Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-41800 | mediawiki/core | MediaWiki allows a denial of service | medium | 5.3 | 2% |
| CVE-2022-36104 | typo3/cms, typo3/cms-core | TYPO3 CMS vulnerable to Denial of Service in Page Error Handling | medium | 5.9 | 2% |
| CVE-2021-20185 | moodle/moodle | Moodle Client side denial of service via personal message | medium | 5.3 | 1% |
| CVE-2023-3566 | wallabag/wallabag | Wallabag vulnerable to Allocation of Resources Without Limits or Throttling | medium | 6.5 | 1% |
| CVE-2020-12697 | directmailteam/direct-mail | Denial of service in direct_mail | medium | 5.3 | 1% |
| CVE-2023-38492 | getkirby/cms | Denial of service from unlimited password lengths | medium | 5.3 | 1% |
| CVE-2022-43686 | concrete5/concrete5 | Concrete CMS vulnerable to Uncontrolled Resource Consumption leading to DoS | medium | 6.5 | 1% |
| CVE-2021-32476 | moodle/moodle | Moodle denial-of-service risk in the draft files area | high | 7.5 | 1% |
| CVE-2023-28104 | silverstripe/graphql | DDOS attack on graphql endpoints | high | 7.5 | 1% |
| CVE-2024-25978 | moodle/moodle | Uncontrolled Resource Consumption in moodle | high | 7.5 | 1% |
| CVE-2026-59942 | dompdf/dompdf | Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps | medium | 0.0 | 1% |
| CVE-2024-32871 | pimcore/pimcore | Flooding Server with Thumbnail files | high | 7.5 | 1% |
| CVE-2024-24752 | bref/bref | Bref's Uploaded Files Not Deleted in Event-Driven Functions | medium | 6.5 | 1% |
| CVE-2023-2666 | froxlor/froxlor | Froxlor vulnerable to Allocation of Resources Without Limits or Throttling | medium | 6.5 | 1% |
| CVE-2026-33483 | wwbn/avideo | AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php | high | 7.5 | 1% |
| CVE-2026-53965 | mcp/sdk | MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter | high | 0.0 | 1% |
| CVE-2023-46745 | librenms/librenms | LibreNMS vulnerable to rate limiting bypass on login page | medium | 5.3 | 1% |
| CVE-2025-68456 | craftcms/cms | Unauthenticated Craft CMS users can trigger a database backup | high | 0.0 | 1% |
| CVE-2026-49209 | symfony/ux-live-component | symfony/ux-live-component: Denial of service via unbounded batch action requests | low | 0.0 | 1% |
| CVE-2025-71418 | pocketmine/pocketmine-mp | PocketMine-MP allows malicious client data to waste server resources due to lack of limits for explode() | medium | 5.3 | 1% |
| CVE-2026-46629 | twig/intl-extra | twig/intl-extra: Unbounded formatter memoisation in keyed on template-controlled arguments | low | 0.0 | 1% |
| CVE-2026-107379 | enshrined/svg-sanitize | enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash | medium | 6.5 | 1% |
| CVE-2026-53653 | getgrav/grav | Grav: Unauthenticated denial of service via unbounded image derivative dimensions | high | 0.0 | 1% |
| CVE-2026-26047 | moodle/moodle | Moodle TeX formula editor is vulnerable to DoS through lack of execution time limits | medium | 6.5 | 1% |
| CVE-2026-61609 | pterodactyl/panel | Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS) | high | 7.5 | 0% |
| CVE-2025-71417 | pocketmine/pocketmine-mp | PocketMine-MP `ResourcePackDataInfoPacket` amplification vulnerability due to lack of resource pack sequence status checking | high | 0.0 | 0% |
| CVE-2026-86204 | pocketmine/pocketmine-mp | PocketMine-MP: JSON decoding of unlimited size large arrays/objects in ModalFormResponse Handling | high | 0.0 | 0% |
| CVE-2026-104827 | react/http | react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS | high | 7.5 | 0% |
| CVE-2026-67353 | guzzlehttp/guzzle | Guzzle: Unbounded response cookies risk denial of service | medium | 5.3 | 0% |
| CVE-2025-46556 | mantisbt/mantisbt | MantisBT Vulnerable to Denial-of-Service (DoS) via Excessive Note Length | medium | 6.5 | 0% |
| CVE-2026-49870 | snipe/snipe-it | Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor` | medium | 5.9 | 0% |
| CVE-2026-40863 | phpoffice/phpspreadsheet | PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader | high | 7.5 | 0% |
| CVE-2026-40902 | phpoffice/phpspreadsheet | PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions | high | 7.5 | 0% |
| CVE-2025-54869 | setasign/fpdi | FPDI allows Memory Exhaustion (OOM) in PDF Parser which leads to Denial of Service | medium | 0.0 | 0% |
| CVE-2025-48448 | drupal/admin_audit_trail | The Admin Audit Trail module tracks logs of specific events that you'd like to review. When the submodule Admin Audit Tr | high | 7.5 | 0% |
| CVE-2026-33541 | miraheze/ts-portal | TSPortal's Uncontrolled User Creation via Validation Side Effects Leads to Potential Denial of Service | medium | 6.5 | 0% |
| CVE-2026-30662 | concrete5/concrete5 | ConcreteCMS is vulnerable to Denial of Service During Bulk Downloads | medium | 6.5 | 0% |
| CVE-2026-107843 | contao/core-bundle | Contao: The registration module re-sends activation mails | medium | 5.3 | 0% |
| CVE-2026-45802 | setasign/fpdi | FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service | medium | 0.0 | 0% |
| CVE-2026-35202 | pterodactyl/panel | Pterodactyl has a database resource limit bypass via race condition in Client API | low | 0.0 | 0% |
| GHSA-w8gf-g2vq-j2f4 | amphp/http-client | amphp/http-client Denial of Service via HTTP/2 CONTINUATION Frames | high | 8.2 | – |
| GHSA-g585-crjf-vhwq | typo3/cms | TYPO3 Denial of Service in Frontend Record Registration | high | 7.5 | – |
| GHSA-hjx5-v9xg-7h25 | typo3/cms-core | TYPO3 Denial of Service in Frontend Record Registration | high | 7.5 | – |
| GHSA-f3wf-q4fj-3gxf | typo3/cms | TYPO3 Denial of Service in Online Media Asset Handling | medium | 6.5 | – |
| GHSA-29m4-mx89-3mjg | typo3/cms-core | TYPO3 Denial of Service in Online Media Asset Handling | medium | 5.3 | – |
| GHSA-3prj-6hqw-cm82 | web-token/jwt-framework, web-token/jwt-library | PHP JWT Library: PBES2-HS*+A*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of service | high | 0.0 | – |
| GHSA-58q2-9x27-h2jm | solspace/craft-freeform | solspace/craft-freeform Has a DoS Vulnerability | low | 0.0 | – |