PHP Group PHP
103 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-109619 | 8.2.* – < 8.2.35 ; 8.3.* – < 8.3.36 ; 8.4.* – < 8.4.27 ; … | RCE via stale global state | CRITICAL 9.2 | 100 % | KEV | |
| CVE-2026-109618 | 8.2.* – < 8.2.35 ; 8.3.* – < 8.3.36 ; 8.4.* – < 8.4.27 ; … | RCE via OOM corruption | CRITICAL 9.2 | 100 % | KEV | |
| CVE-2026-92842 | 8.2.* – < 8.2.34 ; 8.3.* – < 8.3.35 ; 8.4.* – < 8.4.26 ; … | OOB read / info leak in convert.* stream filters when line-break-chars contains NUL | MEDIUM 5.9 | 0.2 % | ||
| CVE-2026-91768 | 8.2.* – < 8.2.34 ; 8.3.* – < 8.3.35 ; 8.4.* – < 8.4.26 ; … | IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes) | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-91769 | 8.2.* – < 8.2.34 ; 8.3.* – < 8.3.35 ; 8.4.* – < 8.4.26 ; … | TLS Hostname Verification Falls Back to CN After SAN Mismatch | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-91767 | 8.2.* – < 8.2.34 ; 8.3.* – < 8.3.35 ; 8.4.* – < 8.4.26 ; … | Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN | MEDIUM 6.5 | 0.1 % | ||
| CVE-2025-1218 | 8.2.* – < 8.2.34 ; 8.3.* – < 8.3.35 ; 8.4.* – < 8.4.26 ; … | Various packet overreads in mysqlnd_writeprotocol.c | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-91766 | 8.2.* – < 8.2.34 ; 8.3.* – < 8.3.35 ; 8.4.* – < 8.4.26 ; … | Cross-origin credential leak in HTTP stream wrapper redirects | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-91765 | 8.2.* – < 8.2.34 ; 8.3.* – < 8.3.35 ; 8.4.* – < 8.4.26 ; … | SOAP: Unbounded Recursion in Server-Side cleanup_xml_node | HIGH 7.5 | 0.4 % | ||
| CVE-2025-14181 | 8.2.* – < 8.2.34 ; 8.3.* – < 8.3.35 ; 8.4.* – < 8.4.26 ; … | Integer overflow to buffer overflow in soap HTTP parsing | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-17545 | 8.2.* – < 8.2.34 ; 8.3.* – < 8.3.35 ; 8.4.* – < 8.4.26 ; … | PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-6103 | 8.2.* – < 8.2.34 ; 8.3.* – < 8.3.35 ; 8.4.* – < 8.4.26 ; … | Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-93682 | 8.2.* – < 8.2.34 ; 8.3.* – < 8.3.35 ; 8.4.* – < 8.4.26 ; … | Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header | MEDIUM 5.8 | 0.3 % | ||
| CVE-2026-7260 | 8.2.* – < 8.2.33 ; 8.3.* – < 8.3.33 ; 8.4.* – < 8.4.24 ; … | Stack overflow in phar with circular symlinks | MEDIUM 5.4 | 0.1 % | ||
| CVE-2026-17544 | 8.4.* – < 8.4.24 ; 8.5.* – < 8.5.9 | Out-of-bounds write in bccomp() via crafted operand and scale | HIGH 8.1 | 0.4 % | ||
| CVE-2026-17543 | 8.2.* – < 8.2.33 ; 8.3.* – < 8.3.33 ; 8.4.* – < 8.4.24 ; … | SQL injection in ext-pgsql via E'...' backslash breakout | HIGH 8.1 | 0.3 % | ||
