PHP CVE feed and alerts
Every new CVE and security advisory affecting PHP, merged from the CVE List, GitHub, OSV, NVD and CISA KEV into one entry each, with severity, exploitation status and fixed versions. New entries appear within minutes of their source. The feeds are free and need no API key; the newest 200 are listed below.
- Critical
- 23
- High
- 40
- On CISA KEV
- 4
Of the newest 164
- CVE-2026-128014FrankenPHP out-of-bounds write in bundled Brotli decoderfrankenphp
- CVE-2026-128015FrankenPHP use-after-free in putenv() during shutdownfrankenphp
- CVE-2026-128016FrankenPHP memory disclosure and crash via SplTempFileObject streamsfrankenphp
- CVE-2026-128017FrankenPHP denial of service via double free in worker modefrankenphp
- CVE-2026-128018FrankenPHP denial of service in worker request handlingfrankenphp
- CVE-2026-128019FrankenPHP information disclosure via per-request env variable leakfrankenphp
- CVE-2026-128020FrankenPHP denial of service in PHP-to-Go array converterfrankenphp
- CVE-2026-128021FrankenPHP information disclosure via libxml errors in worker modefrankenphp
- CVE-2026-128022FrankenPHP denial of service via abandoned requests in thread poolfrankenphp
- CVE-2026-128023FrankenPHP authentication bypass in header name handlingfrankenphp
- CVE-2026-128024FrankenPHP denial of service via nil type assertion in goArrayfrankenphp
- CVE-2026-128025FrankenPHP access rule bypass in CGI splitPosfrankenphp
- CVE-2026-128026FrankenPHP cross-request environment leakage via putenvfrankenphp
- CVE-2026-128027FrankenPHP remote code execution via stale libraries in base imagefrankenphp
- CVE-2026-122233FrankenPHP information disclosure of response headers in worker modefrankenphp
- CVE-2026-103420StageIt extension for Joomla forged user actions via CSRF in extensionphp-web-design.com StageIt extension for Joomla
- CVE-2026-105600StageIt extension for Joomla remote code execution via crafted setting stringsphp-web-design.com StageIt extension for Joomla
- CVE-2026-105601StageIt extension for Joomla reflected XSS in CMS extensionphp-web-design.com StageIt extension for Joomla
- CVE-2026-109619PHP remote code execution via stale global statePHP Group PHP · libphp +2
- CVE-2026-109618PHP remote code execution in out-of-memory handlingPHP Group PHP · libphp +2
- CVE-2026-85733FrankenPHP: Docker images serve phpinfo() as the default index.php, leaking environment variablesfrankenphp
- CVE-2026-82416FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared modulefrankenphp · github.com/dunglas/frankenphp
- CVE-2026-92842OOB read / info leak in convert. stream filters when line-break-chars contains NULPHP Group PHP
- CVE-2026-91768IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)PHP Group PHP
- CVE-2026-91769TLS Hostname Verification Falls Back to CN After SAN MismatchPHP Group PHP
- CVE-2026-91767Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CNPHP Group PHP
- CVE-2025-1218Various packet overreads in mysqlnd_writeprotocol.cPHP Group PHP
- CVE-2026-91766Cross-origin credential leak in HTTP stream wrapper redirectsPHP Group PHP
- CVE-2026-91765SOAP: Unbounded Recursion in Server-Side cleanup_xml_nodePHP Group PHP
- CVE-2025-14181Integer overflow to buffer overflow in soap HTTP parsingPHP Group PHP
- CVE-2026-17545PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoSPHP Group PHP
- CVE-2026-6103Phar TAR phar_tar_number() Integer Overflow - Archive Entry InjectionPHP Group PHP · libphp +2
- CVE-2026-93682Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location headerPHP Group PHP
- CVE-2026-46594Reflected XSS in PHP Poll ScriptPHP Jabbers PHP Poll Script
- CVE-2026-46593Authenticated SQL Injection in PHP Poll ScriptPHP Jabbers PHP Poll Script
- CVE-2025-67651CSRF in PHP Jabbers scriptsPHP Jabbers Appointment Scheduler · PHP Jabbers Bus Res… +33
- CVE-2025-67650Authenticated SQL Injection in PHP Jabbers scriptsPHP Jabbers Appointment Scheduler · PHP Jabbers Bus Res… +33
- CVE-2025-67649Unauthenticated SQL Injection in PHP Jabbers - Car Rental Script scriptPHP Jabbers Car Rental Script
- CVE-2026-7260Stack overflow in phar with circular symlinksPHP Group PHP
- CVE-2026-17544Out-of-bounds write in bccomp() via crafted operand and scalePHP Group PHP
- CVE-2026-17543SQL injection in ext-pgsql via E'...' backslash breakoutPHP Group PHP
- CVE-2026-14355ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PADphp
