# cve.now: PHP Group

The newest entries naming PHP Group as an affected vendor (up to 200), of 104 in all, 3 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-109619](https://cve.now/CVE-2026-109619.md): RCE via stale global state (CVSS 9.2, KEV)
- [CVE-2026-109618](https://cve.now/CVE-2026-109618.md): RCE via OOM corruption (CVSS 9.2, KEV)
- [CVE-2026-92842](https://cve.now/CVE-2026-92842.md): OOB read / info leak in convert.\* stream filters when line-break-chars contains NUL (CVSS 5.9)
- [CVE-2026-91768](https://cve.now/CVE-2026-91768.md): IPv6 ACL bypass in FastCGI listen.allowed\_clients due to partial address comparison (memcmp 12 bytes) (CVSS 6.5)
- [CVE-2026-91769](https://cve.now/CVE-2026-91769.md): TLS Hostname Verification Falls Back to CN After SAN Mismatch (CVSS 4.3)
- [CVE-2026-91767](https://cve.now/CVE-2026-91767.md): Heap-buffer-overflow in php\_openssl\_matches\_wildcard\_name on crafted server cert wildcard CN (CVSS 6.5)
- [CVE-2025-1218](https://cve.now/CVE-2025-1218.md): Various packet overreads in mysqlnd\_writeprotocol.c (CVSS 3.4)
- [CVE-2026-91766](https://cve.now/CVE-2026-91766.md): Cross-origin credential leak in HTTP stream wrapper redirects (CVSS 5.9)
- [CVE-2026-91765](https://cve.now/CVE-2026-91765.md): SOAP: Unbounded Recursion in Server-Side cleanup\_xml\_node (CVSS 7.5)
- [CVE-2025-14181](https://cve.now/CVE-2025-14181.md): Integer overflow to buffer overflow in soap HTTP parsing (CVSS 6.5)
- [CVE-2026-17545](https://cve.now/CVE-2026-17545.md): PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS (CVSS 6.9)
- [CVE-2026-6103](https://cve.now/CVE-2026-6103.md): Phar TAR phar\_tar\_number() Integer Overflow - Archive Entry Injection (CVSS 4.3)
- [CVE-2026-93682](https://cve.now/CVE-2026-93682.md): Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header (CVSS 5.8)
- [CVE-2026-7260](https://cve.now/CVE-2026-7260.md): Stack overflow in phar with circular symlinks (CVSS 5.4)
- [CVE-2026-17544](https://cve.now/CVE-2026-17544.md): Out-of-bounds write in bccomp() via crafted operand and scale (CVSS 8.1)
- [CVE-2026-17543](https://cve.now/CVE-2026-17543.md): SQL injection in ext-pgsql via E'...' backslash breakout (CVSS 8.1)
- [CVE-2026-7263](https://cve.now/CVE-2026-7263.md): DoS attack via DOMNode::C14N() (CVSS 6.3)
- [CVE-2026-6104](https://cve.now/CVE-2026-6104.md): Global buffer over-read in mb\_convert\_encoding() with attacker-supplied encoding (CVSS 6.3)
- [CVE-2026-7258](https://cve.now/CVE-2026-7258.md): Out-of-bounds read in urldecode() on NetBSD (CVSS 6.3)
- [CVE-2026-6722](https://cve.now/CVE-2026-6722.md): Use-After-Free in SOAP using Apache map (CVSS 9.5)
- [CVE-2026-7259](https://cve.now/CVE-2026-7259.md): Null pointer dereference in php\_mb\_check\_encoding() via mb\_ereg\_search\_init() (CVSS 2.1)
- [CVE-2026-7261](https://cve.now/CVE-2026-7261.md): SoapServer session-persisted object use-after-free via SOAP header fault (CVSS 6.3)
- [CVE-2026-7262](https://cve.now/CVE-2026-7262.md): NULL pointer dereference in SOAP apache:Map decoder with missing \<value\> (CVSS 2.9)
- [CVE-2025-14179](https://cve.now/CVE-2025-14179.md): SQL injection in pdo\_firebird via NUL bytes in quoted strings (CVSS 7.4)
