{"items":[{"id":"CVE-2026-109619","published":"2026-10-21T13:54:43.866Z","updated":"2026-11-04T17:47:40.945Z","title":"RCE via stale global state","severity":"CRITICAL","score":9.2,"vendor":"PHP Group","product":"PHP","kev":true,"epss":0.99999,"kevAdded":"2026-10-26"},{"id":"CVE-2026-109618","published":"2026-10-21T13:48:34.845Z","updated":"2026-11-04T17:47:39.617Z","title":"RCE via OOM corruption","severity":"CRITICAL","score":9.2,"vendor":"PHP Group","product":"PHP","kev":true,"epss":0.99999,"kevAdded":"2026-10-26"},{"id":"CVE-2026-92842","published":"2026-09-25T21:11:57.236Z","updated":"2026-09-28T13:31:31.256Z","title":"OOB read / info leak in convert.* stream filters when line-break-chars contains NUL","severity":"MEDIUM","score":5.9,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-91768","published":"2026-09-25T21:07:30.950Z","updated":"2026-09-28T13:31:31.382Z","title":"IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)","severity":"MEDIUM","score":6.5,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00376,"kevAdded":null},{"id":"CVE-2026-91769","published":"2026-09-25T20:59:39.727Z","updated":"2026-10-04T16:10:05.639Z","title":"TLS Hostname Verification Falls Back to CN After SAN Mismatch","severity":"MEDIUM","score":4.3,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-91767","published":"2026-09-25T20:53:42.587Z","updated":"2026-09-28T13:31:31.640Z","title":"Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN","severity":"MEDIUM","score":6.5,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00107,"kevAdded":null},{"id":"CVE-2025-1218","published":"2026-09-25T20:48:21.777Z","updated":"2026-09-28T13:31:31.774Z","title":"Various packet overreads in mysqlnd_writeprotocol.c","severity":"LOW","score":3.4,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2026-91766","published":"2026-09-25T20:40:25.040Z","updated":"2026-09-28T13:31:31.921Z","title":"Cross-origin credential leak in HTTP stream wrapper redirects","severity":"MEDIUM","score":5.9,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00286,"kevAdded":null},{"id":"CVE-2026-91765","published":"2026-09-25T20:33:03.634Z","updated":"2026-09-28T13:31:32.047Z","title":"SOAP: Unbounded Recursion in Server-Side cleanup_xml_node","severity":"HIGH","score":7.5,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00378,"kevAdded":null},{"id":"CVE-2025-14181","published":"2026-09-25T20:26:45.445Z","updated":"2026-09-25T20:44:13.720Z","title":"Integer overflow to buffer overflow in soap HTTP parsing","severity":"MEDIUM","score":6.5,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00312,"kevAdded":null},{"id":"CVE-2026-17545","published":"2026-09-25T20:18:11.288Z","updated":"2026-09-25T20:43:34.157Z","title":"PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS","severity":"MEDIUM","score":6.9,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2026-6103","published":"2026-09-25T20:08:49.333Z","updated":"2026-09-25T20:41:27.115Z","title":"Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection","severity":"MEDIUM","score":4.3,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.0016,"kevAdded":null},{"id":"CVE-2026-93682","published":"2026-09-25T20:02:11.467Z","updated":"2026-09-25T20:38:14.346Z","title":"Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header","severity":"MEDIUM","score":5.8,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2026-7260","published":"2026-07-30T11:22:53.918Z","updated":"2026-07-30T12:15:22.862Z","title":"Stack overflow in phar with circular symlinks","severity":"MEDIUM","score":5.4,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-17544","published":"2026-07-30T11:22:24.023Z","updated":"2026-07-31T03:55:47.261Z","title":"Out-of-bounds write in bccomp() via crafted operand and scale","severity":"HIGH","score":8.1,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00418,"kevAdded":null},{"id":"CVE-2026-17543","published":"2026-07-30T11:22:04.549Z","updated":"2026-07-31T03:55:46.475Z","title":"SQL injection in ext-pgsql via