- CVE-2026-48979PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smugglingphp-standard-library · php-standard-library/h2 +1
- CVE-2026-45062FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Filesfrankenphp · github.com/dunglas/frankenphp
- CVE-2026-10273php-censor Webhook Endpoint GitBuild.php os command injectionphp-censor
- CVE-2026-7263DoS attack via DOMNode::C14N()PHP Group PHP
- CVE-2026-6104Global buffer over-read in mb_convert_encoding() with attacker-supplied encodingPHP Group PHP
- CVE-2026-7258Out-of-bounds read in urldecode() on NetBSDPHP Group PHP
- CVE-2026-6722Use-After-Free in SOAP using Apache mapPHP Group PHP
- CVE-2026-7259Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()PHP Group PHP
- CVE-2026-7261SoapServer session-persisted object use-after-free via SOAP header faultPHP Group PHP
- CVE-2026-7262NULL pointer dereference in SOAP apache:Map decoder with missing <value>PHP Group PHP
- CVE-2025-14179SQL injection in pdo_firebird via NUL bytes in quoted stringsPHP Group PHP
- CVE-2026-7568Signed integer overflow in metaphone()PHP Group PHP
- CVE-2026-6735PHP cross-site scripting in FPM status endpointPHP Group PHP
- CVE-2025-41011HTML injection in PHP Point Of SalePHP Point Of Sale
- CVE-2026-24895FrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary filesfrankenphp · github.com/dunglas/frankenphp
- CVE-2026-24894FrankenPHP leaks session data between requests in worker modefrankenphp · github.com/dunglas/frankenphp
- CVE-2020-37152PHP-Fusion 9.03.50 panels.php - Cross-Site Scripting (XSS)PHP-Fusion
- CVE-2020-36996PHPFusion 9.03.50 - Persistent Cross-Site ScriptingPhp-Fusion PHPFusion
- CVE-2025-14177Information Leak of Memory in getimagesizePHP Group PHP
- CVE-2025-14178Heap buffer overflow in array_merge()PHP Group PHP
- CVE-2025-14180NULL Pointer Dereference in PDO quotingPHP Group PHP
- CVE-2023-53928PHPFusion 9.10.30 Stored Cross-Site Scripting via File Manager UploadPhp-fusion PHPFusion
- CVE-2012-10056PHP Volunteer Management System 1.0.2 Arbitrary File UploadPHP Volunteer Management
- CVE-2013-10070PHP-Charts v1.0 PHP Code ExecutionPHP-Charts
- CVE-2025-1735pgsql extension does not check for errors during escapingPHP Group PHP
- CVE-2025-1220Null byte termination in hostnamesPHP Group PHP
- CVE-2025-6491NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace PrefixPHP Group PHP
- CVE-2024-11235Reference counting in php_request_shutdown causes Use-After-FreePHP Group PHP
- CVE-2025-1861Stream HTTP wrapper truncates redirect location to 1024 bytesPHP Group PHP
- CVE-2025-1736Stream HTTP wrapper header check might omit basic auth headerPHP Group PHP
- CVE-2025-1734Streams HTTP wrapper does not fail for headers with invalid name and no colonPHP Group PHP
- CVE-2025-1219libxml streams use wrong content-type header when requesting a redirected resourcePHP Group PHP
- CVE-2025-1217Header parser of http stream wrapper does not handle folded headersPHP Group PHP
- CVE-2022-31631PDO::quote() may return unquoted stringPHP Group PHP
- CVE-2024-11233Single byte overread with convert.quoted-printable-decode filterPHP Group PHP
- CVE-2024-11234Configuring a proxy in a stream context might allow for CRLF injection in URIsPHP Group PHP
- CVE-2024-11236Integer overflow in the firebird and dblib quoters causing OOB writesPHP Group PHP
- CVE-2024-8929Leak partial content of the heap through heap buffer over-read in mysqlndPHP Group PHP
- CVE-2024-8932OOB access in ldap_escapePHP Group PHP
- CVE-2024-9026PHP-FPM logs from children may be alteredPHP Group PHP
- CVE-2024-8927cgi.force_redirect configuration is bypassable due to the environment variable collisionPHP Group PHP
- CVE-2024-8926PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)PHP Group PHP
- CVE-2024-8925Erroneous parsing of multipart form dataPHP Group PHP
- CVE-2024-2408PHP is vulnerable to the Marvin AttackPHP Group PHP
- CVE-2024-4577PHP code execution via argument injection in CGI modulePHP Group PHP
- CVE-2024-5585Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)PHP Group PHP
- CVE-2024-5458Filter bypass in filter_var (FILTER_VALIDATE_URL)PHP Group PHP
- CVE-2024-5312Cross-Site Scripting vulnerability in PHP Server MonitorPHP Server Monitor · phpservermon/phpservermon
- CVE-2024-1874Command injection via array-ish $command parameter of proc_open()PHP Group PHP
- CVE-2024-2757PHP mb_encode_mimeheader runs endlessly for some inputsPHP Group PHP
