Product by Open Source
PHP
21 known vulnerabilities in PHP (Open Source), 0 of them actively exploited (CISA KEV).
Key figures
21
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
4
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2024-11235 | Reference counting in php_request_shutdown causes Use-After-Free | 8.1 | |
| Medium | CVE-2026-12184 | open source PHP: security vulnerability | — | |
| Critical | CVE-2025-1861 | Stream HTTP wrapper truncates redirect location to 1024 bytes | 9.8 | |
| Critical | CVE-2026-17544 | Out-of-bounds write in bccomp() via crafted operand and scale | 9.8 | |
| Critical | CVE-2026-17543 | SQL injection in ext-pgsql via E'...' backslash breakout | 9.8 | |
| High | CVE-2026-91765 | SOAP: Unbounded Recursion in Server-Side cleanup_xml_node | 7.5 | |
| High | CVE-2026-17545 | PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS | 7.5 | |
| Medium | CVE-2025-14181 | Integer overflow to buffer overflow in soap HTTP parsing | 6.5 | |
| Medium | CVE-2026-93682 | PHP: Out-of-bounds Read | 5.8 | |
| Medium | CVE-2025-1219 | libxml streams use wrong content-type header when requesting a redirected resource | 5.3 | |
| Medium | CVE-2026-91766 | Cross-origin credential leak in HTTP stream wrapper redirects | 5.9 | |
| Medium | CVE-2026-91767 | Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN | 6.5 | |
| High | CVE-2025-1736 | Stream HTTP wrapper header check might omit basic auth header | 7.3 | |
| Medium | CVE-2026-92842 | OOB read / info leak in convert.* stream filters when line-break-chars contains NUL | 5.9 | |
| Medium | CVE-2025-1217 | Header parser of http stream wrapper does not handle folded headers | 3.1 | |
| Medium | CVE-2025-1734 | Streams HTTP wrapper does not fail for headers with invalid name and no colon | 5.3 | |
| Medium | CVE-2026-14355 | ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD | 5.6 | |
| Medium | CVE-2026-91769 | TLS Hostname Verification Falls Back to CN After SAN Mismatch | 4.3 | |
| Medium | CVE-2025-1218 | Various packet overreads in mysqlnd_writeprotocol.c | 3.4 | |
| Medium | CVE-2026-6103 | Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection | 4.0 | |
| Medium | CVE-2026-7260 | Stack overflow in phar with circular symlinks | 5.5 |