E'...' backslash breakout","severity":"HIGH","score":8.1,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-14355","published":"2026-07-03T20:57:31.958Z","updated":"2026-07-06T13:57:58.387Z","title":"ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD","severity":"MEDIUM","score":5.6,"vendor":"php","product":"php","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-7263","published":"2026-05-10T04:43:04.483Z","updated":"2026-07-15T00:40:16.236Z","title":"DoS attack via DOMNode::C14N()","severity":"MEDIUM","score":6.3,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00353,"kevAdded":null},{"id":"CVE-2026-6104","published":"2026-05-10T04:35:17.328Z","updated":"2026-07-15T00:41:42.455Z","title":"Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding","severity":"MEDIUM","score":6.3,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00469,"kevAdded":null},{"id":"CVE-2026-7258","published":"2026-05-10T04:28:14.520Z","updated":"2026-05-11T13:06:10.908Z","title":"Out-of-bounds read in urldecode() on NetBSD","severity":"MEDIUM","score":6.3,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00363,"kevAdded":null},{"id":"CVE-2026-6722","published":"2026-05-10T04:19:15.288Z","updated":"2026-07-23T12:08:11.781Z","title":"Use-After-Free in SOAP using Apache map","severity":"CRITICAL","score":9.5,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00894,"kevAdded":null},{"id":"CVE-2026-7259","published":"2026-05-10T04:13:26.766Z","updated":"2026-05-11T13:13:50.416Z","title":"Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()","severity":"LOW","score":2.1,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-7261","published":"2026-05-10T04:07:25.484Z","updated":"2026-05-11T13:14:26.451Z","title":"SoapServer session-persisted object use-after-free via SOAP header fault","severity":"MEDIUM","score":6.3,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00302,"kevAdded":null},{"id":"CVE-2026-7262","published":"2026-05-10T04:00:09.382Z","updated":"2026-07-15T00:40:18.277Z","title":"NULL pointer dereference in SOAP apache:Map decoder with missing <value>","severity":"LOW","score":2.9,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.0078,"kevAdded":null},{"id":"CVE-2025-14179","published":"2026-05-10T03:51:14.596Z","updated":"2026-07-15T01:27:20.859Z","title":"SQL injection in pdo_firebird via NUL bytes in quoted strings","severity":"HIGH","score":7.4,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00439,"kevAdded":null},{"id":"CVE-2026-7568","published":"2026-05-10T03:42:36.433Z","updated":"2026-07-15T00:39:53.392Z","title":"Signed integer overflow in metaphone()","severity":"MEDIUM","score":6.3,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2026-6735","published":"2026-05-10T03:27:00.607Z","updated":"2026-05-11T13:25:54.957Z","title":"XSS within PHP-FPM status endpoint","severity":"HIGH","score":7.3,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2025-14177","published":"2025-12-27T19:33:23.973Z","updated":"2025-12-29T16:01:36.231Z","title":"Information Leak of Memory in getimagesize","severity":"MEDIUM","score":6.3,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00504,"kevAdded":null},{"id":"CVE-2025-14178","published":"2025-12-27T19:27:41.691Z","updated":"2026-01-24T11:04:01.892Z","title":"Heap buffer overflow in array_merge()","severity":"MEDIUM","score":6.5,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2025-14180","published":"2025-12-27T19:21:20.768Z","updated":"2025-12-29T16:00:11.239Z","title":"NULL Pointer Dereference in PDO quoting","severity":"HIGH","score":8.2,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00697,"kevAdded":null},{"id":"CVE-2025-1735","published":"2025-07-13T22:27:48.299Z","updated":"2025-11-04T21:09:33.172Z","title":"pgsql extension does not check for errors during escaping","severity":"MEDIUM","score":5.9,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.01157,"kevAdded":null},{"id":"CVE-2025-1220","published":"2025-07-13T22:18:36.974Z","updated":"2025-11-04T21:09:17.792Z","title":"Null