[ Vendor · 8 CVEs ]
PHP
CVEs affecting PHP published in the last 30 days, plus any PHP CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-82416 | 13 Oct 2026 | CVSS 7.7 | FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared moduleFrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the… | Fix |
| CVE-2026-85733 | 13 Oct 2026 | CVSS 5.3 | php frankenphpFrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default… | |
| CVE-2020-36193 | 18 Jan 2021 | CVSS 7.5 | PEAR Archive_Tar Improper Link ResolutionTar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue… | ExploitedFix |
| CVE-2020-28949 | 19 Nov 2020 | CVSS 7.8 | PEAR Archive_Tar Deserialization of Untrusted DataArchive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to… | Exploited |
| CVE-2019-11043 | 28 Oct 2019 | CVSS 9.8 | PHP FastCGI Process Manager (FPM) Buffer OverflowIn PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM… | ExploitedFix |
| CVE-2016-10033 | 30 Dec 2016 | CVSS 9.8 | PHPMailer Command InjectionThe mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command… | ExploitedFix |
| CVE-2012-1823 | 11 May 2012 | CVSS 9.8 | PHP-CGI Query String Parametersapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query… | ExploitedFix |
| CVE-2012-1823 | 11 May 2012 | CVSS 9.8 | PHP-CGI Query String Parametersapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query… | ExploitedFix |