CVE records Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program , by email as they are published. Where the data comes from: sources .
Updated under an hour ago (Oct 25, 2026, 10:10 PM ET )
This week: 4,079 CVEs published, 329 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.
Published in the last 7 days 4,079 Show in the list Critical, last 7 days 329 Show in the list Healthcare-tagged, last 7 days 9 Show in the list Known exploited (CISA KEV) 1,756 Show in the list Showing CVEs that name the product php:php . Show all products
31 CVEs, showing 1 to 31
CVE Severity Title Published CVE-2026-109619 Critical 9.2 RCE via stale global state Assigned by php
Oct 21, 2026 CVE-2026-109618 Critical 9.2 RCE via OOM corruption Assigned by php
Oct 21, 2026 CVE-2026-91769 Medium 4.3 TLS Hostname Verification Falls Back to CN After SAN Mismatch Assigned by php
Sep 25, 2026 CVE-2025-1218 Low 3.4 Various packet overreads in mysqlnd_writeprotocol.c Assigned by php
Sep 25, 2026 CVE-2026-91766 Medium 5.9 Cross-origin credential leak in HTTP stream wrapper redirects Assigned by php
Sep 25, 2026 CVE-2026-91765 High 7.5 SOAP: Unbounded Recursion in Server-Side cleanup_xml_node Assigned by php
Sep 25, 2026 CVE-2025-14181 Medium 6.5 Integer overflow to buffer overflow in soap HTTP parsing Assigned by php
Sep 25, 2026 CVE-2026-17545 Medium 6.9 PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS Assigned by php
Sep 25, 2026 CVE-2026-6103 Medium 4.3 Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection Assigned by php
Sep 25, 2026 CVE-2026-93682 Medium 5.8 Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header Assigned by php
Sep 25, 2026 CVE-2026-7260 Medium 5.4 Stack overflow in phar with circular symlinks Assigned by php
Jul 30, 2026 CVE-2026-17544 High 8.1 Out-of-bounds write in bccomp() via crafted operand and scale Assigned by php
Jul 30, 2026 CVE-2026-17543 High 8.1 SQL injection in ext-pgsql via E'...' backslash breakout Assigned by php
Jul 30, 2026 CVE-2026-14355 Medium 5.6 ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD Assigned by php
Jul 3, 2026 CVE-2026-7263 Medium 6.3 DoS attack via DOMNode::C14N() Assigned by php
May 10, 2026 CVE-2026-6104 Medium 6.3 Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding Assigned by php
May 10, 2026 CVE-2026-7258 Medium 6.3 Out-of-bounds read in urldecode() on NetBSD Assigned by php
May 10, 2026 CVE-2026-6722 Critical 9.5 Use-After-Free in SOAP using Apache map Assigned by php
May 10, 2026 CVE-2026-7259 Low 2.1 Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() Assigned by php
May 10, 2026 CVE-2026-7261 Medium 6.3 SoapServer session-persisted object use-after-free via SOAP header fault Assigned by php
May 10, 2026 CVE-2026-7262 Low 2.9 NULL pointer dereference in SOAP apache:Map decoder with missing <value> Assigned by php
May 10, 2026 CVE-2025-14179 High 7.4 SQL injection in pdo_firebird via NUL bytes in quoted strings Assigned by php
May 9, 2026 CVE-2026-7568 Medium 6.3 Signed integer overflow in metaphone() Assigned by php
May 9, 2026 CVE-2026-6735 High 7.3 XSS within PHP-FPM status endpoint Assigned by php
May 9, 2026 CVE-2025-14177 Medium 6.3 Information Leak of Memory in getimagesize Assigned by php
Dec 27, 2025 CVE-2025-14178 Medium 6.5 Heap buffer overflow in array_merge() Assigned by php
Dec 27, 2025 CVE-2025-14180 High 8.2 NULL Pointer Dereference in PDO quoting Assigned by php
Dec 27, 2025 CVE-2024-4577 Known exploited
Critical 9.8 Argument Injection in PHP-CGI Assigned by php
Jun 9, 2024 CVE-2022-37454 Critical 9.8 The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic… Assigned by mitre
Oct 20, 2022 CVE-2019-11043 Known exploited
High 8.7 Underflow in PHP-FPM can lead to RCE Assigned by php
Oct 28, 2019 CVE-2012-1823 Known exploited
Critical 9.8 sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which al… Assigned by certcc
May 11, 2012
CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.
© 2026 MTC Group, LLC. All rights reserved. InfoSec Signals™ and the InfoSec Signals logo are trademarks of MTC Group, LLC.
Printed from infosecsignals.com. Every record links back to the agency that published it.