byte termination in hostnames","severity":"LOW","score":3.7,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.0074,"kevAdded":null},{"id":"CVE-2025-6491","published":"2025-07-13T22:10:15.996Z","updated":"2025-11-04T21:14:48.898Z","title":"NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix","severity":"MEDIUM","score":5.9,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.01117,"kevAdded":null},{"id":"CVE-2024-11235","published":"2025-04-04T17:51:07.550Z","updated":"2026-02-26T18:28:56.191Z","title":"Reference counting in php_request_shutdown causes Use-After-Free","severity":"CRITICAL","score":9.2,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.01482,"kevAdded":null},{"id":"CVE-2025-1861","published":"2025-03-30T05:57:57.894Z","updated":"2025-11-03T20:57:13.769Z","title":"Stream HTTP wrapper truncates redirect location to 1024 bytes","severity":"MEDIUM","score":6.3,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00856,"kevAdded":null},{"id":"CVE-2025-1736","published":"2025-03-30T05:49:14.551Z","updated":"2025-11-03T20:57:10.963Z","title":"Stream HTTP wrapper header check might omit basic auth header","severity":"MEDIUM","score":6.3,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00554,"kevAdded":null},{"id":"CVE-2025-1734","published":"2025-03-30T05:43:35.771Z","updated":"2025-11-03T20:57:09.506Z","title":"Streams HTTP wrapper does not fail for headers with invalid name and no colon","severity":"MEDIUM","score":6.3,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00502,"kevAdded":null},{"id":"CVE-2025-1219","published":"2025-03-30T05:33:13.801Z","updated":"2025-11-03T20:57:06.601Z","title":"libxml streams use wrong content-type header when requesting a redirected resource","severity":"MEDIUM","score":6.3,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00749,"kevAdded":null},{"id":"CVE-2025-1217","published":"2025-03-29T05:19:33.696Z","updated":"2025-11-03T20:57:05.208Z","title":"Header parser of http stream wrapper does not handle folded headers","severity":"MEDIUM","score":6.3,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00585,"kevAdded":null},{"id":"CVE-2022-31631","published":"2025-02-12T22:10:45.418Z","updated":"2025-02-13T16:06:41.825Z","title":"PDO::quote() may return unquoted string","severity":"CRITICAL","score":9.1,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.02189,"kevAdded":null},{"id":"CVE-2024-11233","published":"2024-11-24T01:08:28.663Z","updated":"2025-11-03T21:51:48.654Z","title":"Single byte overread with convert.quoted-printable-decode filter","severity":"MEDIUM","score":4.8,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.01607,"kevAdded":null},{"id":"CVE-2024-11234","published":"2024-11-24T00:57:39.349Z","updated":"2025-11-03T21:51:51.580Z","title":"Configuring a proxy in a stream context might allow for CRLF injection in URIs","severity":"MEDIUM","score":4.8,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.01108,"kevAdded":null},{"id":"CVE-2024-11236","published":"2024-11-24T00:44:54.951Z","updated":"2025-11-03T21:51:54.520Z","title":"Integer overflow in the firebird and dblib quoters causing OOB writes","severity":"CRITICAL","score":9.8,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.02065,"kevAdded":null},{"id":"CVE-2024-8929","published":"2024-11-22T06:15:29.643Z","updated":"2025-11-03T22:33:10.858Z","title":"Leak partial content of the heap through heap buffer over-read in mysqlnd","severity":"MEDIUM","score":5.8,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.02238,"kevAdded":null},{"id":"CVE-2024-8932","published":"2024-11-22T06:03:29.764Z","updated":"2025-11-03T22:33:12.327Z","title":"OOB access in ldap_escape","severity":"CRITICAL","score":9.8,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.01275,"kevAdded":null},{"id":"CVE-2024-9026","published":"2024-10-08T04:07:33.452Z","updated":"2025-11-03T22:33:15.254Z","title":"PHP-FPM logs from children may be