Known vulnerabilities in PHP
Vendor:
PHP Group
Software:
PHP
Software CPE:
cpe:2.3:a:php_group:php:*:*:*:*:*:*:*:*
Website:
https://php.net
Total vulnerabilities:
695
Public exploits:
156
Known exploited (KEV):
5
Highest CVSSv4 Score:
9.3
Breakdown by Severity Chart
8.2.34
8.3.35
8.4.26
8.5.11
8.5.10
8.4.25
8.4.9
8.4.0
8.4.24
8.3.33
8.5.9
8.2.33
8.5.8
8.4.23
8.3.32
8.2.32
8.4.22
8.5.7
8.5.6
8.4.21
8.3.31
8.2.31
8.5.5
8.4.20
8.5.4
8.4.19
8.5.3
8.4.18
8.5.2
8.3.30
8.4.17
8.1.34
8.4.16
8.2.30
8.3.29
8.5.1
8.5.0
8.4.15
8.3.28
8.3.27
8.4.14
8.3.26
8.4.13
8.3.25
8.4.12
8.4.11
8.3.24
8.3.23
8.1.33
8.4.10
8.2.29
8.3.22
8.4.8
8.3.21
8.4.7
8.4.6
8.3.20
8.2.28
8.4.5
8.3.19
8.1.32
8.4.4
8.3.17
8.4.3
8.3.16
8.4.2
8.3.15
8.2.27
8.4.1
8.1.31
8.3.14
8.2.26
8.3.13
8.2.25
8.1.30
8.2.24
8.3.12
8.3.11
8.2.23
8.2.22
8.3.10
8.3.9
8.2.21
8.2.20
8.3.8
8.1.29
8.3.7
8.2.19
8.1.28
8.3.6
8.2.18
8.3.4
8.2.17
8.2.16
8.3.3
8.3.2
8.2.15
8.2.14
8.3.1
8.1.27
8.1.26
8.3.0
8.2.13
8.1.25
8.2.12
8.1.24
8.2.11
8.1.23
8.2.10
8.2.9
8.0.30
8.1.22
8.1.21
8.2.8
8.1.20
8.2.7
8.0.29
8.1.19
8.2.6
8.1.18
8.2.5
8.2.4
8.1.17
8.1.16
8.2.3
8.0.28
8.1.15
8.2.2
8.0.27
8.2.1
8.1.14
8.2.0
8.0.26
8.1.13
7.4.33
8.1.12
8.0.25
8.0.24
8.1.11
7.4.32
8.0.23
8.1.10
8.1.9
8.0.22
8.1.8
8.0.21
8.0.20
8.1.7
7.4.30
8.1.6
8.0.19
8.0.18
8.1.5
7.4.29
8.1.4
8.0.17
8.1.3
8.0.16
7.4.28
8.1.2
8.0.15
8.1.1
8.0.14
7.4.27
8.1.0
8.0.13
7.4.26
7.3.33
7.3.32
7.4.25
8.0.12
7.4.24
8.0.11
7.3.31
7.4.23
7.3.30
8.0.10
8.0.9
7.4.22
7.4.21
8.0.8
7.3.29
8.0.7
7.4.20
8.0.6
7.4.19
7.4.18
8.0.5
7.3.28
7.4.16
8.0.3
8.0.2
7.4.15
7.3.27
8.0.1
7.4.14
7.3.26
8.0.0
7.4.13
7.4.12
7.3.25
7.3.24
7.4.11
7.3.23
7.2.34
7.4.10
7.3.22
7.4
7.3
7.2
7.1
7.0
6.4
6.3
6.2
6.1
6.0
5.5
5.4
5.3
5.2
4.11
4.10
4.9
4.8
4.7
4.6.2
4.6
4.5
4.4
4.3
4.2
4.1
3.5
3.4
3.3
3.2
3.1
2.2.8
2.2.7
2.2.6
2.2.5
2.2.2
2.2.1
2.2
2.1.7
2.1.6
2.1.5
2.1
2.0.5
1.1.5.1
1.1.5
1.1
9.1
9.0
2.5.6
7.4.9
7.3.21
7.2.33
7.4.8
7.3.20
7.2.32
7.4.7
7.3.19
7.4.6
7.3.18
7.2.31
7.2.30
7.4.5
7.3.17
7.4.4
7.2.29
7.3.16
7.4.3
7.3.15
7.2.28
7.3.14
7.2.27
7.4.2
7.4.1
7.3.13
7.2.26
7.4.0
7.2.25
7.3.12
7.1.33
7.3.11
7.3.10
7.2.24
7.2.23
7.3.9
7.2.22
7.1.32
4.0.4pl1
7.3.8
7.2.21
7.1.31
7.2.20
7.3.7
7.1.30
7.2.19
7.3.6
7.1.29
7.3.5
7.2.18
7.1.28
7.3.4
7.3.3
7.2.17
7.2.16
7.1.27
7.2.15
7.3.2
7.1.26
5.6.40
7.3.1
7.2.14
7.3.0alpha4
7.3.0beta1
7.3.0beta3
7.3.0alpha1
7.3.0
7.2.13
7.1.25
7.0.33
5.6.39
5.3.28
4.4.8
4.4.9
4.3.0
4.4.6
4.4.7
4.4.4
4.4.5
3.0
3.0.18
4.3.3
4.3.4
4.3.1
4.3.2
4.0.2
4.0.3
4.0.0
4.0.1
2.0b10
2.0
4.0
4.0.6
4.0.7
4.4.3
4.0.4
4.4.0
4.0.5
4.4.1
4.1.1
4.1.2
4.1.0
1.0
3.0.9
4.3.9
