Fixed in
Check your version
php -r 'echo PHP_VERSION;'CVEs affecting 8.0
| CVE | Title | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2026-109619 | RCE via stale global state | 9.2 | KEV | 100.0% | 2026-10-21 |
| CVE-2026-109618 | RCE via OOM corruption | 9.2 | KEV | 100.0% | 2026-10-21 |
| CVE-2022-37454 | The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer ove... | 9.8 | — | 2022-10-21 | |
| CVE-2024-3566 | Command injection vulnerability in programing languages on Microsoft Windows operating system. | 9.8 | — | 2024-04-10 | |
| CVE-2017-9120 | PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application cr... | 9.8 | — | 2018-08-03 | |
| CVE-2017-8923 | The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string... | 9.8 | — | 2017-05-13 | |
| CVE-2023-3824 | Buffer overflow and overread in phar_dir_read() | 9.4 | — | 2023-08-11 | |
| CVE-2022-31631 | PDO::quote() may return unquoted string | 9.1 | — | 2025-02-13 | |
| CVE-2023-3823 | Security issue with external entity loading in XML without enabling it | 8.6 | — | 2023-08-11 | |
| CVE-2021-21708 | UAF due to php_filter_float() failing | 8.2 | — | 2022-02-27 | |
| CVE-2022-31625 | Freeing unallocated memory in php_pgsql_free_params() | 8.1 | — | 2022-06-16 | |
| CVE-2021-21703 | PHP-FPM memory access in root process leading to privilege escalation | 7.8 | — | 2021-10-25 | |
| CVE-2023-0567 | password_verify() always returns true for some invalid hashes | 7.7 | — | 2023-02-16 | |
| CVE-2022-31626 | mysqlnd/pdo password buffer overflow | 7.5 | — | 2022-06-16 | |
| CVE-2023-0568 | Array overrun in common path resolve code | 7.5 | — | 2023-02-16 | |
| CVE-2023-0662 | DoS vulnerability when parsing multipart request body | 7.5 | — | 2023-02-16 | |
| CVE-2017-9118 | PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call. | 7.5 | — | 2018-08-03 | |
| CVE-2022-31629 | $_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities | 6.5 | — | 2022-09-29 | |
| CVE-2022-31630 | OOB read due to insufficient input validation in imageloadfont() | 6.5 | — | 2022-11-14 | |
| CVE-2022-4900 | Potential buffer overflow in php_cli_server_startup_workers | 6.2 | — | 2023-11-03 | |
| CVE-2024-5458 | Filter bypass in filter_var (FILTER_VALIDATE_URL) | 5.3 | — | 2024-06-10 | |
| CVE-2020-7071 | FILTER_VALIDATE_URL accepts URLs with invalid userinfo | 5.3 | — | 2021-02-15 | |
| CVE-2021-21702 | Null Dereference in SoapClient | 5.3 | — | 2021-02-15 | |
| CVE-2021-21706 | ZipArchive::extractTo may extract outside of destination dir | 5.3 | — | 2021-10-04 | |
| CVE-2021-21707 | Special characters break path parsing in XML functions | 5.3 | — | 2021-11-29 | |
| CVE-2021-21704 | Multiple vulnerabilities in Firebird client extension | 5.0 | — | 2021-10-04 | |
| CVE-2021-21705 | Incorrect URL validation in FILTER_VALIDATE_URL | 4.3 | — | 2021-10-04 | |
| CVE-2023-3247 | Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP | 2.6 | — | 2023-07-22 | |
| CVE-2022-31628 | phar wrapper can occur dos when using quine gzip file | 2.3 | — | 2022-09-29 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).