altered","severity":"LOW","score":3.3,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00487,"kevAdded":null},{"id":"CVE-2024-8927","published":"2024-10-08T03:56:31.849Z","updated":"2025-11-03T22:33:09.411Z","title":"cgi.force_redirect configuration is bypassable due to the environment variable collision","severity":"HIGH","score":7.5,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.01054,"kevAdded":null},{"id":"CVE-2024-8926","published":"2024-10-08T03:48:53.628Z","updated":"2025-11-03T22:33:06.473Z","title":"PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)","severity":"HIGH","score":8.1,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.03662,"kevAdded":null},{"id":"CVE-2024-8925","published":"2024-10-08T03:35:02.673Z","updated":"2025-11-03T22:33:05.003Z","title":"Erroneous parsing of multipart form data","severity":"LOW","score":3.1,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00935,"kevAdded":null},{"id":"CVE-2024-2408","published":"2024-06-09T19:55:51.625Z","updated":"2025-03-21T18:03:45.831Z","title":"PHP is vulnerable to the Marvin Attack","severity":"MEDIUM","score":5.9,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.01158,"kevAdded":null},{"id":"CVE-2024-4577","published":"2024-06-09T19:42:36.464Z","updated":"2025-10-21T23:05:16.089Z","title":"Argument Injection in PHP-CGI","severity":"CRITICAL","score":9.8,"vendor":"PHP Group","product":"PHP","kev":true,"epss":0.99987,"kevAdded":"2024-06-12"},{"id":"CVE-2024-5585","published":"2024-06-09T18:36:50.477Z","updated":"2025-02-13T17:54:21.435Z","title":"Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)","severity":"HIGH","score":7.7,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.28807,"kevAdded":null},{"id":"CVE-2024-5458","published":"2024-06-09T18:26:28.804Z","updated":"2025-11-03T22:32:24.445Z","title":"Filter bypass in filter_var (FILTER_VALIDATE_URL)","severity":"MEDIUM","score":5.3,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.12117,"kevAdded":null},{"id":"CVE-2024-1874","published":"2024-04-29T03:57:35.624Z","updated":"2025-11-04T18:22:36.621Z","title":"Command injection via array-ish $command parameter of proc_open()","severity":"CRITICAL","score":9.4,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.32799,"kevAdded":null},{"id":"CVE-2024-2757","published":"2024-04-29T03:49:15.519Z","updated":"2025-11-04T17:18:03.534Z","title":"PHP mb_encode_mimeheader runs endlessly for some inputs","severity":"HIGH","score":7.5,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.01924,"kevAdded":null},{"id":"CVE-2024-3096","published":"2024-04-29T03:42:04.093Z","updated":"2025-11-04T17:19:57.320Z","title":"PHP function password_verify can erroneously return true when argument contains NUL","severity":"MEDIUM","score":6.5,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.01492,"kevAdded":null},{"id":"CVE-2024-2756","published":"2024-04-29T03:34:16.912Z","updated":"2025-11-04T17:18:00.434Z","title":"__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix","severity":"MEDIUM","score":6.5,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.38115,"kevAdded":null},{"id":"CVE-2023-3824","published":"2023-08-11T05:48:34.082Z","updated":"2025-02-13T17:01:48.673Z","title":"Buffer overflow and overread in phar_dir_read()","severity":"CRITICAL","score":9.4,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.21786,"kevAdded":null},{"id":"CVE-2023-3823","published":"2023-08-11T05:42:25.771Z","updated":"2025-02-13T17:01:48.139Z","title":"Security issue with external entity loading in XML without enabling it","severity":"HIGH","score":8.6,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.0164,"kevAdded":null},{"id":"CVE-2023-3247","published":"2023-07-22T04:17:09.896Z","updated":"2024-10-15T20:34:03.327Z","title":"Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP","severity":"LOW","score":2.6,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00709,"kevAdded":null},{"id":"CVE-2023-0568","published":"2023-02-16T06:34:04.101Z","updated":"2025-03-18T14:57:10.966Z","title":"Array overrun in common path resolve