Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2022-40871 | dolibarr/dolibarr | Dolibarr vulnerable to Eval Injection | critical | 9.8 | 34% |
| CVE-2022-31181 | prestashop/prestashop | PrestaShop eval injection possible if shop vulnerable to SQL injection | critical | 9.8 | 7% |
| CVE-2020-5256 | ssddanbrown/bookstack | Remote Code Execution Through Image Uploads in BookStack | high | 7.9 | 2% |
| CVE-2026-40187 | egroupware/egroupware | EGroupware has Authenticated RCE via Malicious eTemplate Upload | high | 0.0 | 1% |
| CVE-2024-3562 | custom-field-suite (WordPress plugin) | The Custom Field Suite plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.6.7 via the Loop cus | high | 8.8 | 1% |
| CVE-2026-45293 | wp-coding-standards/wpcs | WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability | high | 8.6 | 0% |
| CVE-2026-65954 | phpcsstandards/phpcsutils | PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey() | high | 8.6 | 0% |
| CVE-2026-49273 | mantisbt/mantisbt | MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php | high | 0.0 | – |
| GHSA-3fgr-xjr6-xqm8 | phpxmlrpc/phpxmlrpc | code injection in phpxmlrpc/phpxmlrpc | high | 0.0 | – |