magic Hash Vulnerability | high | 7.5 | 1% |
| CVE-2024-56522 | tecnickcom/tcpdf | TCPDF has incorrect comparison | high | 7.5 | 1% |
| CVE-2024-6641 | wp-security-hardening (WordPress plugin) | The WP Hardening – Fix Your WordPress Security plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and incl | medium | 5.3 | 0% |
| CVE-2025-47776 | mantisbt/mantisbt | MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling | critical | 9.1 | 0% |