code","severity":"HIGH","score":7.5,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.01242,"kevAdded":null},{"id":"CVE-2023-0662","published":"2023-02-16T06:24:01.692Z","updated":"2025-03-18T14:58:15.370Z","title":"DoS vulnerability when parsing multipart request body","severity":"HIGH","score":7.5,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.01469,"kevAdded":null},{"id":"CVE-2023-0567","published":"2023-02-16T06:15:50.127Z","updated":"2026-07-19T18:24:30.482Z","title":"password_verify() always returns true for some invalid hashes","severity":"HIGH","score":7.7,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00925,"kevAdded":null},{"id":"CVE-2022-31630","published":"2022-11-14T06:53:06.774Z","updated":"2024-08-03T07:26:01.044Z","title":"OOB read due to insufficient input validation in imageloadfont()","severity":"MEDIUM","score":6.5,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.01317,"kevAdded":null},{"id":"CVE-2022-31629","published":"2022-09-28T22:25:10.116Z","updated":"2025-11-04T17:12:24.069Z","title":"$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities","severity":"MEDIUM","score":6.5,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.49569,"kevAdded":null},{"id":"CVE-2022-31628","published":"2022-09-28T22:25:09.309Z","updated":"2025-05-20T20:24:57.733Z","title":"phar wrapper can occur dos when using quine gzip file","severity":"LOW","score":2.3,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.00628,"kevAdded":null},{"id":"CVE-2022-31627","published":"2022-07-28T05:50:09.522Z","updated":"2024-09-16T21:02:46.605Z","title":"Heap buffer overflow in finfo_buffer","severity":"HIGH","score":7.7,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.02141,"kevAdded":null},{"id":"CVE-2022-31626","published":"2022-06-16T05:45:16.880Z","updated":"2024-09-17T03:38:54.950Z","title":"mysqlnd/pdo password buffer overflow","severity":"HIGH","score":7.5,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.58123,"kevAdded":null},{"id":"CVE-2022-31625","published":"2022-06-16T05:45:15.228Z","updated":"2024-09-16T18:35:01.122Z","title":"Freeing unallocated memory in php_pgsql_free_params()","severity":"HIGH","score":8.1,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.0379,"kevAdded":null},{"id":"CVE-2021-21708","published":"2022-02-27T08:00:12.018Z","updated":"2024-09-17T03:18:02.531Z","title":"UAF due to php_filter_float() failing","severity":"HIGH","score":8.2,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.03002,"kevAdded":null},{"id":"CVE-2021-21707","published":"2021-11-29T06:25:08.814Z","updated":"2024-09-17T03:38:22.394Z","title":"Special characters break path parsing in XML functions","severity":"MEDIUM","score":5.3,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.25315,"kevAdded":null},{"id":"CVE-2021-21703","published":"2021-10-25T05:40:08.576Z","updated":"2024-09-17T03:02:55.020Z","title":"PHP-FPM memory access in root process leading to privilege escalation","severity":"HIGH","score":7.8,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.01426,"kevAdded":null},{"id":"CVE-2021-21706","published":"2021-10-04T04:00:17.182Z","updated":"2024-09-16T23:06:09.569Z","title":"ZipArchive::extractTo may extract outside of destination dir","severity":"MEDIUM","score":5.3,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.01517,"kevAdded":null},{"id":"CVE-2021-21705","published":"2021-10-04T04:00:15.654Z","updated":"2024-09-17T04:09:29.556Z","title":"Incorrect URL validation in FILTER_VALIDATE_URL","severity":"MEDIUM","score":4.3,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.02091,"kevAdded":null},{"id":"CVE-2021-21704","published":"2021-10-04T04:00:13.838Z","updated":"2024-09-17T00:45:32.187Z","title":"Multiple vulnerabilities in Firebird client extension","severity":"MEDIUM","score":5,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.01796,"kevAdded":null},{"id":"CVE-2021-21702","published":"2021-02-15T04:10:16.837Z","updated":"2024-09-16T17:34:26.201Z","title":"Null Dereference in