Known vulnerabilities in PHP
Vendor:
PHP Group
Software:
PHP
Software CPE:
cpe:2.3:a:php_group:php:*:*:*:*:*:*:*:*
Website:
https://php.net
Total vulnerabilities:
689
Public exploits:
155
Known exploited (KEV):
5
Highest CVSSv4 Score:
9.3
Breakdown by Severity Chart
8.4.9
8.4.0
8.4.24
8.3.33
8.5.9
8.2.33
8.5.8
8.4.23
8.3.32
8.2.32
8.4.22
8.5.7
8.5.6
8.4.21
8.3.31
8.2.31
8.5.5
8.4.20
8.5.4
8.4.19
8.5.3
8.4.18
8.5.2
8.3.30
8.4.17
8.1.34
8.4.16
8.2.30
8.3.29
8.5.1
8.5.0
8.4.15
8.3.28
8.3.27
8.4.14
8.3.26
8.4.13
8.3.25
8.4.12
8.4.11
8.3.24
8.3.23
8.1.33
8.4.10
8.2.29
8.3.22
8.4.8
8.3.21
8.4.7
8.4.6
8.3.20
8.2.28
8.4.5
8.3.19
8.1.32
8.4.4
8.3.17
8.4.3
8.3.16
8.4.2
8.3.15
8.2.27
8.4.1
8.1.31
8.3.14
8.2.26
8.3.13
8.2.25
8.1.30
8.2.24
8.3.12
8.3.11
8.2.23
8.2.22
8.3.10
8.3.9
8.2.21
8.2.20
8.3.8
8.1.29
8.3.7
8.2.19
8.1.28
8.3.6
8.2.18
8.3.4
8.2.17
8.2.16
8.3.3
8.3.2
8.2.15
8.2.14
8.3.1
8.1.27
8.1.26
8.3.0
8.2.13
8.1.25
8.2.12
8.1.24
8.2.11
8.1.23
8.2.10
8.2.9
8.0.30
8.1.22
8.1.21
8.2.8
8.1.20
8.2.7
8.0.29
8.1.19
8.2.6
8.1.18
8.2.5
8.2.4
8.1.17
8.1.16
8.2.3
8.0.28
8.1.15
8.2.2
8.0.27
8.2.1
8.1.14
8.2.0
8.0.26
8.1.13
7.4.33
8.1.12
8.0.25
8.0.24
8.1.11
7.4.32
8.0.23
8.1.10
8.1.9
8.0.22
8.1.8
8.0.21
8.0.20
8.1.7
7.4.30
8.1.6
8.0.19
8.0.18
8.1.5
7.4.29
8.1.4
8.0.17
8.1.3
8.0.16
7.4.28
8.1.2
8.0.15
8.1.1
8.0.14
7.4.27
8.1.0
8.0.13
7.4.26
7.3.33
7.3.32
7.4.25
8.0.12
7.4.24
8.0.11
7.3.31
7.4.23
7.3.30
8.0.10
8.0.9
7.4.22
7.4.21
8.0.8
7.3.29
8.0.7
7.4.20
8.0.6
7.4.19
7.4.18
8.0.5
7.3.28
7.4.16
8.0.3
8.0.2
7.4.15
7.3.27
8.0.1
7.4.14
7.3.26
8.0.0
7.4.13
7.4.12
7.3.25
7.3.24
7.4.11
7.3.23
7.2.34
7.4.10
7.3.22
7.4
7.3
7.2
7.1
7.0
6.4
6.3
6.2
6.1
6.0
5.5
5.4
5.3
5.2
4.11
4.10
4.9
4.8
4.7
4.6.2
4.6
4.5
4.4
4.3
4.2
4.1
3.5
3.4
3.3
3.2
3.1
2.2.8
2.2.7
2.2.6
2.2.5
2.2.2
2.2.1
2.2
2.1.7
2.1.6
2.1.5
2.1
2.0.5
1.1.5.1
1.1.5
1.1
9.1
9.0
2.5.6
7.4.9
7.3.21
7.2.33
7.4.8
7.3.20
7.2.32
7.4.7
7.3.19
7.4.6
7.3.18
7.2.31
7.2.30
7.4.5
7.3.17
7.4.4
7.2.29
7.3.16
7.4.3
7.3.15
7.2.28
7.3.14
7.2.27
7.4.2
7.4.1
7.3.13
7.2.26
7.4.0
7.2.25
7.3.12
7.1.33
7.3.11
7.3.10
7.2.24
7.2.23
7.3.9
7.2.22
7.1.32
4.0.4pl1
7.3.8
7.2.21
7.1.31
7.2.20
7.3.7
7.1.30
7.2.19
7.3.6
7.1.29
7.3.5
7.2.18
7.1.28
7.3.4
7.3.3
7.2.17
7.2.16
7.1.27
7.2.15
7.3.2
7.1.26
5.6.40
7.3.1
7.2.14
7.3.0alpha4
7.3.0beta1
7.3.0beta3
7.3.0alpha1
7.3.0
7.2.13
7.1.25
7.0.33
5.6.39
5.3.28
4.4.8
4.4.9
4.3.0
4.4.6
4.4.7
4.4.4
4.4.5
3.0
3.0.18
4.3.3
4.3.4
4.3.1
4.3.2
4.0.2
4.0.3
4.0.0
4.0.1
2.0b10
2.0
4.0
4.0.6
4.0.7
4.4.3
4.0.4
4.4.0
4.0.5
4.4.1
4.1.1
4.1.2
4.1.0
1.0
3.0.9
4.3.9
4.2.0
4.2.1
3.0.5
3.0.14
4.3.7
3.0.6
3.0.15
4.3.8
3.0.7
3.0.16
4.3.5
3.0.8
3.0.17
4.3.6
4.3.10
4.3.11
