Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2015-5161 | zendframework/zendframework, zendframework/zendframework1, zendframework/zendxml | ZendXml and Zend Framework contain XXE and XEE Vulnerabilities | medium | 0.0 | 10% |
| CVE-2012-6531 | zendframework/zendframework1 | Zend Framework XEE Vulnerability | medium | 0.0 | 3% |
| CVE-2014-2683 | zendframework/zendframework1, zendframework/zendopenid, zendframework/zendrest +7 more | Several Zend Products Vulnerable to XXE and XEE attacks | medium | 0.0 | 2% |
| CVE-2014-2682 | zendframework/zendframework1, zendframework/zendopenid, zendframework/zendrest +7 more | Several Zend Products Vulnerable to XXE and XEE attacks | medium | 0.0 | 2% |
| CVE-2012-6532 | zendframework/zendframework1 | Zend Framework XEE Vulnerability | medium | 0.0 | 2% |
| CVE-2021-41559 | silverstripe/framework | Quadratic blowup in Convert::xml2array() | medium | 6.5 | 1% |
| CVE-2019-8126 | magento/community-edition, magento/product-community-edition | Information disclosure through processing of external XML entities | medium | 4.9 | 1% |
| CVE-2026-45304 | symfony/symfony, symfony/yaml | Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs") | low | 0.0 | 1% |
| CVE-2026-45133 | symfony/symfony, symfony/yaml | Symfony hardened the parser when handling untrusted input | low | 0.0 | 1% |
| CVE-2026-108358 | phpoffice/phpspreadsheet | PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service | high | 0.0 | 0% |
| CVE-2026-108357 | phpoffice/phpspreadsheet | PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service | high | 0.0 | 0% |
| GHSA-8x2v-pcg7-94f4 | zendframework/zend-json | Zend-JSON vulnerable to XXE/XEE attacks | critical | 9.8 | – |
| GHSA-f4fj-q6m4-cc52 | zendframework/zend-xmlrpc | ZendFramework vulnerable to XXE/XEE attacks | critical | 9.8 | – |
| GHSA-mhpx-3rv8-wrjm | zendframework/zendframework1 | ZendFramework potential XML eXternal Entity injection vectors | critical | 9.8 | – |
| GHSA-qc7w-4567-84wv | zendframework/zendframework | Zendframework vulnerable to XXE/XEE attacks | critical | 9.8 | – |
| GHSA-2jx7-xg83-j2m7 | zendframework/zendframework1 | Zendframework Denial of Service vector via XEE injection | high | 7.5 | – |
| GHSA-4vf2-qfg3-7598 | symfony/validator | symfony/validator XML Entity Expansion vulnerability | high | 7.5 | – |
| GHSA-f75p-x5vm-83qp | symfony/translation | symfony/translation XML Entity Expansion vulnerability | high | 7.5 | – |
| GHSA-q2gc-gg3x-7942 | symfony/symfony | Symfony XML Entity Expansion security vulnerability | high | 7.5 | – |
| GHSA-g43w-98wp-m694 | silverstripe/framework | SilverStripe framework XML Quadratic Blowup Attack | medium | 5.3 | – |