php vulnerabilities

CVEs per yearBy the year they were published

1. 20191
2. 20201
3. 20267

Known exploitedNewest addition to KEV first

• CVE-2019-11043

  Underflow in PHP-FPM can lead to RCE

  PHP · PHP

  ExploitedHigh8.7

Newest CVEs

• CVE-2026-122233

  FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Mode

  php · frankenphp

  Medium6.3
• CVE-2026-85733

  FrankenPHP: Docker images serve phpinfo() as the default index.php, leaking environment variables

  php · frankenphp

  Medium5.3
• CVE-2026-82416

  FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module

  php · frankenphp

  High7.7
• CVE-2026-14355

  ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD

  php · php

  Medium5.6
• CVE-2026-45062

  FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

  php · frankenphp

  High8.1
• CVE-2026-24895

  FrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary files

  php · frankenphp

  High8.9
• CVE-2026-24894

  FrankenPHP leaks session data between requests in worker mode

  php · frankenphp

  High8.7
• CVE-2014-3622

  Use-after-free vulnerability in the add_post_var function in the Posthandler component in PHP 5.6.x before 5.6.1 might allow remote attackers to execute…

  PHP · PHP

  Critical9.8
• CVE-2019-11043

  Underflow in PHP-FPM can lead to RCE

  PHP · PHP

  ExploitedHigh8.7