Product by Debian
Php8.2
49 known vulnerabilities in Php8.2 (Debian), 2 of them actively exploited (CISA KEV).
Key figures
49
Vulnerabilities
2
Actively exploited (KEV)
0
Used by ransomware
10
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-109618 | RCE via OOM corruption In CISA KEValso in 12 other products | 9.8 | |
| Critical | CVE-2026-109619 | RCE via stale global state In CISA KEValso in 12 other products | 8.1 | |
| Critical | CVE-2023-3824 | Buffer overflow and overread in phar_dir_read() | 9.4 | |
| Medium | CVE-2024-2756 | __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix | 6.5 | |
| High | CVE-2024-8926 | PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass) | 8.1 | |
| Critical | CVE-2024-11236 | Integer overflow in the firebird and dblib quoters causing OOB writes | 9.8 | |
| Medium | CVE-2024-5458 | Filter bypass in filter_var (FILTER_VALIDATE_URL) | 5.3 | |
| Critical | CVE-2024-8932 | OOB access in ldap_escape | 9.8 | |
| Critical | CVE-2026-6722 | Use-After-Free in SOAP using Apache map | 9.8 | |
| High | CVE-2023-3823 | Security issue with external entity loading in XML without enabling it | 8.6 | |
| Medium | CVE-2024-8929 | Leak partial content of the heap through heap buffer over-read in mysqlnd | 5.8 | |
| Critical | CVE-2025-1861 | Stream HTTP wrapper truncates redirect location to 1024 bytes | 9.8 | |
| Medium | CVE-2024-3096 | PHP function password_verify can erroneously return true when argument contains NUL | 6.5 | |
| High | CVE-2026-7262 | NULL pointer dereference in SOAP apache:Map decoder with missing <value> | 7.5 | |
| Critical | CVE-2025-14179 | SQL injection in pdo_firebird via NUL bytes in quoted strings | 9.8 | |
| High | CVE-2024-8927 | cgi.force_redirect configuration is bypassable due to the environment variable collision | 7.5 | |
| High | CVE-2024-11233 | Single byte overread with convert.quoted-printable-decode filter | 4.8 | |
| Critical | CVE-2026-17543 | SQL injection in ext-pgsql via E'...' backslash breakout | 9.8 | |
| High | CVE-2025-14180 | NULL Pointer Dereference in PDO quoting | 7.5 | |
| High | CVE-2025-1735 | pgsql extension does not check for errors during escaping | 5.9 | |
| High | CVE-2026-91765 | SOAP: Unbounded Recursion in Server-Side cleanup_xml_node | 7.5 | |
| Medium | CVE-2025-6491 | NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix | 5.9 | |
| Critical | CVE-2026-7261 | SoapServer session-persisted object use-after-free via SOAP header fault | 9.8 | |
| Medium | CVE-2026-91768 | PHP: Incomplete Comparison with Missing Factors | 6.5 | |
| High | CVE-2026-7568 | Signed integer overflow in metaphone() | 7.5 |
News
- Multiples vulnérabilités dans Palo Alto Networks PAN-OS (28 octobre 2026)cert-fr,
- CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Executionthehackernews,
- PHP2Shell security flaws now sucessfully exploited in the wildbleepingcomputer,
- PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activitythehackernews,
- PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malwarethehackernews,
- PHP2Shell exposes the weakness in coordinated vulnerability disclosurecsoonline,