4.2.0
4.2.1
3.0.5
3.0.14
4.3.7
3.0.6
3.0.15
4.3.8
3.0.7
3.0.16
4.3.5
3.0.8
3.0.17
4.3.6
4.3.10
4.3.11
3.0.1
3.0.10
3.0.2
3.0.11
3.0.3
3.0.12
3.0.4
3.0.13
4.2.2
4.2.3
7.2.12
7.1.24
7.2.11
7.1.23
7.2.10
7.1.22
7.0.32
5.6.38
7.1.21
7.2.9
7.1.20
7.0.31
5.6.37
7.2.8
7.1.19
7.2.7
7.2.6
7.1.18
5.6.36
5.6.35
7.1.17
7.1.16
7.0.30
7.0.29
7.2.5
7.2.4
7.2.3
7.1.15
5.6.34
7.1.14
7.0.28
5.6.33
5.3.29
5.4.45
7.2.2
5.4.21
5.4.20
5.4.19
5.4.18
7.1.12
7.1.7
7.1.5
7.2.1
7.1.13
7.0.27
7.2.0
7.0.26
7.1.11
7.0.25
5.6.32
5.6.31
7.1.10
7.0.24
7.1.9
7.0.23
7.1.8
7.0.22
7.0.21
7.1.6
7.0.20
7.0.19
7.1.4
7.0.18
7.1.3
5.6.30
5.6.29
5.6.28
5.6.27
5.6.25
5.6.24
7.1.2
7.1.1
7.1.0
7.0.17
7.0.16
7.0.15
7.0.14
7.0.13
7.0.12
7.0.10
7.0.9
5.5.38
5.4.44
5.4.43
5.4.41
5.4.40
5.4.39
5.4.38
5.4.37
5.4.36
5.4.35
5.4.34
5.4.33
5.4.32
5.4.31
5.4.30
5.4.29
5.4.28
5.4.27
5.4.26
5.4.25
5.4.24
5.4.23
5.4.22
5.4.17
5.4.16
5.4.15
5.4.14
5.4.13
5.4.12
5.4.11
5.4.10
5.4.9
5.4.8
5.4.7
5.4.6
5.4.5
5.4.4
5.4.3
5.4.2
5.6.26
7.0.11
4.4.2
5.1.2
5.3.17
5.3.18
5.3.15
5.3.16
5.3.19
5.3.13
5.3.14
5.3.11
5.3.12
5.4.1
5.3.26
5.3.27
5.3.20
5.3.21
5.3.24
5.3.25
5.3.22
5.3.23
5.3.7
5.3.10
5.3.8
5.3.9
5.3.6
5.3.5
5.3.4
5
5.4.0
5.2.16
5.2.17
5.2.14
5.2.15
5.2.12
5.2.13
5.2.10
5.2.11
5.2.7
5.2.8
5.2.5
5.2.6
5.2.9
5.3.2
5.3.0
5.3.1
5.2.3
5.2.1
5.2.4
5.2.2
5.2.0
5.1.5
5.1.4
5.1.3
5.1.0
5.1.1
5.1
5.0.5
5.0.4
5.0.3
5.0.0
5.0.1
5.0.2
5.0
5.3.3
5.4.42
5.1.6
7.0.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.6.0
5.5.17
5.6.1
5.5.18
5.6.2
5.5.19
5.6.3
5.5.20
5.6.4
5.5.21
5.6.5
5.5.22
5.6.6
5.5.23
5.6.7
5.5.24
5.6.8
5.5.25
5.6.9
5.5.26
5.6.10
5.5.27
5.6.11
5.5.28
5.6.12
5.5.29
5.6.13
5.5.30
5.6.14
5.6.15
5.6.16
5.5.31
5.6.17
5.5.32
5.6.18
5.5.33
5.6.19
5.5.34
5.6.20
5.5.35
5.6.21
5.6.23
5.5.37
7.0.8
5.5.36
5.6.22
7.0.7
Vulnerabilities (695)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU151927 - Heap-based Buffer Overflow CVE-2026-91767 |
CWE-122 | Medium | 8.2.34, 8.3.35, 8.4.26, 8.5.11 | 24.09.2026 |
SB2026092449 |
||
| #VU151926 - Uncontrolled Recursion CVE-2026-91765 |
CWE-674 | Medium | 8.2.34, 8.3.35, 8.4.26, 8.5.11 | 24.09.2026 |
SB2026092449 |
||
| #VU151925 - Insufficiently Protected Credentials CVE-2026-91766 |
CWE-522 | Medium | 8.2.34, 8.3.35, 8.4.26, 8.5.11 | 24.09.2026 |
SB2026092449 |
||
| #VU151924 - Use of Uninitialized Variable |
CWE-457 | Low | 8.2.34, 8.3.35, 8.4.25, 8.5.10 | 24.09.2026 |
SB2026092449 |
||
| #VU151923 - Incorrect Comparison CVE-2026-91768 |
CWE-697 | Medium | 8.2.34, 8.3.35, 8.4.26, 8.5.11 | 24.09.2026 |
SB2026092449 |
||
| #VU151922 - Out-of-bounds read CVE-2026-93682 |
