Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2016-10033 KEV | phpmailer/phpmailer | Remote code execution via crafted Sender in the isMail transport | critical | 9.8 | 100% |
| CVE-2024-52301 | laravel/framework | Laravel environment manipulation via query string | high | 0.0 | 45% |
| CVE-2023-6634 | learnpress (WordPress plugin) | The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content fun | high | 8.1 | 9% |
| CVE-2020-35136 | dolibarr/dolibarr | Dolibarr authenticated Remote Code Execution | high | 7.2 | 7% |
| CVE-2021-29472 | composer/composer | Composer's missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial | high | 8.8 | 5% |
| CVE-2019-18888 | symfony/http-foundation, symfony/mime, symfony/symfony | Argument injection in a MimeTypeGuesser in Symfony | high | 7.5 | 2% |
| CVE-2022-24828 | composer/composer | Missing input validation can lead to command execution in composer | high | 8.3 | 2% |
| CVE-2025-32931 | tcg/voyager | DevDojo Voyager Argument Injection vulnerability | critical | 9.1 | 1% |
| CVE-2026-45068 | symfony/mailer, symfony/symfony | Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address | medium | 0.0 | 1% |
| CVE-2022-4864 | froxlor/froxlor | Froxlor vulnerable to Argument Injection | medium | 5.4 | 0% |
| CVE-2026-35538 | roundcube/roundcubemail | Roundcube Webmail: Unsanitized IMAP SEARCH command arguments | low | 3.1 | 0% |
| CVE-2026-24739 | symfony/process, symfony/symfony | Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows | medium | 6.3 | 0% |
| CVE-2026-41570 | phpunit/phpunit | PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes | high | 7.8 | 0% |
| GHSA-g3hq-hphg-8fhh | pheditor/pheditor | Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixe | high | 8.8 | – |
| GHSA-mh6w-vxff-9wqp | phpunit/phpunit | PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes | high | 7.8 | – |
| GHSA-q7qq-9gx2-ggxv | phpxmlrpc/phpxmlrpc | phpxmlrpc vulnerable to argument injection | medium | 0.0 | – |