Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2019-14537 | yourls/yourls | Access of Resource Using Incompatible Type ('Type Confusion') in yourls/yourls | critical | 9.8 | 6% |
| CVE-2021-26600 | impresscms/impresscms | Type Confusion in ImpressCMS | critical | 9.8 | 6% |
| CVE-2019-17675 | WordPress core | WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CS | high | 8.8 | 3% |
| CVE-2022-1176 | remdex/livehelperchat | Type Confusion in LiveHelperChat | high | 7.5 | 1% |
| CVE-2021-46743 | firebase/php-jwt | Firebase PHP-JWT key/algorithm type confusion | critical | 9.1 | 1% |
| CVE-2024-56522 | tecnickcom/tcpdf | TCPDF has incorrect comparison | high | 7.5 | 1% |
| CVE-2026-54164 | api-platform/core | API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion) | medium | 6.5 | 0% |
| CVE-2026-35541 | roundcube/roundcubemail | Roundcube Webmail: Incorrect password comparison in the password plugin | medium | 4.2 | 0% |