- CVE-2024-3096PHP function password_verify can erroneously return true when argument contains NULPHP Group PHP
- CVE-2024-2756Host-/Secure- cookie bypass due to partial CVE-2022-31629 fixPHP Group PHP
- CVE-2022-4900Potential buffer overflow in php_cli_server_startup_workersphp · Red Hat Enterprise Linux +2
- CVE-2023-3824Buffer overflow and overread in phar_dir_read()PHP Group PHP
- CVE-2023-3823Security issue with external entity loading in XML without enabling itPHP Group PHP
- CVE-2023-4117PHP Jabbers Rental Property Booking index.php cross site scriptingPHP Jabbers Rental Property Booking
- CVE-2023-4116PHP Jabbers Taxi Booking index.php cross site scriptingPHP Jabbers Taxi Booking
- CVE-2023-4115PHP Jabbers Cleaning Business index.php cross site scriptingPHP Jabbers Cleaning Business
- CVE-2023-4114PHP Jabbers Night Club Booking Software index.php cross site scriptingPHP Jabbers Night Club Booking Software
- CVE-2023-4113PHP Jabbers Service Booking Script index.php cross site scriptingPHP Jabbers Service Booking Script
- CVE-2023-4112PHP Jabbers Shuttle Booking Software index.php cross site scriptingPHP Jabbers Shuttle Booking Software
- CVE-2023-4111PHP Jabbers Bus Reservation System index.php cross site scriptingPHP Jabbers Bus Reservation System
- CVE-2023-3247Missing error check and insufficient random bytes in HTTP Digest authentication for SOAPPHP Group PHP
- CVE-2023-0568Array overrun in common path resolve codePHP Group PHP
- CVE-2023-0662DoS vulnerability when parsing multipart request bodyPHP Group PHP
- CVE-2023-0567password_verify() always returns true for some invalid hashesPHP Group PHP
- CVE-2022-31630OOB read due to insufficient input validation in imageloadfont()PHP Group PHP
- CVE-2022-40294CSV Injection in PHP Point of Sale version 19.0, by PHP Point of Sale, LLCPHP Point of Sale
- CVE-2022-40290The application was vulnerable to an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in the barcode generation functionality, allowing attackers to generate an unsafe link that…PHP Point of Sale
- CVE-2022-40287The application was found to be vulnerable to an authenticated Stored Cross-Site Scripting (XSS) vulnerability in messaging functionality, leading to privilege escalation or a compromise of a…PHP Point of Sale
- CVE-2022-40296The application was vulnerable to a Server-Side Request Forgery attacks, allowing the backend server to interact with unexpected endpoints, potentially including internal and local services, leading…PHP Point of Sale
- CVE-2022-40289The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the upload and download functionality, which could be leveraged to escalate privileges or compromise any…PHP Point of Sale
- CVE-2022-40292The application allowed for Unauthenticated User Enumeration by interacting with an unsecured endpoint to retrieve information on each account within the systemPHP Point of Sale
- CVE-2022-40291Cross-site request forgery (CSRF) in PHP Point of Sale version 19.0, by PHP Point of Sale, LLCPHP Point of Sale
- CVE-2022-40293The application was vulnerable to a session fixation that could be used hijack accountsPHP Point of Sale
- CVE-2022-40288Stored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via messaging functionalityPHP Point of Sale
- CVE-2022-31629$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilitiesPHP Group PHP
- CVE-2022-31628phar wrapper can occur dos when using quine gzip filePHP Group PHP
- CVE-2022-31627Heap buffer overflow in finfo_bufferPHP Group PHP
- CVE-2022-31626mysqlnd/pdo password buffer overflowPHP Group PHP
- CVE-2022-31625Freeing unallocated memory in php_pgsql_free_params()PHP Group PHP
- CVE-2021-21708UAF due to php_filter_float() failingPHP Group PHP
- CVE-2021-21707Special characters break path parsing in XML functionsPHP Group PHP
- CVE-2021-21703PHP-FPM memory access in root process leading to privilege escalationPHP Group PHP
- CVE-2021-21706ZipArchive::extractTo may extract outside of destination dirPHP Group PHP
- CVE-2021-21705Incorrect URL validation in FILTER_VALIDATE_URLPHP Group PHP
- CVE-2021-21704Multiple vulnerabilities in Firebird client extensionPHP Group PHP
- CVE-2021-21702Null Dereference in SoapClientPHP Group PHP
- CVE-2020-7071FILTER_VALIDATE_URL accepts URLs with invalid userinfoPHP Group PHP
- CVE-2020-7070In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decodedPHP Group PHP
