Corregido en
Comprueba tu versión
php -r 'echo PHP_VERSION;'CVE que afectan a 8.5
| CVE | Título | CVSS | Explotada | EPSS | Publicación |
|---|---|---|---|---|---|
| CVE-2026-109619 | RCE via stale global state | 9.2 | KEV | 100.0% | 2026-10-21 |
| CVE-2026-109618 | RCE via OOM corruption | 9.2 | KEV | 100.0% | 2026-10-21 |
| CVE-2026-6722 | Use-After-Free in SOAP using Apache map | 9.5 | — | 2026-05-10 | |
| CVE-2025-14180 | NULL Pointer Dereference in PDO quoting | 8.2 | — | 2025-12-28 | |
| CVE-2026-17543 | SQL injection in ext-pgsql via E'...' backslash breakout | 8.1 | — | 2026-07-30 | |
| CVE-2026-17544 | Out-of-bounds write in bccomp() via crafted operand and scale | 8.1 | — | 2026-07-30 | |
| CVE-2026-91765 | SOAP: Unbounded Recursion in Server-Side cleanup_xml_node | 7.5 | — | 2026-09-26 | |
| CVE-2025-14179 | SQL injection in pdo_firebird via NUL bytes in quoted strings | 7.4 | — | 2026-05-10 | |
| CVE-2026-6735 | XSS within PHP-FPM status endpoint | 7.3 | — | 2026-05-10 | |
| CVE-2026-17545 | PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS | 6.9 | — | 2026-09-26 | |
| CVE-2025-14178 | Heap buffer overflow in array_merge() | 6.5 | — | 2025-12-28 | |
| CVE-2025-14181 | Integer overflow to buffer overflow in soap HTTP parsing | 6.5 | — | 2026-09-26 | |
| CVE-2026-91767 | Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN | 6.5 | — | 2026-09-26 | |
| CVE-2026-91768 | IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes) | 6.5 | — | 2026-09-26 | |
| CVE-2025-14177 | Information Leak of Memory in getimagesize | 6.3 | — | 2025-12-28 | |
| CVE-2026-7258 | Out-of-bounds read in urldecode() on NetBSD | 6.3 | — | 2026-05-10 | |
| CVE-2026-7261 | SoapServer session-persisted object use-after-free via SOAP header fault | 6.3 | — | 2026-05-10 | |
| CVE-2026-7568 | Signed integer overflow in metaphone() | 6.3 | — | 2026-05-10 | |
| CVE-2026-6104 | Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding | 6.3 | — | 2026-05-10 | |
| CVE-2026-7263 | DoS attack via DOMNode::C14N() | 6.3 | — | 2026-05-10 | |
| CVE-2026-91766 | Cross-origin credential leak in HTTP stream wrapper redirects | 5.9 | — | 2026-09-26 | |
| CVE-2026-92842 | OOB read / info leak in convert.* stream filters when line-break-chars contains NUL | 5.9 | — | 2026-09-26 | |
| CVE-2026-93682 | Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header | 5.8 | — | 2026-09-26 | |
| CVE-2026-14355 | ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD | 5.6 | — | 2026-07-04 | |
| CVE-2026-7260 | Stack overflow in phar with circular symlinks | 5.4 | — | 2026-07-30 | |
| CVE-2026-6103 | Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection | 4.3 | — | 2026-09-26 | |
| CVE-2026-91769 | TLS Hostname Verification Falls Back to CN After SAN Mismatch | 4.3 | — | 2026-09-26 | |
| CVE-2025-1218 | Various packet overreads in mysqlnd_writeprotocol.c | 3.4 | — | 2026-09-26 | |
| CVE-2026-7262 | NULL pointer dereference in SOAP apache:Map decoder with missing <value> | 2.9 | — | 2026-05-10 | |
| CVE-2026-7259 | Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() | 2.1 | — | 2026-05-10 |
Controla estas versiones en tus propios servidores
InfraGuard recopila las versiones de software instaladas en cada servidor y señala las que tienen vulnerabilidades conocidas. Autoalojado: nada sale de tu red.
Datos: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (consulta EPSS en https://www.first.org/epss), endoflife.date. Lista de software: awesome-selfhosted (CC BY-SA 3.0).