PHP
750 CVEs tracked. 3 of them are in CISA KEV.
This hub aggregates every CVE we track for PHP, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
PHP CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 4 |
| 2024-11 | 5 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 1 |
| 2025-03 | 5 |
| 2025-04 | 1 |
| 2025-05 | 2 |
| 2025-06 | 0 |
| 2025-07 | 3 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 3 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 1 |
| 2026-04 | 0 |
| 2026-05 | 11 |
| 2026-06 | 0 |
| 2026-07 | 4 |
| 2026-08 | 0 |
| 2026-09 | 11 |
Severity
How the 750 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical162
- High240
- Medium312
- Low35
Latest CVEs
The 15 most recently published vulnerabilities affecting PHP.
- CVE-2026-92842OOB read / info leak in convert.* stream filters when line-break-chars contains NUL5.9
- CVE-2026-91768IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)6.5
- CVE-2026-91769TLS Hostname Verification Falls Back to CN After SAN Mismatch4.3
- CVE-2026-91767Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN6.5
- CVE-2025-1218Various packet overreads in mysqlnd_writeprotocol.c3.4
- CVE-2026-91766Cross-origin credential leak in HTTP stream wrapper redirects5.9
- CVE-2026-91765SOAP: Unbounded Recursion in Server-Side cleanup_xml_node7.5
- CVE-2025-14181Integer overflow to buffer overflow in soap HTTP parsing6.5
- CVE-2026-17545PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS—
- CVE-2026-6103Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection4.3
- CVE-2026-93682Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header5.8
- CVE-2026-7260Stack overflow in phar with circular symlinks5.5
- CVE-2026-17544Out-of-bounds write in bccomp() via crafted operand and scale9.8
- CVE-2026-17543SQL injection in ext-pgsql via E'...' backslash breakout9.8
- CVE-2026-14355ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD5.6
Product grouping is registry-driven, with AI assist and human review. How it works