Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2013-2010 | w3-total-cache (WordPress plugin), wp-super-cache (WordPress plugin) | WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability | critical | 9.8 | 74% |
| CVE-2020-9757 | nystudio107/craft-seomatic | SEOmatic for CraftCMS allows Server-Side Template Injection | critical | 9.8 | 73% |
| CVE-2024-50340 | symfony/runtime, symfony/symfony | Symfony allows changing the environment through a query | high | 7.3 | 64% |
| CVE-2023-43661 | cachethq/cachet | Cachet vulnerable to Authenticated Remote Code Execution | critical | 9.1 | 52% |
| CVE-2020-28948 | pear/archive_tar, drupal/core | Multiple vulnerabilities through filename manipulation in Archive_Tar | high | 7.8 | 47% |
| CVE-2018-14009 | codiad/codiad | Codiad remote code execution vulnerability | critical | 9.8 | 38% |
| CVE-2023-4197 | dolibarr/dolibarr | Dolibarr Improper Input Validation vulnerability | high | 7.5 | 36% |
| CVE-2020-15227 | nette/application, nette/nette | Potential Remote Code Execution vulnerability | high | 8.7 | 34% |
| CVE-2017-5630 | pear/pear | PEAR core file overwrite vulnerability | high | 7.5 | 13% |
| CVE-2022-21705 | october/system | Authenticated remote code execution in October CMS | high | 7.2 | 9% |
| CVE-2015-8566 | joomla/session | Joomla! Framework Remote Code Injection Vulnerability | high | 0.0 | 8% |
| CVE-2022-23614 | twig/twig | Code injection in Twig | high | 8.8 | 8% |
| CVE-2014-4172 | jasig/phpcas | Jasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerability | critical | 9.8 | 6% |
| CVE-2022-21663 | WordPress core | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with | medium | 6.6 | 4% |
| CVE-2022-25866 | czproject/git-php | Command injection in czproject/git-php | high | 8.1 | 4% |
| CVE-2021-36022 | magento/community-edition, magento/project-community-edition | Magento XML Injection vulnerability in the Widgets Update Layout | high | 7.2 | 3% |
| CVE-2015-7809 | twig/twig | Twig remote code execution in templates | high | 8.1 | 3% |
| CVE-2016-10131 | bcit-ci/codeigniter | CodeIgniter arbitrary code execution | critical | 9.8 | 3% |
| CVE-2015-5227 | landing-pages (WordPress plugin) | The Landing Pages plugin before 1.9.2 for WordPress allows remote attackers to execute arbitrary code via the url parameter. | high | 8.8 | 3% |
| CVE-2021-27903 | craftcms/cms | Craft CMS Remote Code Injection | critical | 9.8 | 3% |
| CVE-2023-37897 | getgrav/grav | grav Server-side Template Injection (SSTI) mitigation bypass | high | 7.2 | 3% |
| CVE-2020-17952 | topthink/think | Code injection in topthink/think | critical | 9.8 | 2% |
| CVE-2019-8135 | magento/community-edition, magento/product-community-edition | Remote code execution via vulnerable Symphony dependecy injection | critical | 9.8 | 2% |
| CVE-2017-18605 | gravitate-qa-tracker (WordPress plugin) | The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection. | critical | 9.8 | 2% |
| CVE-2023-40035 | craftcms/cms | Craft CMS vulnerable to Remote Code Execution via validatePath bypass | high | 7.2 | 2% |
| CVE-2020-15277 | baserproject/basercms | Edit template, Remote Code Execution (RCE) Vulnerability in Latest Release 4.4.0 | high | 7.2 | 2% |
| CVE-2021-3603 | phpmailer/phpmailer | PHPMailer untrusted code may be run from an overridden address validator | high | 8.1 | 2% |
| CVE-2020-12790 | nystudio107/craft-seomatic | SEOmatic for CraftCMS allows Server-Side Template Injection | high | 7.5 | 2% |
| CVE-2017-18634 | newspaper (WordPress theme) | The newspaper theme before 6.7.2 for WordPress has script injection via td_ads[header] to admin-ajax.php. | critical | 9.8 | 2% |
| CVE-2020-15146 | sylius/resource-bundle | Remote Code Execution in SyliusResourceBundle | critical | 9.6 | 2% |
| CVE-2020-5203 | bcosca/fatfree | Fat-Free Framework arbitrary code execution | critical | 9.8 | 2% |
| CVE-2021-32650 | october/system | october/system arbitrary code execution | high | 8.8 | 2% |
| CVE-2017-18583 | post-pay-counter (WordPress plugin) | The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection. | critical | 9.8 | 2% |
| CVE-2020-15515 | marcwillmann/turn | Remote code execution in turn extension for TYPO3 | high | 8.8 | 2% |
| CVE-2020-15143 | sylius/resource-bundle | Remote Code Execution in SyliusResourceBundle | high | 7.7 | 2% |
| CVE-2023-32679 | craftcms/cms | Craft CMS vulnerable to Remote Code Execution via unrestricted file extension | high | 7.2 | 2% |
| CVE-2021-24948 | the-plus-addons-for-elementor (WordPress plugin) | The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not validate the qvquery parameter of the tp_get_dl_post_info_ajax AJ | high | 7.5 | 2% |
| CVE-2021-29454 | smarty/smarty | Sandbox Escape by math function in smarty | high | 8.1 | 2% |
| CVE-2022-21829 | concrete5/core | Code injection in concrete CMS | high | 8.0 | 2% |
| CVE-2022-29712 | librenms/librenms | Command injection in librenms | high | 0.0 | 2% |
| CVE-2018-6519 | simplesamlphp/saml2 | SimpleSAMLphp SAML2 library Regular Expression Denial of Service vulnerability | high | 7.5 | 2% |
| CVE-2017-18604 | sitebuilder-dynamic-components (WordPress plugin) | The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request. | high | 7.5 | 2% |
| CVE-2021-21263 | illuminate/database, laravel/framework | Query Binding Exploitation | high | 7.2 | 2% |
| CVE-2021-25994 | userfrosting/userfrosting | Injection in UserFrosting | high | 8.8 | 2% |
| CVE-2021-41170 | neoan3-apps/template | Insecure Inherited Permissions in neoan3-apps/template | high | 7.5 | 2% |
| CVE-2016-5701 | phpmyadmin/phpmyadmin | phpMyAdmin vulnerable to Cross-site Scripting | medium | 6.1 | 2% |
| CVE-2022-33011 | idno/known | Known vulnerable to account takeover via host header injection attack in v1.3.1 | high | 8.8 | 2% |
| CVE-2023-43655 | composer/composer | Composer Remote Code Execution vulnerability via web-accessible composer.phar | high | 8.8 | 2% |
| CVE-2019-10665 | librenms/librenms | LibreNMS Information Disclosure | critical | 9.8 | 1% |
| CVE-2022-33012 | microweber/microweber | Account Takeover Through Password Reset Poisoning | high | 8.8 | 1% |