- [CVE-2026-7568](https://cve.now/CVE-2026-7568.md): Signed integer overflow in metaphone() (CVSS 6.3)
- [CVE-2026-6735](https://cve.now/CVE-2026-6735.md): XSS within PHP-FPM status endpoint (CVSS 7.3)
- [CVE-2025-14177](https://cve.now/CVE-2025-14177.md): Information Leak of Memory in getimagesize (CVSS 6.3)
- [CVE-2025-14178](https://cve.now/CVE-2025-14178.md): Heap buffer overflow in array\_merge() (CVSS 6.5)
- [CVE-2025-14180](https://cve.now/CVE-2025-14180.md): NULL Pointer Dereference in PDO quoting (CVSS 8.2)
- [CVE-2025-1735](https://cve.now/CVE-2025-1735.md): pgsql extension does not check for errors during escaping (CVSS 5.9)
- [CVE-2025-1220](https://cve.now/CVE-2025-1220.md): Null byte termination in hostnames (CVSS 3.7)
- [CVE-2025-6491](https://cve.now/CVE-2025-6491.md): NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVSS 5.9)
- [CVE-2024-11235](https://cve.now/CVE-2024-11235.md): Reference counting in php\_request\_shutdown causes Use-After-Free (CVSS 9.2)
- [CVE-2025-1861](https://cve.now/CVE-2025-1861.md): Stream HTTP wrapper truncates redirect location to 1024 bytes (CVSS 6.3)
- [CVE-2025-1736](https://cve.now/CVE-2025-1736.md): Stream HTTP wrapper header check might omit basic auth header (CVSS 6.3)
- [CVE-2025-1734](https://cve.now/CVE-2025-1734.md): Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVSS 6.3)
- [CVE-2025-1219](https://cve.now/CVE-2025-1219.md): libxml streams use wrong content-type header when requesting a redirected resource (CVSS 6.3)
- [CVE-2025-1217](https://cve.now/CVE-2025-1217.md): Header parser of http stream wrapper does not handle folded headers (CVSS 6.3)
- [CVE-2022-31631](https://cve.now/CVE-2022-31631.md): PDO::quote() may return unquoted string (CVSS 9.1)
- [CVE-2024-11233](https://cve.now/CVE-2024-11233.md): Single byte overread with convert.quoted-printable-decode filter (CVSS 4.8)
- [CVE-2024-11234](https://cve.now/CVE-2024-11234.md): Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVSS 4.8)
- [CVE-2024-11236](https://cve.now/CVE-2024-11236.md): Integer overflow in the firebird and dblib quoters causing OOB writes (CVSS 9.8)
- [CVE-2024-8929](https://cve.now/CVE-2024-8929.md): Leak partial content of the heap through heap buffer over-read in mysqlnd (CVSS 5.8)
- [CVE-2024-8932](https://cve.now/CVE-2024-8932.md): OOB access in ldap\_escape (CVSS 9.8)
- [CVE-2024-9026](https://cve.now/CVE-2024-9026.md): PHP-FPM logs from children may be altered (CVSS 3.3)
- [CVE-2024-8927](https://cve.now/CVE-2024-8927.md): cgi.force\_redirect configuration is bypassable due to the environment variable collision (CVSS 7.5)
- [CVE-2024-8926](https://cve.now/CVE-2024-8926.md): PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass) (CVSS 8.1)
- [CVE-2024-8925](https://cve.now/CVE-2024-8925.md): Erroneous parsing of multipart form data (CVSS 3.1)
- [CVE-2024-2408](https://cve.now/CVE-2024-2408.md): PHP is vulnerable to the Marvin Attack (CVSS 5.9)
- [CVE-2024-4577](https://cve.now/CVE-2024-4577.md): Argument Injection in PHP-CGI (CVSS 9.8, KEV)
- [CVE-2024-5585](https://cve.now/CVE-2024-5585.md): Command injection via array-ish $command parameter of proc\_open() (bypass CVE-2024-1874 fix) (CVSS 7.7)