SoapClient","severity":"MEDIUM","score":5.3,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.03152,"kevAdded":null},{"id":"CVE-2020-7071","published":"2021-02-15T04:10:16.239Z","updated":"2024-09-16T17:28:54.077Z","title":"FILTER_VALIDATE_URL accepts URLs with invalid userinfo","severity":"MEDIUM","score":5.3,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.02902,"kevAdded":null},{"id":"CVE-2020-7070","published":"2020-10-02T14:14:45.406Z","updated":"2024-09-16T16:28:36.773Z","title":"PHP parses encoded cookie names so malicious `__Host-` cookies can be sent","severity":"MEDIUM","score":4.3,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.05029,"kevAdded":null},{"id":"CVE-2020-7069","published":"2020-10-02T14:14:45.340Z","updated":"2024-09-17T04:04:37.418Z","title":"Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV","severity":"MEDIUM","score":5.4,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.02055,"kevAdded":null},{"id":"CVE-2020-7068","published":"2020-09-09T17:58:42.837Z","updated":"2024-09-17T00:36:03.824Z","title":"Use of freed hash key in the phar_parse_zipfile function","severity":"MEDIUM","score":4.8,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.01661,"kevAdded":null},{"id":"CVE-2019-11048","published":"2020-05-20T07:15:15.636Z","updated":"2024-09-16T18:13:31.009Z","title":"Temporary files are not cleaned after OOM when parsing HTTP request data","severity":"MEDIUM","score":5.3,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.06264,"kevAdded":null},{"id":"CVE-2020-7067","published":"2020-04-27T20:38:39.634Z","updated":"2024-09-17T02:21:12.549Z","title":"OOB Read in urldecode()","severity":"HIGH","score":7.5,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.04311,"kevAdded":null},{"id":"CVE-2020-7066","published":"2020-04-01T03:35:14.021Z","updated":"2024-09-17T01:51:01.194Z","title":"get_headers() silently truncates after a null byte","severity":"MEDIUM","score":5.3,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.02767,"kevAdded":null},{"id":"CVE-2020-7065","published":"2020-04-01T03:35:13.554Z","updated":"2024-09-17T04:25:45.769Z","title":"mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_full","severity":"HIGH","score":7.4,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.04883,"kevAdded":null},{"id":"CVE-2020-7064","published":"2020-04-01T03:35:13.144Z","updated":"2024-09-16T23:56:45.058Z","title":"Use-of-uninitialized-value in exif","severity":"MEDIUM","score":6.5,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.04295,"kevAdded":null},{"id":"CVE-2020-7063","published":"2020-02-27T20:25:15.606Z","updated":"2024-09-16T16:49:14.274Z","title":"Files added to tar with Phar::buildFromIterator have all-access permissions","severity":"MEDIUM","score":5.5,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.01594,"kevAdded":null},{"id":"CVE-2020-7062","published":"2020-02-27T20:25:15.153Z","updated":"2024-09-16T22:24:49.661Z","title":"Null Pointer Dereference in PHP Session Upload Progress","severity":"HIGH","score":7.5,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.03581,"kevAdded":null},{"id":"CVE-2020-7061","published":"2020-02-27T20:25:14.751Z","updated":"2024-09-17T01:21:01.352Z","title":"heap-buffer-overflow in phar_extract_file","severity":"MEDIUM","score":6.5,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.04075,"kevAdded":null},{"id":"CVE-2020-7060","published":"2020-02-10T07:45:14.320Z","updated":"2024-09-17T03:33:06.766Z","title":"global buffer-overflow in mbfl_filt_conv_big5_wchar","severity":"MEDIUM","score":6.5,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.08888,"kevAdded":null},{"id":"CVE-2020-7059","published":"2020-02-10T07:45:13.921Z","updated":"2024-09-17T02:37:14.052Z","title":"OOB read in php_strip_tags_ex","severity":"MEDIUM","score":6.5,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.07402,"kevAdded":null},{"id":"CVE-2019-11050","published":"2019-12-23T02:40:18.861Z","updated":"2024-09-16T18:33:19.281Z","title":"Use-after-free in exif parsing under memory