| CVE-2026-109619 |
Exploited
RCE via stale global state
|
9.2
Critical
|
Oct 21, 2026 |
| CVE-2026-109618 |
Exploited
RCE via OOM corruption
|
9.2
Critical
|
Oct 21, 2026 |
| CVE-2026-92842 |
The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a…
|
5.9
Medium
|
Sep 25, 2026 |
| CVE-2026-91768 |
The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so…
|
6.5
Medium
|
Sep 25, 2026 |
| CVE-2026-91769 |
PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry…
|
4.3
Medium
|
Sep 25, 2026 |
| CVE-2026-91767 |
php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS…
|
6.5
Medium
|
Sep 25, 2026 |
| CVE-2025-1218 |
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough…
|
3.4
Low
|
Sep 25, 2026 |
| CVE-2026-91766 |
When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and…
|
5.9
Medium
|
Sep 25, 2026 |
| CVE-2026-91765 |
cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit
|
7.5
High
|
Sep 25, 2026 |
| CVE-2025-14181 |
The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is…
|
6.5
Medium
|
Sep 25, 2026 |
| CVE-2026-17545 |
On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to…
|
6.9
Medium
|
Sep 25, 2026 |
| CVE-2026-6103 |
phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check
|
4.3
Medium
|
Sep 25, 2026 |
| CVE-2026-93682 |
When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the…
|
5.8
Medium
|
Sep 25, 2026 |
| CVE-2026-7260 |
Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the…
|
5.4
Medium
|
Jul 30, 2026 |
| CVE-2026-17544 |
Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions…
|
8.1
High
|
Jul 30, 2026 |
| CVE-2026-17543 |
Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP…
|
8.1
High
|
Jul 30, 2026 |
| CVE-2026-7263 |
In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly,…
|
6.3
Medium
|
May 10, 2026 |
| CVE-2026-6104 |
In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is…
|
6.3
Medium
|
May 10, 2026 |
| CVE-2026-7258 |
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions,…
|
6.3
Medium
|
May 10, 2026 |
| CVE-2026-6722 |
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP…
|
9.5
Critical
|
May 10, 2026 |
| CVE-2026-7259 |
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch…
|
2.1
Low
|
May 10, 2026 |
| CVE-2026-7261 |
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer…
|
6.3
Medium
|
May 10, 2026 |
| CVE-2026-7262 |
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP…
|
2.9
Low
|
May 10, 2026 |
| CVE-2025-14179 |
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO…
|
7.4
High
|
May 10, 2026 |
| CVE-2026-7568 |
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone()…
|
6.3
Medium
|
May 10, 2026 |