3.0.1
3.0.10
3.0.2
3.0.11
3.0.3
3.0.12
3.0.4
3.0.13
4.2.2
4.2.3
7.2.12
7.1.24
7.2.11
7.1.23
7.2.10
7.1.22
7.0.32
5.6.38
7.1.21
7.2.9
7.1.20
7.0.31
5.6.37
7.2.8
7.1.19
7.2.7
7.2.6
7.1.18
5.6.36
5.6.35
7.1.17
7.1.16
7.0.30
7.0.29
7.2.5
7.2.4
7.2.3
7.1.15
5.6.34
7.1.14
7.0.28
5.6.33
5.3.29
5.4.45
7.2.2
5.4.21
5.4.20
5.4.19
5.4.18
7.1.12
7.1.7
7.1.5
7.2.1
7.1.13
7.0.27
7.2.0
7.0.26
7.1.11
7.0.25
5.6.32
5.6.31
7.1.10
7.0.24
7.1.9
7.0.23
7.1.8
7.0.22
7.0.21
7.1.6
7.0.20
7.0.19
7.1.4
7.0.18
7.1.3
5.6.30
5.6.29
5.6.28
5.6.27
5.6.25
5.6.24
7.1.2
7.1.1
7.1.0
7.0.17
7.0.16
7.0.15
7.0.14
7.0.13
7.0.12
7.0.10
7.0.9
5.5.38
5.4.44
5.4.43
5.4.41
5.4.40
5.4.39
5.4.38
5.4.37
5.4.36
5.4.35
5.4.34
5.4.33
5.4.32
5.4.31
5.4.30
5.4.29
5.4.28
5.4.27
5.4.26
5.4.25
5.4.24
5.4.23
5.4.22
5.4.17
5.4.16
5.4.15
5.4.14
5.4.13
5.4.12
5.4.11
5.4.10
5.4.9
5.4.8
5.4.7
5.4.6
5.4.5
5.4.4
5.4.3
5.4.2
5.6.26
7.0.11
4.4.2
5.1.2
5.3.17
5.3.18
5.3.15
5.3.16
5.3.19
5.3.13
5.3.14
5.3.11
5.3.12
5.4.1
5.3.26
5.3.27
5.3.20
5.3.21
5.3.24
5.3.25
5.3.22
5.3.23
5.3.7
5.3.10
5.3.8
5.3.9
5.3.6
5.3.5
5.3.4
5
5.4.0
5.2.16
5.2.17
5.2.14
5.2.15
5.2.12
5.2.13
5.2.10
5.2.11
5.2.7
5.2.8
5.2.5
5.2.6
5.2.9
5.3.2
5.3.0
5.3.1
5.2.3
5.2.1
5.2.4
5.2.2
5.2.0
5.1.5
5.1.4
5.1.3
5.1.0
5.1.1
5.1
5.0.5
5.0.4
5.0.3
5.0.0
5.0.1
5.0.2
5.0
5.3.3
5.4.42
5.1.6
7.0.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.6.0
5.5.17
5.6.1
5.5.18
5.6.2
5.5.19
5.6.3
5.5.20
5.6.4
5.5.21
5.6.5
5.5.22
5.6.6
5.5.23
5.6.7
5.5.24
5.6.8
5.5.25
5.6.9
5.5.26
5.6.10
5.5.27
5.6.11
5.5.28
5.6.12
5.5.29
5.6.13
5.5.30
5.6.14
5.6.15
5.6.16
5.5.31
5.6.17
5.5.32
5.6.18
5.5.33
5.6.19
5.5.34
5.6.20
5.5.35
5.6.21
5.6.23
5.5.37
7.0.8
5.5.36
5.6.22
7.0.7
Vulnerabilities (689)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU140834 - Out-of-bounds write CVE-2026-17544 |
CWE-787 | Medium | 8.4.24, 8.5.9 | 03.08.2026 |
SB2026080395 SB2026080397 SB2026080398 and 1 more |
||
| #VU140833 - Uncontrolled Recursion CVE-2026-7260 |
CWE-674 | Low | 8.2.33, 8.3.33, 8.4.24, 8.5.9 | 03.08.2026 |
SB2026080395 SB2026080397 SB2026080398 and 5 more |
||
| #VU140832 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVE-2026-17543 |
CWE-89 | High | 8.2.33, 8.3.33, 8.4.24, 8.5.9 | 03.08.2026 |
SB2026080395 SB2026080397 SB2026080398 and 5 more |
||
| #VU140831 - Improper input validation CVE-2026-9672 |
CWE-20 | Medium | 8.2.33, 8.3.33, 8.4.24, 8.5.9 | 03.08.2026 |
SB2026080395 SB2026080396 SB2026080603 and 3 more |
||
| #VU137285 - Uncaught Exception CVE-2026-12184 |
CWE-248 | Medium | 8.3.32, 8.4.21, 8.5.6 | 09.07.2026 |
SB2026051001 SB2026071918 SB2026071919 and 5 more |
||
| #VU137286 - Memory corruption CVE-2026-14355 |
