PHP Group

Products

Exploited and recent CVEs

• CVE-2026-109619 Critical 9.2 Exploited RCE via stale global state 100.0%
• CVE-2026-109618 Critical 9.2 Exploited RCE via OOM corruption 100.0%
• CVE-2024-4577 Critical 9.8 Exploited Argument Injection in PHP-CGI 100.0%
• CVE-2026-92842 Medium 5.9 OOB read / info leak in convert.* stream filters when line-break-chars contains NUL 0.3%
• CVE-2026-91768 Medium 6.5 IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes) 0.4%
• CVE-2026-91769 Medium 4.3 TLS Hostname Verification Falls Back to CN After SAN Mismatch 0.2%
• CVE-2026-91767 Medium 6.5 Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN 0.1%
• CVE-2025-1218 Low 3.4 Various packet overreads in mysqlnd_writeprotocol.c 0.3%
• CVE-2026-91766 Medium 5.9 Cross-origin credential leak in HTTP stream wrapper redirects 0.3%
• CVE-2026-91765 High 7.5 SOAP: Unbounded Recursion in Server-Side cleanup_xml_node 0.4%
• CVE-2025-14181 Medium 6.5 Integer overflow to buffer overflow in soap HTTP parsing 0.3%
• CVE-2026-17545 Medium 6.9 PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS 0.4%
• CVE-2026-6103 Medium 4.3 Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection 0.2%
• CVE-2026-93682 Medium 5.8 Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header 0.3%
• CVE-2026-7260 Medium 5.4 Stack overflow in phar with circular symlinks 0.1%
• CVE-2026-17544 High 8.1 Out-of-bounds write in bccomp() via crafted operand and scale 0.4%
• CVE-2026-17543 High 8.1 SQL injection in ext-pgsql via E'...' backslash breakout 0.3%
• CVE-2026-7263 High 7.5 DoS attack via DOMNode::C14N() 0.4%
• CVE-2026-6104 High 8.2 Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding 0.5%
• CVE-2026-7258 Medium 6.3 Out-of-bounds read in urldecode() on NetBSD 0.4%
• CVE-2026-6722 High 7.7 Use-After-Free in SOAP using Apache map 0.9%
• CVE-2026-7259 Low 2.1 Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() 0.2%
• CVE-2026-7261 Medium 6.3 SoapServer session-persisted object use-after-free via SOAP header fault 0.3%
• CVE-2026-7262 High 7.5 NULL pointer dereference in SOAP apache:Map decoder with missing <value> 0.8%
• CVE-2025-14179 High 8.1 SQL injection in pdo_firebird via NUL bytes in quoted strings 0.4%
• CVE-2026-7568 High 7.5 Signed integer overflow in metaphone() 0.5%
• CVE-2026-6735 High 7.3 XSS within PHP-FPM status endpoint 0.2%
• CVE-2025-14177 Medium 6.3 Information Leak of Memory in getimagesize 0.5%
• CVE-2025-14178 Medium 6.5 Heap buffer overflow in array_merge() 0.5%
• CVE-2025-14180 High 8.2 NULL Pointer Dereference in PDO quoting 0.7%