Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-0666 | microweber/microweber | CRLF Injection in microweber | high | 7.6 | 44% |
| CVE-2021-39172 | cachethq/cachet | Cachet vulnerable to new line injection during configuration edition | high | 8.8 | 29% |
| CVE-2007-4190 | joomla/application | Joomla! vulnerable to CRLF injection | medium | 0.0 | 2% |
| CVE-2011-4203 | moodle/moodle | Moodle CRLF Injection Vulnerability in Calendar Component | medium | 0.0 | 1% |
| CVE-2021-4097 | phpservermon/phpservermon | phpservermon is vulnerable to CRLF Injection | medium | 6.3 | 1% |
| CVE-2026-84372 | predis/predis | Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections | critical | 9.8 | 1% |
| CVE-2026-45067 | symfony/mime, symfony/symfony | Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address | high | 0.0 | 1% |
| CVE-2026-77634 | cakephp/cakephp | CakePHP: SmtpTransport vulnerable to CRLF header injection | high | 0.0 | 1% |
| CVE-2026-39394 | ci4-cms-erp/ci4ms | CI4MS Vulnerable to .env CRLF Injection via Unvalidated `host` Parameter in Install Controller | high | 8.1 | 1% |
| CVE-2026-48019 | laravel/framework, illuminate/mail | Laravel Framework: CRLF injection in default email rule | high | 8.9 | 1% |
| CVE-2026-50188 | getkirby/cms | Kirby: Request header injection in `Http\Remote` | medium | 0.0 | 0% |
| CVE-2026-45070 | symfony/mime, symfony/symfony | Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names | medium | 0.0 | 0% |
| CVE-2026-41230 | froxlor/froxlor | Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add() | high | 8.5 | 0% |
| CVE-2026-55766 | guzzlehttp/psr7 | guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization | medium | 4.8 | 0% |
| CVE-2026-43882 | wwbn/avideo | AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing | medium | 4.3 | 0% |
| CVE-2026-41570 | phpunit/phpunit | PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes | high | 7.8 | 0% |
| CVE-2026-49214 | guzzlehttp/psr7 | guzzlehttp/psr7 has CRLF Injection via URI Host Component | medium | 5.3 | 0% |
| CVE-2026-61815 | zbateson/mail-mime-parser | zbateson/mail-mime-parser has CRLF header injection via attachment filename | high | 7.2 | 0% |
| GHSA-mh6w-vxff-9wqp | phpunit/phpunit | PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes | high | 7.8 | – |