| CVE-2026-7263 | 8.4.* – < 8.4.21 ; 8.5.* – < 8.5.6 | DoS attack via DOMNode::C14N() | MEDIUM 6.3 | 0.4 % | ||
| CVE-2026-6104 | 8.4.* – < 8.4.21 ; 8.5.* – < 8.5.6 | Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding | MEDIUM 6.3 | 0.5 % | ||
| CVE-2026-7258 | 8.2.* – < 8.2.31 ; 8.3.* – < 8.3.31 ; 8.4.* – < 8.4.21 ; … | Out-of-bounds read in urldecode() on NetBSD | MEDIUM 6.3 | 0.4 % | ||
| CVE-2026-6722 | 8.2.* – < 8.2.31 ; 8.3.* – < 8.3.31 ; 8.4.* – < 8.4.21 ; … | Use-After-Free in SOAP using Apache map | CRITICAL 9.5 | 0.9 % | ||
| CVE-2026-7259 | 8.2.* – < 8.2.31 ; 8.3.* – < 8.3.31 ; 8.4.* – < 8.4.21 ; … | Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() | LOW 2.1 | 0.2 % | ||
| CVE-2026-7261 | 8.2.* – < 8.2.31 ; 8.3.* – < 8.3.31 ; 8.4.* – < 8.4.21 ; … | SoapServer session-persisted object use-after-free via SOAP header fault | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-7262 | 8.2.* – < 8.2.31 ; 8.3.* – < 8.3.31 ; 8.4.* – < 8.4.21 ; … | NULL pointer dereference in SOAP apache:Map decoder with missing <value> | LOW 2.9 | 0.8 % | ||
| CVE-2025-14179 | 8.2.* – < 8.2.31 ; 8.3.* – < 8.3.31 ; 8.4.* – < 8.4.21 ; … | SQL injection in pdo_firebird via NUL bytes in quoted strings | HIGH 7.4 | 0.4 % | ||
| CVE-2026-7568 | 8.2.* – < 8.2.31 ; 8.3.* – < 8.3.31 ; 8.4.* – < 8.4.21 ; … | Signed integer overflow in metaphone() | MEDIUM 6.3 | 0.5 % | ||
| CVE-2026-6735 | 8.2.* – < 8.2.31 ; 8.3.* – < 8.3.31 ; 8.4.* – < 8.4.21 ; … | XSS within PHP-FPM status endpoint | HIGH 7.3 | 0.2 % | ||
| CVE-2025-14177 | 8.1.* – < 8.1.34 ; 8.2.* – < 8.2.30 ; 8.3.* – < 8.3.29 ; … | Information Leak of Memory in getimagesize | MEDIUM 6.3 | 0.5 % | ||
| CVE-2025-14178 | 8.1.* – < 8.1.34 ; 8.2.* – < 8.2.30 ; 8.3.* – < 8.3.29 ; … | Heap buffer overflow in array_merge() | HIGH 8.2 | 0.5 % | ||
| CVE-2025-14180 | 8.1.* – < 8.1.34 ; 8.2.* – < 8.2.30 ; 8.3.* – < 8.3.29 ; … | NULL Pointer Dereference in PDO quoting | HIGH 8.2 | 0.7 % | ||
| CVE-2025-1735 | 8.1.* – < 8.1.33 ; 8.2.* – < 8.2.29 ; 8.3.* – < 8.3.23 ; … | pgsql extension does not check for errors during escaping | HIGH 7.5 | 1.2 % | ||
| CVE-2025-1220 | 8.1.* – < 8.1.33 ; 8.2.* – < 8.2.29 ; 8.3.* – < 8.3.23 ; … | Null byte termination in hostnames | MEDIUM 5.3 | 0.7 % | ||
| CVE-2025-6491 | 8.1.* – < 8.1.33 ; 8.2.* – < 8.2.29 ; 8.3.* – < 8.3.23 ; … | NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix | MEDIUM 5.9 | 1.1 % | ||
| CVE-2024-11235 | 8.4.* – < 8.4.5 ; 8.3.* – < 8.3.19 | Reference counting in php_request_shutdown causes Use-After-Free | CRITICAL 9.2 | 1.5 % | ||
