Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2016-10033 KEV | phpmailer/phpmailer | Remote code execution via crafted Sender in the isMail transport | critical | 9.8 | 100% |
| CVE-2022-39986 | billz/raspap-webgui | RaspAP Command Injection vulnerability | critical | 9.8 | 99% |
| CVE-2016-10045 | phpmailer/phpmailer | Remote code execution in PHPMailer | critical | 9.8 | 98% |
| CVE-2023-0315 | froxlor/froxlor | Froxlor vulnerable to Command Injection | high | 8.8 | 98% |
| CVE-2016-10074 | swiftmailer/swiftmailer | Swift Mailer mail transport Command Injection | critical | 9.8 | 44% |
| CVE-2016-10034 | zendframework/zend-mail | zend-mail remote code execution via Sendmail adapter | critical | 9.8 | 38% |
| CVE-2022-39987 | billz/raspap-webgui | RaspAP Command Injection vulnerability | high | 8.8 | 37% |
| CVE-2022-26265 | contao/managed-edition | Remote Code Execution in Contao Managed Edition | critical | 9.8 | 30% |
| CVE-2021-38556 | billz/raspap-webgui | Command Injection in RaspAP 2.6.6 | high | 8.8 | 13% |
| CVE-2015-5161 | zendframework/zendframework, zendframework/zendframework1, zendframework/zendxml | ZendXml and Zend Framework contain XXE and XEE Vulnerabilities | medium | 0.0 | 10% |
| CVE-2014-1905 | videowhisper-live-streaming-integration (WordPress plugin) | Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPr | high | 10.0 | 10% |
| CVE-2023-6634 | learnpress (WordPress plugin) | The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content fun | high | 8.1 | 9% |
| CVE-2015-1561 | centreon/centreon | Centreon Command Injection | high | 8.5 | 8% |
| CVE-2020-35136 | dolibarr/dolibarr | Dolibarr authenticated Remote Code Execution | high | 7.2 | 7% |
| CVE-2023-32073 | wwbn/avideo | WWBN AVideo command injection vulnerability | high | 8.8 | 6% |
| CVE-2015-7806 | form-manager (WordPress plugin) | Eval injection vulnerability in the fm_saveHelperGatherItems function in ajax.php in the Form Manager plugin before 1.7.3 for WordPress allo | critical | 9.8 | 6% |
| CVE-2022-25866 | czproject/git-php | Command injection in czproject/git-php | high | 8.1 | 4% |
| CVE-2014-5014 | wordpress-flash-uploader (WordPress plugin) | The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to | critical | 9.8 | 4% |
| CVE-2014-3114 | ezpz-one-click-backup (WordPress plugin) | The EZPZ One Click Backup (ezpz-one-click-backup) plugin 12.03.10 and earlier for WordPress allows remote attackers to execute arbitrary com | critical | 9.8 | 3% |
| CVE-2024-35242 | composer/composer | Composer has multiple command injections via malicious git/hg branch names | high | 8.8 | 3% |
| CVE-2020-13664 | drupal/core, drupal/drupal | Drupal 8 and 9 have a remote code execution vulnerability under certain circumstances. An attacker could trick an admin | high | 8.8 | 3% |
| CVE-2021-36024 | magento/community-edition, magento/project-community-edition | Magento is affected by an os command injection via the Data collection endpoint | high | 7.2 | 3% |
| CVE-2021-41116 | composer/composer | Improper escaping of command arguments on Windows leading to command injection | high | 8.2 | 3% |
| CVE-2015-4336 | xcloner (WordPress plugin) | cloner.functions.php in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to execute arbitrary commands via a file co | medium | 6.5 | 3% |
| CVE-2012-6531 | zendframework/zendframework1 | Zend Framework XEE Vulnerability | medium | 0.0 | 3% |
| CVE-2023-30260 | billz/raspap-webgui | RaspAP raspap-webgui Command Injection vulnerability | high | 8.8 | 2% |
| CVE-2021-37708 | shopware/core, shopware/platform | Command injection in mail agent settings | high | 8.8 | 2% |
| CVE-2014-2683 | zendframework/zendframework1, zendframework/zendopenid, zendframework/zendrest +7 more | Several Zend Products Vulnerable to XXE and XEE attacks | medium | 0.0 | 2% |
| CVE-2016-6609 | phpmyadmin/phpmyadmin | phpMyAdmin PHP code injection | high | 8.8 | 2% |
| CVE-2026-41304 | wwbn/avideo | WWBN AVideo: RCE cause by clonesite plugin | critical | 9.8 | 2% |
| CVE-2014-2682 | zendframework/zendframework1, zendframework/zendopenid, zendframework/zendrest +7 more | Several Zend Products Vulnerable to XXE and XEE attacks | medium | 0.0 | 2% |
| CVE-2024-22188 | typo3/cms-core | TYPO3 Install Tool vulnerable to Code Execution | high | 7.2 | 2% |
| CVE-2021-41800 | mediawiki/core | MediaWiki allows a denial of service | medium | 5.3 | 2% |
| CVE-2012-6532 | zendframework/zendframework1 | Zend Framework XEE Vulnerability | medium | 0.0 | 2% |
| CVE-2023-1877 | microweber/microweber | Microweber vulnerable to command injection | medium | 6.1 | 2% |
| CVE-2016-10762 | camptix (WordPress plugin) | The CampTix Event Ticketing plugin before 1.5 for WordPress allows CSV injection when the export tool is used. | high | 7.5 | 2% |
| CVE-2026-53932 | wnx/laravel-backup-restore | laravel-backup-restore has an OS Command Injection during database restore | high | 8.0 | 2% |
| CVE-2023-0789 | thorsten/phpmyfaq | Command Injection in thorsten/phpmyfaq | critical | 9.8 | 2% |
| CVE-2022-36104 | typo3/cms, typo3/cms-core | TYPO3 CMS vulnerable to Denial of Service in Page Error Handling | medium | 5.9 | 2% |
| CVE-2026-55182 | librenms/librenms | LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module | high | 0.0 | 2% |
| CVE-2021-20185 | moodle/moodle | Moodle Client side denial of service via personal message | medium | 5.3 | 1% |
| CVE-2023-3566 | wallabag/wallabag | Wallabag vulnerable to Allocation of Resources Without Limits or Throttling | medium | 6.5 | 1% |
| CVE-2021-39217 | openmage/magento-lts | Fix for arbitrary command execution in custom layout update through blocks | high | 7.2 | 1% |
| CVE-2020-12697 | directmailteam/direct-mail | Denial of service in direct_mail | medium | 5.3 | 1% |
| CVE-2021-41143 | openmage/magento-lts | Fix for arbitrary file deletion in customer media allows for remote code execution | high | 7.2 | 1% |
| CVE-2023-6999 | pods (WordPress plugin) | The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Remote Code Exxecution via shortcode in all versions up to, | high | 8.8 | 1% |
| CVE-2021-41231 | openmage/magento-lts | DataFlow upload remote code execution vulnerability | high | 7.2 | 1% |
| CVE-2023-38492 | getkirby/cms | Denial of service from unlimited password lengths | medium | 5.3 | 1% |
| CVE-2021-41144 | openmage/magento-lts | Fix for authenticated remote code execution through layout update | high | 8.8 | 1% |
| CVE-2022-43686 | concrete5/concrete5 | Concrete CMS vulnerable to Uncontrolled Resource Consumption leading to DoS | medium | 6.5 | 1% |