Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-25513 | facturascripts/facturascripts | FacturaScripts has SQL Injection in API ORDER BY Clause | high | 0.0 | 1% |
| CVE-2026-25514 | facturascripts/facturascripts | FacturaScripts has SQL Injection in Autocomplete Actions | high | 0.0 | 1% |
| CVE-2026-81525 | mongodb/mongodb | mongodb: Reject "." and NUL bytes in database and collection names | high | 8.1 | 0% |
| CVE-2026-34973 | thorsten/phpmyfaq | phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure | medium | 5.3 | 0% |
| CVE-2026-31825 | sylius/sylius | Sylius has a DQL Injection via API Order Filters | medium | 5.3 | 0% |