| CVE-2025-1861 | 8.1.* – < 8.1.32 ; 8.2.* – < 8.2.28 ; 8.3.* – < 8.3.19 ; … | Stream HTTP wrapper truncates redirect location to 1024 bytes | MEDIUM 6.3 | 0.9 % | ||
| CVE-2025-1736 | 8.1.* – < 8.1.32 ; 8.2.* – < 8.2.28 ; 8.3.* – < 8.3.19 ; … | Stream HTTP wrapper header check might omit basic auth header | MEDIUM 6.3 | 0.6 % | ||
| CVE-2025-1734 | 8.1.* – < 8.1.32 ; 8.2.* – < 8.2.28 ; 8.3.* – < 8.3.19 ; … | Streams HTTP wrapper does not fail for headers with invalid name and no colon | MEDIUM 6.3 | 0.5 % | ||
| CVE-2025-1219 | 8.1.* – < 8.1.32 ; 8.2.* – < 8.2.28 ; 8.3.* – < 8.3.19 ; … | libxml streams use wrong content-type header when requesting a redirected resource | MEDIUM 6.3 | 0.7 % | ||
| CVE-2025-1217 | 8.1.* – < 8.1.32 ; 8.2.* – < 8.2.28 ; 8.3.* – < 8.3.19 ; … | Header parser of http stream wrapper does not handle folded headers | MEDIUM 6.3 | 0.6 % | ||
| CVE-2022-31631 | 8.0.x – < 8.0.27 ; 8.1.x – < 8.1.15 ; 8.2.x – < 8.2.2 | PDO::quote() may return unquoted string | CRITICAL 9.1 | 2.2 % | ||
| CVE-2024-11233 | 8.1.* – < 8.1.31 ; 8.2.* – < 8.2.26 ; 8.3.* – < 8.3.14 | Single byte overread with convert.quoted-printable-decode filter | HIGH 8.2 | 1.6 % | ||
| CVE-2024-11234 | 8.1.* – < 8.1.31 ; 8.2.* – < 8.2.26 ; 8.3.* – < 8.3.14 | Configuring a proxy in a stream context might allow for CRLF injection in URIs | HIGH 7.2 | 1.1 % | ||
| CVE-2024-11236 | 8.1.* – < 8.1.31 ; 8.2.* – < 8.2.26 ; 8.3.* – < 8.3.14 | Integer overflow in the firebird and dblib quoters causing OOB writes | CRITICAL 9.8 | 2.1 % | ||
| CVE-2024-8929 | 8.1.* – < 8.1.31 ; 8.2.* – < 8.2.24 ; 8.3.* – < 8.3.14 | Leak partial content of the heap through heap buffer over-read in mysqlnd | MEDIUM 5.8 | 2.2 % | ||
| CVE-2024-8932 | 8.1.* – < 8.1.31 ; 8.2.* – < 8.2.26 ; 8.3.* – < 8.3.14 | OOB access in ldap_escape | CRITICAL 9.8 | 1.3 % | ||
| CVE-2024-9026 | 8.1.* – < 8.1.30 ; 8.2.* – < 8.2.24 ; 8.3.* – < 8.3.12 | PHP-FPM logs from children may be altered | LOW 3.3 | 0.5 % | ||
| CVE-2024-8927 | 8.1.* – < 8.1.30 ; 8.2.* – < 8.2.24 ; 8.3.* – < 8.3.12 | cgi.force_redirect configuration is bypassable due to the environment variable collision | HIGH 7.5 | 1.1 % | ||
| CVE-2024-8926 | 8.1.* – < 8.1.30 ; 8.2.* – < 8.2.24 ; 8.3.* – < 8.3.12 | PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass) | HIGH 8.8 | 3.7 % | ||
| CVE-2024-8925 | 8.1.* – < 8.1.30 ; 8.2.* – < 8.2.24 ; 8.3.* – < 8.3.12 | Erroneous parsing of multipart form data | MEDIUM 5.3 | 0.9 % | ||
| CVE-2024-2408 | 8.1.* – < 8.1.29 ; 8.2.* – < 8.2.20 ; 8.3.* – < 8.3.8 | PHP is vulnerable to the Marvin Attack | MEDIUM 5.9 | 1.2 % | ||
| CVE-2024-4577 | 8.1.* – < 8.1.29 ; 8.2.* – < 8.2.20 ; 8.3.* – < 8.3.8 | Argument Injection in PHP-CGI | CRITICAL 9.8 | 100 % | KEV | |
| CVE-2024-5585 | 8.1.* – < 8.1.29 ; 8.2.* – < 8.2.20 ; 8.3.* – < 8.3.8 | Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix) | HIGH 8.8 | 29 % | ||
| CVE-2024-5458 | 8.1.* – < 8.1.29 ; 8.2.* – < 8.2.20 ; 8.3.* – < 8.3.8 | Filter bypass in filter_var (FILTER_VALIDATE_URL) | MEDIUM 5.3 | 12 % | ||
| CVE-2024-1874 | 8.1.* – < 8.1.28 ; 8.2.* – < 8.2.18 ; 8.3.* – < 8.3.5 | Command injection via array-ish $command parameter of proc_open() | CRITICAL 9.4 | 33 % | ||
| CVE-2024-2757 | 8.3.* – < 8.3.5 | PHP mb_encode_mimeheader runs endlessly for some inputs | HIGH 7.5 | 1.9 % | ||
| CVE-2024-3096 | 8.1.* – < 8.1.28 ; 8.2.* – < 8.2.18 ; 8.3.* – < 8.3.5 | PHP function password_verify can erroneously return true when argument contains NUL | MEDIUM 6.5 | 1.5 % | ||
| CVE-2024-2756 | 8.1.* – < 8.1.28 ; 8.2.* – < 8.2.18 ; 8.3.* – < 8.3.5 | __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix | MEDIUM 6.5 | 38 % | ||
| CVE-2023-3824 | 8.0.* – < 8.0.30 ; 8.1.* – < 8.1.22 ; 8.2.* – < 8.2.8 | Buffer overflow and overread in phar_dir_read() | CRITICAL 9.8 | 22 % | ||
| CVE-2023-3823 | 8.0.* – < 8.0.30 ; 8.1.* – < 8.1.22 ; 8.2.* – < 8.2.8 | Security issue with external entity loading in XML without enabling it | HIGH 8.6 | 1.6 % | ||
| CVE-2023-3247 | 8.0.* – < 8.0.29 ; 8.1.* – < 8.1.20 ; 8.2.* – < 8.2.7 | Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP | MEDIUM 4.3 | 0.7 % | ||
| CVE-2023-0568 | 8.0.x – < 8.0.28 ; 8.1.x – < 8.1.16 ; 8.2.x – < 8.2.3 | Array overrun in common path resolve code | HIGH 8.1 | 1.2 % | ||
| CVE-2023-0662 | 8.0.x – < 8.0.28 ; 8.1.x – < 8.1.16 ; 8.2.x – < 8.2.3 | DoS vulnerability when parsing multipart request body | HIGH 7.5 | 1.5 % | ||
| CVE-2023-0567 | 8.0.* – < 8.0.28 ; 8.1.* – < 8.1.16 ; 8.2.* – < 8.2.3 | password_verify() always returns true for some invalid hashes | HIGH 7.7 | 0.9 % | ||
| CVE-2022-31630 | 7.4.x – < 7.4.33 ; 8.0.x – < 8.0.25 ; 8.1.x – < 8.1.12 | OOB read due to insufficient input validation in imageloadfont() | HIGH 7.1 | 1.3 % | ||
| CVE-2022-31629 | 7.4.X – < 7.4.31 ; 8.0.X – < 8.0.24 ; 8.1.X – < 8.1.11 | $_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities | MEDIUM 6.5 | 50 % | ||
| CVE-2022-31628 | 7.4.X – < 7.4.31 ; 8.0.X – < 8.0.24 ; 8.1.X – < 8.1.11 | phar wrapper can occur dos when using quine gzip file | MEDIUM 5.5 | 0.6 % | ||
| CVE-2022-31627 | 8.1.X – < 8.1.8 | Heap buffer overflow in finfo_buffer | CRITICAL 9.8 | 2.1 % | ||
| CVE-2022-31626 | 7.4.X – < 7.4.30 ; 8.0.X – < 8.0.20 ; 8.1.X – < 8.1.7 | mysqlnd/pdo password buffer overflow | HIGH 8.8 | 58 % | ||
| CVE-2022-31625 | 7.4.X – < 7.4.30 ; 8.0.X – < 8.0.20 ; 8.1.X – < 8.1.7 | Freeing unallocated memory in php_pgsql_free_params() | HIGH 8.1 | 3.8 % | ||
| CVE-2021-21708 | 7.4.x – < 7.4.28 ; 8.0.X – < 8.0.16 ; 8.1.X – < 8.1.3 | UAF due to php_filter_float() failing | CRITICAL 9.8 | 3.0 % | ||
| CVE-2021-21707 | 7.3.x – < 7.3.33 ; 7.4.x – < 7.4.26 ; 8.0.X – < 8.0.13 | Special characters break path parsing in XML functions | MEDIUM 5.3 | 25 % | ||
| CVE-2021-21703 | 7.3.x – 7.3.31 ; 7.4.x – < 7.4.25 ; 8.0.X – < 8.0.12 | PHP-FPM memory access in root process leading to privilege escalation | HIGH 7.8 | 1.4 % | ||
| CVE-2021-21706 | 7.3.x – < 7.3.31 ; 7.4.x – < 7.4.24 ; 8.0.X – < 8.0.11 | ZipArchive::extractTo may extract outside of destination dir | MEDIUM 6.5 | 1.4 % | ||
| CVE-2021-21705 | 7.3.x – < 7.3.29 ; 7.4.x – < 7.4.21 ; 8.0.X – < 8.0.8 | Incorrect URL validation in FILTER_VALIDATE_URL | MEDIUM 5.3 | 2.1 % | ||
| CVE-2021-21704 | 7.3.x – < 7.3.29 ; 7.4.x – < 7.4.21 ; 8.0.X – < 8.0.8 | Multiple vulnerabilities in Firebird client extension | MEDIUM 5.9 | 1.8 % | ||
| CVE-2021-21702 | 7.3.x – < 7.3.27 ; 7.4.x – < 7.4.15 ; 8.0.X – < 8.0.2 | Null Dereference in SoapClient | HIGH 7.5 | 3.2 % | ||
| CVE-2020-7071 | 7.3.x – < 7.3.26 ; 7.4.x – < 7.4.14 ; 8.0.X – < 8.0.1 | FILTER_VALIDATE_URL accepts URLs with invalid userinfo | MEDIUM 5.3 | 2.9 % | ||
| CVE-2020-7070 | 7.3.x – < 7.3.23 ; 7.4.x – < 7.4.11 ; 7.2.x – < 7.2.34 | PHP parses encoded cookie names so malicious `__Host-` cookies can be sent | MEDIUM 5.3 | 5.0 % | ||
| CVE-2020-7069 | 7.3.x – < 7.3.23 ; 7.4.x – < 7.4.11 ; 7.2.x – < 7.2.34 | Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV | MEDIUM 6.5 | 2.1 % | ||
| CVE-2020-7068 | 7.3.x – < 7.3.21 ; 7.4.x – < 7.4.9 ; 7.2.x – < 7.2.33 | Use of freed hash key in the phar_parse_zipfile function | MEDIUM 4.8 | 1.7 % | ||
| CVE-2019-11048 | 7.3.x – < 7.3.18 ; 7.4.x – < 7.4.6 ; 7.2.x – < 7.2.31 | Temporary files are not cleaned after OOM when parsing HTTP request data | MEDIUM 5.3 | 6.3 % | ||
| CVE-2020-7067 | 7.2.x below 7.2.30 ; 7.3.x below 7.3.17 and 7.4.x below 7.4.5 | OOB Read in urldecode() | HIGH 7.5 | 4.3 % | ||
| CVE-2020-7066 | 7.2.x below 7.2.29 ; 7.3.x below 7.3.16 ; 7.4.x below 7.4.4 | get_headers() silently truncates after a null byte | MEDIUM 5.3 | 2.8 % | ||
| CVE-2020-7065 | 7.3.x – < 7.3.16 ; 7.4.x – < 7.4.4 | mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_full | HIGH 8.8 | 4.9 % | ||
| CVE-2020-7064 | 7.3.x – < 7.3.16 ; 7.4.x – < 7.4.4 ; 7.2.x – < 7.2.29 | Use-of-uninitialized-value in exif | MEDIUM 6.5 | 4.3 % | ||
