Product by Debian
Php7.4
47 known vulnerabilities in Php7.4 (Debian), 2 of them actively exploited (CISA KEV).
Key figures
47
Vulnerabilities
2
Actively exploited (KEV)
0
Used by ransomware
10
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-109618 | RCE via OOM corruption In CISA KEValso in 13 other products | 9.8 | |
| Critical | CVE-2026-109619 | RCE via stale global state In CISA KEValso in 13 other products | 8.1 | |
| Critical | CVE-2023-3824 | Buffer overflow and overread in phar_dir_read() | 9.4 | |
| Critical | CVE-2022-37454 | Python Software Foundation CPython: Buffer Overflow | 9.8 | |
| High | CVE-2022-31626 | mysqlnd/pdo password buffer overflow | 7.5 | |
| Medium | CVE-2024-2756 | __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix | 6.5 | |
| Medium | CVE-2022-31629 | PHP: Improper Input Validation | 6.5 | |
| Critical | CVE-2022-31631 | PDO::quote() may return unquoted string | 9.1 | |
| High | CVE-2022-31625 | Freeing unallocated memory in php_pgsql_free_params() | 8.1 | |
| Medium | CVE-2021-21707 | Special characters break path parsing in XML functions | 5.3 | |
| Critical | CVE-2021-21708 | UAF due to php_filter_float() failing | 8.2 | |
| Critical | CVE-2026-6722 | Use-After-Free in SOAP using Apache map | 9.8 | |
| High | CVE-2023-3823 | Security issue with external entity loading in XML without enabling it | 8.6 | |
| Critical | CVE-2025-1861 | Stream HTTP wrapper truncates redirect location to 1024 bytes | 9.8 | |
| High | CVE-2023-0662 | DoS vulnerability when parsing multipart request body | 7.5 | |
| High | CVE-2021-21703 | PHP-FPM memory access in root process leading to privilege escalation | 7.8 | |
| Medium | CVE-2024-3096 | PHP function password_verify can erroneously return true when argument contains NUL | 6.5 | |
| High | CVE-2026-7262 | NULL pointer dereference in SOAP apache:Map decoder with missing <value> | 7.5 | |
| Medium | CVE-2026-91768 | PHP: Incomplete Comparison with Missing Factors | 6.5 | |
| High | CVE-2023-0568 | Array overrun in common path resolve code | 7.5 | |
| Critical | CVE-2026-17543 | SQL injection in ext-pgsql via E'...' backslash breakout | 9.8 | |
| High | CVE-2025-1735 | pgsql extension does not check for errors during escaping | 5.9 | |
| High | CVE-2026-91765 | SOAP: Unbounded Recursion in Server-Side cleanup_xml_node | 7.5 | |
| Medium | CVE-2025-6491 | NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix | 5.9 | |
| High | CVE-2022-31630 | OOB read due to insufficient input validation in imageloadfont() | 6.5 |
News
- CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Executionthehackernews,
- PHP2Shell security flaws now sucessfully exploited in the wildbleepingcomputer,
- PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activitythehackernews,
- PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malwarethehackernews,
- PHP2Shell exposes the weakness in coordinated vulnerability disclosurecsoonline,
- Neutralizing PHP2Shell: Stopping Critical PHP RCEs with VMware vDefend and Avi WAFvmware-security,