Skip to content
OpenAdvisories

Package · Wolfi

php-8.4

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • Critical 9.2
    CVE-2026-109619 Exploited Public exploit Scanner template EPSS 100%

    RCE via stale global state

    PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subs…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine Wolfi
    KEV Oct 26, 2026
  • Critical 9.2
    CVE-2026-109618 Exploited Public exploit Scanner template EPSS 100%

    RCE via OOM corruption

    PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The s…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine Wolfi
    KEV Oct 26, 2026
  • Unscored —
    CVE-2007-4596 Public exploit

    The perl extension in PHP does not follow safe_mode restrictions, which allows context-dependent attackers to execute a…

    php-8.4 php-8.5 Wolfi
  • Unscored —
    CVE-2007-3205

    The parse_str function in (1) PHP, (2) Hardened-PHP, and (3) Suhosin, when called without a second parameter, might all…

    php-8.5 php-8.4 Wolfi
  • Unscored —
    CVE-2007-2728

    The soap extension in PHP calls php_rand_r with an uninitialized seed variable, which has unknown impact and attack vec…

    php-8.5 php-8.4 Wolfi