- CVE-2020-7069Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IVPHP Group PHP
- CVE-2020-7068Use of freed hash key in the phar_parse_zipfile functionPHP Group PHP
- CVE-2019-11048Temporary files are not cleaned after OOM when parsing HTTP request dataPHP Group PHP
- CVE-2020-7067OOB Read in urldecode()PHP Group PHP
- CVE-2020-7066get_headers() silently truncates after a null bytePHP Group PHP
- CVE-2020-7065mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_fullPHP Group PHP
- CVE-2020-7064Use-of-uninitialized-value in exifPHP Group PHP
- CVE-2020-7063Files added to tar with Phar::buildFromIterator have all-access permissionsPHP Group PHP
- CVE-2020-7062Null Pointer Dereference in PHP Session Upload ProgressPHP Group PHP
- CVE-2020-7061heap-buffer-overflow in phar_extract_filePHP Group PHP
- CVE-2014-3622Use-after-free vulnerability in the add_post_var function in the Posthandler component in PHP 5.6.x before 5.6.1 might allow remote attackers to execute arbitrary code by leveraging a third-party…PHP
- CVE-2020-7060global buffer-overflow in mbfl_filt_conv_big5_wcharPHP Group PHP
- CVE-2020-7059OOB read in php_strip_tags_exPHP Group PHP
- CVE-2019-11050Use-after-free in exif parsing under memory sanitizerPHP Group PHP
- CVE-2019-11049mail() may release string with refcount==1 twicePHP Group PHP
- CVE-2019-11047Heap-buffer-overflow READ in exifPHP Group PHP
- CVE-2019-11046Buffer underflow in bc_shift_addsubPHP Group PHP
- CVE-2019-11045DirectoryIterator class silently truncates after a null bytePHP Group PHP
- CVE-2019-11044link() silently truncates after a null byte on WindowsPHP Group PHP
- CVE-2019-11043PHP remote code execution in FastCGI process managerPHP
- CVE-2019-11042heap-buffer-overflow on exif_process_user_comment in EXIF extensionPHP Group PHP
- CVE-2019-11041heap-buffer-overflow on exif_scan_thumbnail in EXIF extensionPHP Group PHP
- CVE-2019-11040Heap buffer overflow in EXIF extensionPHP Group PHP
- CVE-2019-11039Out-of-bounds read in iconv.cPHP Group PHP
- CVE-2019-11038Uninitialized read in gdImageCreateFromXbmPHP Group PHP
- CVE-2019-11037Out of bounds memory write in PHP Imagick extensionPHP Group PHP Imagick extension
- CVE-2019-11036Heap over-read in PHP EXIF extensionPHP Group PHP
- CVE-2019-11035Heap over-read in PHP EXIF extensionPHP Group PHP
- CVE-2019-11034Heap over-read in PHP EXIF extensionPHP Group PHP
- CVE-2016-7479In all versions of PHP 7, during the unserialization process, resizing the 'properties' hash table of a serialized object may lead to use-after-freePHP 7.x
- CVE-2016-7480The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or…PHP before
- CVE-2016-7478Zend/zend_exceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (infinite loop) via a crafted Exception object in serialized…PHP before
Get alerts for new PHP CVEs
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/feed?tech=php
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/feed?tech=php in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/feed?tech=php&format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/feed?tech=php&format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
Frequently asked questions
What are the latest PHP CVEs?
The newest are CVE-2026-128014 (FrankenPHP out-of-bounds write in bundled Brotli decoder); CVE-2026-128015 (FrankenPHP use-after-free in putenv() during shutdown); CVE-2026-128016 (FrankenPHP memory disclosure and crash via SplTempFileObject streams).
Are any PHP CVEs being exploited?
4 of the 164 newest PHP vulnerabilities are on CISA's Known Exploited Vulnerabilities list: CVE-2026-109619, CVE-2026-109618, CVE-2024-4577, CVE-2019-11043.
How many critical PHP CVEs are there?
23 of the 164 newest are rated critical (CVSS 9.0 or higher, or rated critical by their source when they have no score): CVE-2026-128014, CVE-2026-128023, CVE-2026-128027, CVE-2026-109619, CVE-2026-109618 and more.
How do I get alerts for new PHP CVEs?
Subscribe to this page's RSS, Atom or JSON feed, or connect a coding agent to the cve.now MCP server. Each new entry appears within minutes of its source.
Is there an RSS feed of PHP CVEs?
Yes: https://cve.now/feed?tech=php. Add format=atom or format=json for Atom or JSON Feed. It is free and needs no account or API key.
How do I get PHP CVEs in Slack or by email?
In Slack, run /feed subscribe https://cve.now/feed?tech=php. For email, give the RSS URL to any RSS-to-email service.