php

Latest CVEs · RSS

• CVE-2026-92842 2026-09-25 · CVSS 5.9
  The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is t
• CVE-2026-91768 2026-09-25 · CVSS 6.5
  The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix
• CVE-2026-91769 2026-09-25 · CVSS 4.3
  PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC
• CVE-2026-91767 2026-09-25 · CVSS 6.5
  php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard
• CVE-2025-1218 2026-09-25 · CVSS 3.4
  The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromise
• CVE-2026-91766 2026-09-25 · CVSS 5.9
  When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the
• CVE-2026-91765 2026-09-25 · CVSS 7.5
  cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containin
• CVE-2025-14181 2026-09-25 · CVSS 6.5
  The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed t
• CVE-2026-17545 2026-09-25 · CVSS 6.9
  On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when
• CVE-2026-6103 2026-09-25 · CVSS 4.3
  phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0
• CVE-2026-93682 2026-09-25 · CVSS 5.8
  When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of
• CVE-2026-7260 2026-07-30 · CVSS 5.4
  Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* befo
• CVE-2026-17544 2026-07-30 · CVSS 8.1
  Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.*
• CVE-2026-17543 2026-07-30 · CVSS 8.1
  Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* befo
• CVE-2026-14355 2026-07-03 · CVSS 5.6
  In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extensio
• CVE-2026-7263 2026-05-10 · CVSS 6.3
  In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the d
• CVE-2026-6104 2026-05-10 · CVSS 6.3
  In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related
• CVE-2026-7258 2026-05-10 · CVSS 6.3
  In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char t
• CVE-2026-6722 2026-05-10 · CVSS 9.5
  In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism store
• CVE-2026-7259 2026-05-10 · CVSS 2.1
  In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl l
• CVE-2026-7261 2026-05-10 · CVSS 6.3
  In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSI
• CVE-2026-7262 2026-05-10 · CVSS 2.9
  In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding
• CVE-2025-14179 2026-05-10 · CVSS 7.4
  In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when
• CVE-2026-7568 2026-05-10 · CVSS 6.3
  In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses
• CVE-2026-6735 2026-05-10 · CVSS 7.3
  In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacke