P
Vendor security profile4 actively exploited CVEs
php
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs42
Critical8
CISA KEV4
Public exploit17
Patch rate%17
Avg. CVSS7.1
12-month vulnerability rate
0
3
0
0
0
0
10
0
4
0
11
2
CVE KEV
CVE severity distribution
42toplam CVE
Critical8 (19%)
High11 (26%)
Medium20 (48%)
Low1 (2%)
Uncertain2 (5%)
Patch and exploitation view
%17
Verified patch
%10
CISA KEV
%40
Public exploit
7Patch available
0Partial
4Workaround
0Vendor: no patch
31Unknown
Latest vulnerabilities
5.3
CVE-2026-85733
FrankenPHP: Docker images serve phpinfo() as the default index.php, leaking environment variables
P
Patch status unknown
7.7
CVE-2026-82416
FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module
P
Patch status unknown
8.6
CVE-2026-65954
PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()
P
Patch status unknownEPSS %0
4.8
CVE-2026-108754
GPT-Load through 1.4.11 Cleartext Proxy Key Logging via Access Logger
T
Patch status unknownEPSS %0
5.3
CVE-2026-108720
phpIPAM through 1.8.3 Missing Authorization in Customers, Locations and NAT Pages
P
Patch status unknownEPSS %0
8.7
CVE-2026-105830
league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParser
T
Patch status unknownEPSS %0
5.3
CVE-2026-105829
League CommonMark 1.3.0 before 2.10.2 Stored XSS via DisallowedRawHtml Bypass
T
Patch status unknownEPSS %0
9.2
CVE-2026-82531
Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache
S
Patch verifiedEPSS %1
5.1
CVE-2026-105703
PHPGurukul User Registration & Login and User Management System Change Password change-password.php authorization
P
Patch status unknownEPSS %0
5.4
CVE-2026-104181
Filament: Multi-factor authentication (app) management actions do not require password reauthentication
F
Patch status unknownEPSS %0