- [CVE-2024-5458](https://cve.now/CVE-2024-5458.md): Filter bypass in filter\_var (FILTER\_VALIDATE\_URL) (CVSS 5.3)
- [CVE-2024-1874](https://cve.now/CVE-2024-1874.md): Command injection via array-ish $command parameter of proc\_open() (CVSS 9.4)
- [CVE-2024-2757](https://cve.now/CVE-2024-2757.md): PHP mb\_encode\_mimeheader runs endlessly for some inputs (CVSS 7.5)
- [CVE-2024-3096](https://cve.now/CVE-2024-3096.md): PHP function password\_verify can erroneously return true when argument contains NUL (CVSS 6.5)
- [CVE-2024-2756](https://cve.now/CVE-2024-2756.md): \_\_Host-/\_\_Secure- cookie bypass due to partial CVE-2022-31629 fix (CVSS 6.5)
- [CVE-2023-3824](https://cve.now/CVE-2023-3824.md): Buffer overflow and overread in phar\_dir\_read() (CVSS 9.4)
- [CVE-2023-3823](https://cve.now/CVE-2023-3823.md): Security issue with external entity loading in XML without enabling it (CVSS 8.6)
- [CVE-2023-3247](https://cve.now/CVE-2023-3247.md): Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP (CVSS 2.6)
- [CVE-2023-0568](https://cve.now/CVE-2023-0568.md): Array overrun in common path resolve code (CVSS 7.5)
- [CVE-2023-0662](https://cve.now/CVE-2023-0662.md): DoS vulnerability when parsing multipart request body (CVSS 7.5)
- [CVE-2023-0567](https://cve.now/CVE-2023-0567.md): password\_verify() always returns true for some invalid hashes (CVSS 7.7)
- [CVE-2022-31630](https://cve.now/CVE-2022-31630.md): OOB read due to insufficient input validation in imageloadfont() (CVSS 6.5)
- [CVE-2022-31629](https://cve.now/CVE-2022-31629.md): $\_COOKIE names string replacement (. -\> \_): cookie integrity vulnerabilities (CVSS 6.5)
- [CVE-2022-31628](https://cve.now/CVE-2022-31628.md): phar wrapper can occur dos when using quine gzip file (CVSS 2.3)
- [CVE-2022-31627](https://cve.now/CVE-2022-31627.md): Heap buffer overflow in finfo\_buffer (CVSS 7.7)
- [CVE-2022-31626](https://cve.now/CVE-2022-31626.md): mysqlnd/pdo password buffer overflow (CVSS 7.5)
- [CVE-2022-31625](https://cve.now/CVE-2022-31625.md): Freeing unallocated memory in php\_pgsql\_free\_params() (CVSS 8.1)
- [CVE-2021-21708](https://cve.now/CVE-2021-21708.md): UAF due to php\_filter\_float() failing (CVSS 8.2)
- [CVE-2021-21707](https://cve.now/CVE-2021-21707.md): Special characters break path parsing in XML functions (CVSS 5.3)
- [CVE-2021-21703](https://cve.now/CVE-2021-21703.md): PHP-FPM memory access in root process leading to privilege escalation (CVSS 7.8)
- [CVE-2021-21706](https://cve.now/CVE-2021-21706.md): ZipArchive::extractTo may extract outside of destination dir (CVSS 5.3)
- [CVE-2021-21705](https://cve.now/CVE-2021-21705.md): Incorrect URL validation in FILTER\_VALIDATE\_URL (CVSS 4.3)
- [CVE-2021-21704](https://cve.now/CVE-2021-21704.md): Multiple vulnerabilities in Firebird client extension (CVSS 5.0)
- [CVE-2021-21702](https://cve.now/CVE-2021-21702.md): Null Dereference in SoapClient (CVSS 5.3)
- [CVE-2020-7071](https://cve.now/CVE-2020-7071.md): FILTER\_VALIDATE\_URL accepts URLs with invalid userinfo (CVSS 5.3)
- [CVE-2020-7070](https://cve.now/CVE-2020-7070.md): PHP parses encoded cookie names so malicious \`\_\_Host-\` cookies can be sent (CVSS 4.3)