CWE-125 | Medium | 8.2.34, 8.3.35, 8.4.26, 8.5.11 | 24.09.2026 |
SB2026092449 |
||
| #VU140834 - Out-of-bounds write CVE-2026-17544 |
CWE-787 | Medium | 8.4.24, 8.5.9 | 03.08.2026 |
SB2026080395 SB2026080397 SB2026080398 and 2 more |
||
| #VU140833 - Uncontrolled Recursion CVE-2026-7260 |
CWE-674 | Low | 8.2.33, 8.3.33, 8.4.24, 8.5.9 | 03.08.2026 |
SB2026080395 SB2026080397 SB2026080398 and 15 more |
||
| #VU140832 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVE-2026-17543 |
CWE-89 | High | 8.2.33, 8.3.33, 8.4.24, 8.5.9 | 03.08.2026 |
SB2026080395 SB2026080397 SB2026080398 and 14 more |
||
| #VU140831 - Improper input validation CVE-2026-9672 |
CWE-20 | Medium | 8.2.33, 8.3.33, 8.4.24, 8.5.9 | 03.08.2026 |
SB2026080395 SB2026080396 SB2026080603 and 6 more |
||
| #VU137286 - Memory corruption CVE-2026-14355 |
CWE-119 | Medium | 8.2.32, 8.3.32, 8.4.23, 8.5.8 | 09.07.2026 |
SB2026070955 SB2026070956 SB2026071356 and 17 more |
||
| #VU130908 - Improper Encoding or Escaping of Output CVE-2026-7263 |
CWE-116 | Medium | 8.4.21, 8.5.6 | 10.05.2026 |
SB2026051001 SB2026051416 SB2026051523 and 3 more |
||
| #VU130909 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2026-6735 |
CWE-79 | Medium | 8.2.31, 8.3.31, 8.4.21, 8.5.6 | 10.05.2026 |
SB2026051001 SB20260511112 SB20260513120 and 19 more |
||
| #VU130910 - NULL Pointer Dereference CVE-2026-7259 |
CWE-476 | Medium | 8.2.31, 8.3.31, 8.4.21, 8.5.6 | 10.05.2026 |
SB2026051001 SB20260511112 SB20260513120 and 14 more |
||
| #VU130911 - Out-of-bounds read CVE-2026-6104 |
CWE-125 | Medium | 8.4.21, 8.5.6 | 10.05.2026 |
SB2026051001 SB2026051416 SB2026051523 and 3 more |
||
| #VU130912 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVE-2025-14179 |
CWE-89 | High | 8.2.31, 8.3.31, 8.4.21, 8.5.6 | 10.05.2026 |
SB2026051001 SB20260511112 SB20260513120 and 19 more |
||
| #VU130913 - Use After Free CVE-2026-6722 |
CWE-416 | Medium | 8.2.31, 8.3.31, 8.4.21, 8.5.6 | 10.05.2026 |
SB2026051001 SB20260511112 SB20260513120 and 17 more |
||
| #VU130914 - Use After Free CVE-2026-7261 |
CWE-416 | Medium | 8.2.31, 8.3.31, 8.4.21, 8.5.6 | 10.05.2026 |
SB2026051001 SB20260511112 SB20260513120 and 17 more |
||
| #VU130915 - NULL Pointer Dereference CVE-2026-7262 |
CWE-476 | Medium | 8.2.31, 8.3.31, 8.4.21, 8.5.6 | 10.05.2026 |
SB2026051001 SB20260511112 SB20260513120 and 20 more |
||
| #VU130916 - Integer overflow CVE-2026-7568 |
CWE-190 | Medium | 8.2.31, 8.3.31, 8.4.21, 8.5.6 | 10.05.2026 |
SB2026051001 SB20260511112 SB20260513120 and 20 more |
Showing elements 1 - 20 out of 695