| CVE-2020-7063 | 7.3.x – < 7.3.15 ; 7.4.x – < 7.4.3 ; 7.2.x – < 7.2.28 | Files added to tar with Phar::buildFromIterator have all-access permissions | MEDIUM 5.5 | 1.6 % | ||
| CVE-2020-7062 | 7.3.x – < 7.3.15 ; 7.4.x – < 7.4.3 ; 7.2.x – < 7.2.28 | Null Pointer Dereference in PHP Session Upload Progress | HIGH 7.5 | 3.6 % | ||
| CVE-2020-7061 | 7.3.x – < 7.3.15 ; 7.4.x – < 7.4.3 | heap-buffer-overflow in phar_extract_file | CRITICAL 9.1 | 4.1 % | ||
| CVE-2020-7060 | 7.2.x – < 7.2.27 ; 7.3.x – < 7.3.14 ; 7.4.x – < 7.4.2 | global buffer-overflow in mbfl_filt_conv_big5_wchar | CRITICAL 9.1 | 8.9 % | ||
| CVE-2020-7059 | 7.2.x – < 7.2.27 ; 7.3.x – < 7.3.14 ; 7.4.x – < 7.4.2 | OOB read in php_strip_tags_ex | CRITICAL 9.1 | 7.4 % | ||
| CVE-2019-11050 | 7.2.x – < 7.2.26 ; 7.3.x – < 7.3.13 ; 7.4.x – < 7.4.1 | Use-after-free in exif parsing under memory sanitizer | MEDIUM 6.5 | 7.6 % | ||
| CVE-2019-11049 | 7.3.x – < 7.3.13 ; 7.4.x – < 7.4.1 | mail() may release string with refcount==1 twice | CRITICAL 9.8 | 4.2 % | ||
| CVE-2019-11047 | 7.2.x – < 7.2.26 ; 7.3.x – < 7.3.13 ; 7.4.x – < 7.4.1 | Heap-buffer-overflow READ in exif | MEDIUM 6.5 | 7.5 % | ||
| CVE-2019-11046 | 7.2.x – < 7.2.26 ; 7.3.x – < 7.3.13 ; 7.4.x – < 7.4.1 | Buffer underflow in bc_shift_addsub | MEDIUM 5.3 | 4.1 % | ||
| CVE-2019-11045 | 7.2.x – < 7.2.26 ; 7.3.x – < 7.3.13 ; 7.4.x – < 7.4.1 | DirectoryIterator class silently truncates after a null byte | MEDIUM 5.9 | 8.8 % | ||
| CVE-2019-11044 | 7.2.x – < 7.2.26 ; 7.3.x – < 7.3.13 ; 7.4.x – < 7.4.1 | link() silently truncates after a null byte on Windows | HIGH 7.5 | 5.1 % | ||
| CVE-2019-11042 | 7.1.x below 7.1.31 ; 7.2.x below 7.2.21 ; 7.3.x below 7.3.8 | heap-buffer-overflow on exif_process_user_comment in EXIF extension | HIGH 7.1 | 4.4 % | ||
| CVE-2019-11041 | 7.1.x below 7.1.31 ; 7.2.x below 7.2.21 ; 7.3.x below 7.3.8 | heap-buffer-overflow on exif_scan_thumbnail in EXIF extension | HIGH 7.1 | 4.4 % | ||
| CVE-2019-11040 | 7.1.30 ; 7.2.19 ; 7.3.6 | Heap buffer overflow in EXIF extension | CRITICAL 9.1 | 4.1 % | ||
| CVE-2019-11039 | 7.1.30 ; 7.2.19 ; 7.3.6 | Out-of-bounds read in iconv.c | CRITICAL 9.1 | 3.1 % | ||
| CVE-2019-11038 | 7.1.x < 7.1.30 ; 7.2.x < 7.2.19 ; 7.3.x < 7.3.6 | Uninitialized read in gdImageCreateFromXbm | MEDIUM 5.3 | 4.3 % | ||
| CVE-2019-11036 | 7.1.x – < 7.1.29 ; 7.2.x – < 7.2.18 ; 7.3.x – < 7.3.5 | Heap over-read in PHP EXIF extension | CRITICAL 9.1 | 7.0 % | ||
| CVE-2019-11035 | 7.1.x – < 7.1.28 ; 7.2.x – < 7.2.17 ; 7.3.x – < 7.3.4 | Heap over-read in PHP EXIF extension | CRITICAL 9.1 | 4.4 % | ||
| CVE-2019-11034 | 7.1.x – < 7.1.28 ; 7.2.x – < 7.2.17 ; 7.3.x – < 7.3.4 | Heap over-read in PHP EXIF extension | CRITICAL 9.1 | 4.1 % |