Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2023-45363 | mediawiki/core | MediaWiki Denial of Service vulnerability | high | 7.5 | 24% |
| CVE-2019-18981 | pimcore/pimcore | Pimcore Access Control Issues | critical | 9.8 | 1% |
| CVE-2026-43871 | apache/thrift | Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop | high | 7.5 | 1% |
| CVE-2023-23617 | openmage/magento-lts | DoS vulnerability in MaliciousCode filter | medium | 4.9 | 1% |
| CVE-2024-0842 | backuply (WordPress plugin) | The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Denial of Service in all versions up to, and includi | high | 7.5 | 1% |
| CVE-2023-27560 | phpseclib/phpseclib | phpseclib Infinite Loop vulnerability | high | 7.5 | 1% |
| CVE-2023-49316 | phpseclib/phpseclib | Phpseclib needs guardrails on large binaryfield integers | high | 7.5 | 1% |
| CVE-2024-29904 | codeigniter4/framework | CodeIgniter4 DoS Vulnerability | high | 7.5 | 1% |
| CVE-2026-84997 | react/http | react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU | high | 7.5 | 1% |
| CVE-2024-11941 | drupal/core | The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests th | high | 7.5 | 0% |
| CVE-2026-42609 | getgrav/grav | Grav Vulnerable to Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic | high | 8.1 | 0% |
| CVE-2026-59933 | phpoffice/phpspreadsheet | PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion | high | 7.5 | 0% |
| CVE-2026-56396 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards | high | 8.1 | 0% |
| CVE-2026-49276 | getkirby/cms | Kirby: Self cross-site scripting (self-XSS) in the writer field | high | 0.0 | 0% |
| CVE-2024-34006 | moodle/moodle | Moodle Unsanitized HTML in site log for config_log_created | medium | 4.3 | 0% |
| CVE-2026-8245 | concrete5/concrete5 | Concrete CMS is Vulnerable to Reflected XSS in Legacy Pagination | medium | 0.0 | 0% |