sanitizer","severity":"MEDIUM","score":4.8,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.07624,"kevAdded":null},{"id":"CVE-2019-11049","published":"2019-12-23T02:40:18.474Z","updated":"2024-09-16T20:47:57.583Z","title":"mail() may release string with refcount==1 twice","severity":"MEDIUM","score":6.5,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.04218,"kevAdded":null},{"id":"CVE-2019-11047","published":"2019-12-23T02:40:17.978Z","updated":"2024-09-17T04:24:19.473Z","title":"Heap-buffer-overflow READ in exif","severity":"MEDIUM","score":4.8,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.07473,"kevAdded":null},{"id":"CVE-2019-11046","published":"2019-12-23T02:40:17.526Z","updated":"2024-09-16T17:52:45.661Z","title":"Buffer underflow in bc_shift_addsub","severity":"LOW","score":3.7,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.04116,"kevAdded":null},{"id":"CVE-2019-11045","published":"2019-12-23T02:40:17.130Z","updated":"2024-09-16T17:32:41.178Z","title":"DirectoryIterator class silently truncates after a null byte","severity":"LOW","score":3.7,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.08818,"kevAdded":null},{"id":"CVE-2019-11044","published":"2019-12-23T02:40:16.742Z","updated":"2024-09-17T01:47:06.457Z","title":"link() silently truncates after a null byte on Windows","severity":"LOW","score":3.7,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.05124,"kevAdded":null},{"id":"CVE-2019-11043","published":"2019-10-28T14:19:04.252Z","updated":"2025-10-21T23:45:28.408Z","title":"Underflow in PHP-FPM can lead to RCE","severity":"HIGH","score":8.7,"vendor":"PHP","product":"PHP","kev":true,"epss":0.99783,"kevAdded":"2022-03-25"},{"id":"CVE-2019-11042","published":"2019-08-09T19:26:34.193Z","updated":"2024-09-17T02:15:56.650Z","title":"heap-buffer-overflow on exif_process_user_comment in EXIF extension","severity":"MEDIUM","score":4.8,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.0442,"kevAdded":null},{"id":"CVE-2019-11041","published":"2019-08-09T19:26:34.152Z","updated":"2024-09-16T19:31:07.181Z","title":"heap-buffer-overflow on exif_scan_thumbnail in EXIF extension","severity":"MEDIUM","score":4.8,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.0442,"kevAdded":null},{"id":"CVE-2019-11040","published":"2019-06-18T23:28:28.320Z","updated":"2024-09-16T17:23:01.910Z","title":"Heap buffer overflow in EXIF extension","severity":"MEDIUM","score":4.8,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.04068,"kevAdded":null},{"id":"CVE-2019-11039","published":"2019-06-18T23:28:28.280Z","updated":"2024-09-17T00:21:46.316Z","title":"Out-of-bounds read in iconv.c","severity":"MEDIUM","score":4.2,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.0313,"kevAdded":null},{"id":"CVE-2019-11038","published":"2019-06-18T23:28:28.236Z","updated":"2024-09-16T21:04:15.889Z","title":"Uninitialized read in gdImageCreateFromXbm","severity":"LOW","score":3.1,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.04332,"kevAdded":null},{"id":"CVE-2019-11037","published":"2019-05-03T19:28:15.611Z","updated":"2024-09-16T17:43:40.554Z","title":"Out of bounds memory write in PHP Imagick extension","severity":"MEDIUM","score":4.9,"vendor":"PHP Group","product":"PHP Imagick extension","kev":false,"epss":0.01972,"kevAdded":null},{"id":"CVE-2019-11036","published":"2019-05-03T19:28:15.566Z","updated":"2024-09-16T22:30:46.095Z","title":"Heap over-read in PHP EXIF extension","severity":"MEDIUM","score":4.8,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.07031,"kevAdded":null},{"id":"CVE-2019-11035","published":"2019-04-18T16:57:00.996Z","updated":"2024-09-17T03:43:08.668Z","title":"Heap over-read in PHP EXIF extension","severity":"MEDIUM","score":4.8,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.04409,"kevAdded":null},{"id":"CVE-2019-11034","published":"2019-04-18T16:57:00.954Z","updated":"2024-09-17T02:31:25.024Z","title":"Heap over-read in PHP EXIF extension","severity":"MEDIUM","score":4.8,"vendor":"PHP Group","product":"PHP","kev":false,"epss":0.04094,"kevAdded":null}]}