Skip to content
Pphalcon
Products
| Product | CVEs | Exploited | Latest |
|---|
| cphalcon | 3 | – | Aug 21, 2026 |
Exploited and recent CVEs
-
CVE-2026-59989
Critical 9.2
Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE)
0.5%
-
CVE-2026-57584
High 8.7
Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS
0.5%
-
CVE-2026-54736
High 8.2
Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)
0.2%