- [CVE-2020-7069](https://cve.now/CVE-2020-7069.md): Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV (CVSS 5.4)
- [CVE-2020-7068](https://cve.now/CVE-2020-7068.md): Use of freed hash key in the phar\_parse\_zipfile function (CVSS 4.8)
- [CVE-2019-11048](https://cve.now/CVE-2019-11048.md): Temporary files are not cleaned after OOM when parsing HTTP request data (CVSS 5.3)
- [CVE-2020-7067](https://cve.now/CVE-2020-7067.md): OOB Read in urldecode() (CVSS 7.5)
- [CVE-2020-7066](https://cve.now/CVE-2020-7066.md): get\_headers() silently truncates after a null byte (CVSS 5.3)
- [CVE-2020-7065](https://cve.now/CVE-2020-7065.md): mb\_strtolower (UTF-32LE): stack-buffer-overflow at php\_unicode\_tolower\_full (CVSS 7.4)
- [CVE-2020-7064](https://cve.now/CVE-2020-7064.md): Use-of-uninitialized-value in exif (CVSS 6.5)
- [CVE-2020-7063](https://cve.now/CVE-2020-7063.md): Files added to tar with Phar::buildFromIterator have all-access permissions (CVSS 5.5)
- [CVE-2020-7062](https://cve.now/CVE-2020-7062.md): Null Pointer Dereference in PHP Session Upload Progress (CVSS 7.5)
- [CVE-2020-7061](https://cve.now/CVE-2020-7061.md): heap-buffer-overflow in phar\_extract\_file (CVSS 6.5)
- [CVE-2020-7060](https://cve.now/CVE-2020-7060.md): global buffer-overflow in mbfl\_filt\_conv\_big5\_wchar (CVSS 6.5)
- [CVE-2020-7059](https://cve.now/CVE-2020-7059.md): OOB read in php\_strip\_tags\_ex (CVSS 6.5)
- [CVE-2019-11050](https://cve.now/CVE-2019-11050.md): Use-after-free in exif parsing under memory sanitizer (CVSS 4.8)
- [CVE-2019-11049](https://cve.now/CVE-2019-11049.md): mail() may release string with refcount==1 twice (CVSS 6.5)
- [CVE-2019-11047](https://cve.now/CVE-2019-11047.md): Heap-buffer-overflow READ in exif (CVSS 4.8)
- [CVE-2019-11046](https://cve.now/CVE-2019-11046.md): Buffer underflow in bc\_shift\_addsub (CVSS 3.7)
- [CVE-2019-11045](https://cve.now/CVE-2019-11045.md): DirectoryIterator class silently truncates after a null byte (CVSS 3.7)
- [CVE-2019-11044](https://cve.now/CVE-2019-11044.md): link() silently truncates after a null byte on Windows (CVSS 3.7)
- [CVE-2019-11042](https://cve.now/CVE-2019-11042.md): heap-buffer-overflow on exif\_process\_user\_comment in EXIF extension (CVSS 4.8)
- [CVE-2019-11041](https://cve.now/CVE-2019-11041.md): heap-buffer-overflow on exif\_scan\_thumbnail in EXIF extension (CVSS 4.8)
- [CVE-2019-11040](https://cve.now/CVE-2019-11040.md): Heap buffer overflow in EXIF extension (CVSS 4.8)
- [CVE-2019-11039](https://cve.now/CVE-2019-11039.md): Out-of-bounds read in iconv.c (CVSS 4.2)
- [CVE-2019-11038](https://cve.now/CVE-2019-11038.md): Uninitialized read in gdImageCreateFromXbm (CVSS 3.1)
- [CVE-2019-11037](https://cve.now/CVE-2019-11037.md): Out of bounds memory write in PHP Imagick extension (CVSS 4.9)
- [CVE-2019-11036](https://cve.now/CVE-2019-11036.md): Heap over-read in PHP EXIF extension (CVSS 4.8)
- [CVE-2019-11035](https://cve.now/CVE-2019-11035.md): Heap over-read in PHP EXIF extension (CVSS 4.8)
- [CVE-2019-11034](https://cve.now/CVE-2019-11034.md): Heap over-read in PHP EXIF extension (CVSS 4.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/php-group
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.