Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2020-24914 | qcubed/qcubed | qcubed PHP object injection | critical | 9.8 | 5% |
| CVE-2018-19296 | phpmailer/phpmailer | Phar object injection in PHPMailer | high | 8.8 | 2% |
| CVE-2020-11066 | typo3/cms, typo3/cms-core | Class destructors causing side-effects when being unserialized in TYPO3 CMS | high | 8.7 | 2% |
| CVE-2024-55638 | drupal/core, drupal/core-recommended, drupal/drupal | Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead t | critical | 9.8 | 1% |
| CVE-2024-55636 | drupal/core, drupal/core-recommended, drupal/drupal | Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead t | critical | 9.8 | 1% |
| CVE-2024-55637 | drupal/core, drupal/core-recommended, drupal/drupal | Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead t | critical | 9.8 | 1% |
| CVE-2026-72778 | craftcms/cms | Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass | high | 0.0 | 1% |
| CVE-2026-27591 | winter/wn-backend-module | Winter vulnerable to privilege escalation by authenticated backend users | critical | 9.9 | 1% |
| CVE-2025-31674 | drupal/core | Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead t | medium | 0.0 | 1% |
| CVE-2026-76086 | verbb/formie | Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials | high | 8.5 | 1% |
| CVE-2025-15602 | snipe/snipe-it | Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment | high | 8.8 | 0% |
| CVE-2026-50281 | craftcms/cms | Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements | high | 0.0 | 0% |
| CVE-2026-6366 | drupal/core | Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists | medium | 6.6 | 0% |
| CVE-2026-28781 | craftcms/cms | Craft CMS: Entries Authorship Spoofing via Mass Assignment | medium | 0.0 | 0% |
| CVE-2025-13081 | drupal/core | Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the | medium | 5.9 | 0% |
| CVE-2026-40486 | kimai/kimai | Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate | medium | 4.3 | 0% |
| CVE-2025-49597 | handcraftedinthealps/goodby-csv | handcraftedinthealps/goodby-csv has Potential Gadget Chain allowing Remote Code Execution | low | 3.9 | 0% |
| GHSA-2jx3-65f3-xr8r | spomky-labs/otphp | spomky-labs/otphp: Mass-assignment in Factory::loadFromProvisioningUri lets a hostile provisioning URI corrupt OTP state or leak an uncaught | medium | 0.0 | – |