PG
Vendor security profile1 actively exploited CVEs
PHP Group
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs12
Critical1
CISA KEV1
Public exploit5
Patch rate%0
Avg. CVSS6.1
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
0
11
0
CVE KEV
CVE severity distribution
12toplam CVE
Critical1 (8%)
High1 (8%)
Medium9 (75%)
Low1 (8%)
Patch and exploitation view
%0
Verified patch
%8
CISA KEV
%42
Public exploit
0Patch available
0Partial
1Workaround
0Vendor: no patch
11Unknown
Latest vulnerabilities
5.9
CVE-2026-92842
OOB read / info leak in convert.* stream filters when line-break-chars contains NUL
PG
Patch status unknownEPSS %0
6.5
CVE-2026-91768
IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)
PG
Patch status unknownEPSS %1
4.3
CVE-2026-91769
TLS Hostname Verification Falls Back to CN After SAN Mismatch
PG
Patch status unknownEPSS %0
6.5
CVE-2026-91767
Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN
PG
Patch status unknownEPSS %0
3.4
CVE-2025-1218
Various packet overreads in mysqlnd_writeprotocol.c
PG
Patch status unknownEPSS %0
5.9
CVE-2026-91766
Cross-origin credential leak in HTTP stream wrapper redirects
PG
Patch status unknownEPSS %0
7.5
CVE-2026-91765
SOAP: Unbounded Recursion in Server-Side cleanup_xml_node
PG
Patch status unknownEPSS %1
6.5
CVE-2025-14181
Integer overflow to buffer overflow in soap HTTP parsing
PG
Patch status unknownEPSS %0
6.9
CVE-2026-17545
PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS
PG
Patch status unknownEPSS %0
4.3
CVE-2026-6103
Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection
PG
Patch status unknownEPSS %0