PHP vulnerability advisories

Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.

19,303CVEs

8,638Composer advisories

12,328WordPress advisories

35Actively exploited (KEV) →

CVE	Package	Title	Severity	CVSS	EPSS
CVE-2013-5958	symfony/polyfill, symfony/polyfill-php55, symfony/security +1 more	Symfony Denial of Service Via Long Password Hashing	medium	0.0	2%
CVE-2026-108359	phpoffice/phpspreadsheet	PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)	high	0.0	0%
GHSA-w8gf-g2vq-j2f4	amphp/http-client	amphp/http-client Denial of Service via HTTP/2 CONTINUATION Frames	high	8.2	–

Severity and CVSS come from the upstream advisory (OSV.dev, NVD, FriendsOfPHP); KEV marks CVEs on CISA's Known Exploited Vulnerabilities list; EPSS is FIRST's 30-day exploitation probability. Rows sort exploitation-first: KEV, then EPSS, then CVSS.