CWE-119 | Medium | 8.2.32, 8.3.32, 8.4.23, 8.5.8 | 09.07.2026 |
SB2026070955 SB2026070956 SB2026071356 and 16 more |
||
| #VU130908 - Improper Encoding or Escaping of Output CVE-2026-7263 |
CWE-116 | Medium | 8.4.21, 8.5.6 | 10.05.2026 |
SB2026051001 SB2026051416 SB2026051523 and 3 more |
||
| #VU130909 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2026-6735 |
CWE-79 | Medium | 8.2.31, 8.3.31, 8.4.21, 8.5.6 | 10.05.2026 |
SB2026051001 SB20260511112 SB20260513120 and 19 more |
||
| #VU130910 - NULL Pointer Dereference CVE-2026-7259 |
CWE-476 | Medium | 8.2.31, 8.3.31, 8.4.21, 8.5.6 | 10.05.2026 |
SB2026051001 SB20260511112 SB20260513120 and 14 more |
||
| #VU130911 - Out-of-bounds read CVE-2026-6104 |
CWE-125 | Medium | 8.4.21, 8.5.6 | 10.05.2026 |
SB2026051001 SB2026051416 SB2026051523 and 3 more |
||
| #VU130912 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVE-2025-14179 |
CWE-89 | High | 8.2.31, 8.3.31, 8.4.21, 8.5.6 | 10.05.2026 |
SB2026051001 SB20260511112 SB20260513120 and 19 more |
||
| #VU130913 - Use After Free CVE-2026-6722 |
CWE-416 | Medium | 8.2.31, 8.3.31, 8.4.21, 8.5.6 | 10.05.2026 |
SB2026051001 SB20260511112 SB20260513120 and 17 more |
||
| #VU130914 - Use After Free CVE-2026-7261 |
CWE-416 | Medium | 8.2.31, 8.3.31, 8.4.21, 8.5.6 | 10.05.2026 |
SB2026051001 SB20260511112 SB20260513120 and 17 more |
||
| #VU130915 - NULL Pointer Dereference CVE-2026-7262 |
CWE-476 | Medium | 8.2.31, 8.3.31, 8.4.21, 8.5.6 | 10.05.2026 |
SB2026051001 SB20260511112 SB20260513120 and 19 more |
||
| #VU130916 - Integer overflow CVE-2026-7568 |
CWE-190 | Medium | 8.2.31, 8.3.31, 8.4.21, 8.5.6 | 10.05.2026 |
SB2026051001 SB20260511112 SB20260513120 and 19 more |
||
| #VU130917 - Type conversion CVE-2026-7258 |
CWE-704 | Medium | 8.2.31, 8.3.31, 8.4.21, 8.5.6 | 10.05.2026 |
SB2026051001 SB20260511112 SB20260513120 and 17 more |
||
| #VU130918 - Integer overflow CVE-2026-42371 |
CWE-190 | Medium | 8.5.6 | 10.05.2026 |
SB2026051001 SB2026051002 SB2026051003 and 9 more |
||
| #VU120272 - Missing release of memory after effective lifetime CVE-2025-14177 |
CWE-401 | Medium | 8.1.34, 8.2.30, 8.3.29, 8.4.16, 8.5.1 | 23.12.2025 |
SB2025122340 SB2025122342 SB2026010709 and 20 more |
||
| #VU120271 - Heap-based Buffer Overflow CVE-2025-14178 |
CWE-122 | High | 8.1.34, 8.2.30, 8.3.29, 8.4.16, 8.5.1 | 23.12.2025 |
SB2025122340 SB2025122342 SB2026010709 and 33 more |
||
| #VU120270 - NULL Pointer Dereference CVE-2025-14180 |
CWE-476 | Medium | 8.1.34, 8.2.30, 8.3.29, 8.4.16, 8.5.1 | 23.12.2025 |
SB2025122340 SB2025122342 SB2026010709 and 18 more |
Showing elements 1 - 20 out of 689