Исправлено в
Проверьте свою версию
php -r 'echo PHP_VERSION;'CVE, затрагивающие 8.2
| CVE | Название | CVSS | Эксплуатируется | EPSS | Опубликовано |
|---|---|---|---|---|---|
| CVE-2024-4577 | Argument Injection in PHP-CGI | 9.8 | KEV | 100.0% | 2024-06-10 |
| CVE-2026-109619 | RCE via stale global state | 9.2 | KEV | 100.0% | 2026-10-21 |
| CVE-2026-109618 | RCE via OOM corruption | 9.2 | KEV | 100.0% | 2026-10-21 |
| CVE-2024-3566 | Command injection vulnerability in programing languages on Microsoft Windows operating system. | 9.8 | — | 2024-04-10 | |
| CVE-2024-8932 | OOB access in ldap_escape | 9.8 | — | 2024-11-22 | |
| CVE-2024-11236 | Integer overflow in the firebird and dblib quoters causing OOB writes | 9.8 | — | 2024-11-24 | |
| CVE-2026-6722 | Use-After-Free in SOAP using Apache map | 9.5 | — | 2026-05-10 | |
| CVE-2023-3824 | Buffer overflow and overread in phar_dir_read() | 9.4 | — | 2023-08-11 | |
| CVE-2024-1874 | Command injection via array-ish $command parameter of proc_open() | 9.4 | — | 2024-04-29 | |
| CVE-2022-31631 | PDO::quote() may return unquoted string | 9.1 | — | 2025-02-13 | |
| CVE-2023-3823 | Security issue with external entity loading in XML without enabling it | 8.6 | — | 2023-08-11 | |
| CVE-2025-14180 | NULL Pointer Dereference in PDO quoting | 8.2 | — | 2025-12-28 | |
| CVE-2024-8926 | PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass) | 8.1 | — | 2024-10-08 | |
| CVE-2026-17543 | SQL injection in ext-pgsql via E'...' backslash breakout | 8.1 | — | 2026-07-30 | |
| CVE-2023-0567 | password_verify() always returns true for some invalid hashes | 7.7 | — | 2023-02-16 | |
| CVE-2024-5585 | Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix) | 7.7 | — | 2024-06-10 | |
| CVE-2023-0568 | Array overrun in common path resolve code | 7.5 | — | 2023-02-16 | |
| CVE-2023-0662 | DoS vulnerability when parsing multipart request body | 7.5 | — | 2023-02-16 | |
| CVE-2024-8927 | cgi.force_redirect configuration is bypassable due to the environment variable collision | 7.5 | — | 2024-10-08 | |
| CVE-2026-91765 | SOAP: Unbounded Recursion in Server-Side cleanup_xml_node | 7.5 | — | 2026-09-26 | |
| CVE-2025-14179 | SQL injection in pdo_firebird via NUL bytes in quoted strings | 7.4 | — | 2026-05-10 | |
| CVE-2026-6735 | XSS within PHP-FPM status endpoint | 7.3 | — | 2026-05-10 | |
| CVE-2026-17545 | PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS | 6.9 | — | 2026-09-26 | |
| CVE-2024-3096 | PHP function password_verify can erroneously return true when argument contains NUL | 6.5 | — | 2024-04-29 | |
| CVE-2025-14178 | Heap buffer overflow in array_merge() | 6.5 | — | 2025-12-28 | |
| CVE-2025-14181 | Integer overflow to buffer overflow in soap HTTP parsing | 6.5 | — | 2026-09-26 | |
| CVE-2026-91767 | Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN | 6.5 | — | 2026-09-26 | |
| CVE-2026-91768 | IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes) | 6.5 | — | 2026-09-26 | |
| CVE-2025-1217 | Header parser of http stream wrapper does not handle folded headers | 6.3 | — | 2025-03-29 | |
| CVE-2025-1219 | libxml streams use wrong content-type header when requesting a redirected resource | 6.3 | — | 2025-03-30 | |
| CVE-2025-1734 | Streams HTTP wrapper does not fail for headers with invalid name and no colon | 6.3 | — | 2025-03-30 | |
| CVE-2025-1736 | Stream HTTP wrapper header check might omit basic auth header | 6.3 | — | 2025-03-30 | |
| CVE-2025-1861 | Stream HTTP wrapper truncates redirect location to 1024 bytes | 6.3 | — | 2025-03-30 | |
| CVE-2025-14177 | Information Leak of Memory in getimagesize | 6.3 | — | 2025-12-28 | |
| CVE-2026-7258 | Out-of-bounds read in urldecode() on NetBSD | 6.3 | — | 2026-05-10 | |
| CVE-2026-7261 | SoapServer session-persisted object use-after-free via SOAP header fault | 6.3 | — | 2026-05-10 | |
| CVE-2026-7568 | Signed integer overflow in metaphone() | 6.3 | — | 2026-05-10 | |
| CVE-2024-2408 | PHP is vulnerable to the Marvin Attack | 5.9 | — | 2024-06-10 | |
| CVE-2025-6491 | NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix | 5.9 | — | 2025-07-14 | |
| CVE-2025-1735 | pgsql extension does not check for errors during escaping | 5.9 | — | 2025-07-14 | |
| CVE-2026-91766 | Cross-origin credential leak in HTTP stream wrapper redirects | 5.9 | — | 2026-09-26 | |
| CVE-2026-92842 | OOB read / info leak in convert.* stream filters when line-break-chars contains NUL | 5.9 | — | 2026-09-26 | |
| CVE-2024-8929 | Leak partial content of the heap through heap buffer over-read in mysqlnd | 5.8 | — | 2024-11-22 | |
| CVE-2026-93682 | Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header | 5.8 | — | 2026-09-26 | |
| CVE-2026-14355 | ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD | 5.6 | — | 2026-07-04 | |
| CVE-2026-7260 | Stack overflow in phar with circular symlinks | 5.4 | — | 2026-07-30 | |
| CVE-2024-5458 | Filter bypass in filter_var (FILTER_VALIDATE_URL) | 5.3 | — | 2024-06-10 | |
| CVE-2024-11234 | Configuring a proxy in a stream context might allow for CRLF injection in URIs | 4.8 | — | 2024-11-24 | |
| CVE-2024-11233 | Single byte overread with convert.quoted-printable-decode filter | 4.8 | — | 2024-11-24 | |
| CVE-2026-6103 | Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection | 4.3 | — | 2026-09-26 | |
| CVE-2026-91769 | TLS Hostname Verification Falls Back to CN After SAN Mismatch | 4.3 | — | 2026-09-26 | |
| CVE-2025-1220 | Null byte termination in hostnames | 3.7 | — | 2025-07-14 | |
| CVE-2025-1218 | Various packet overreads in mysqlnd_writeprotocol.c | 3.4 | — | 2026-09-26 | |
| CVE-2024-9026 | PHP-FPM logs from children may be altered | 3.3 | — | 2024-10-08 | |
| CVE-2024-8925 | Erroneous parsing of multipart form data | 3.1 | — | 2024-10-08 | |
| CVE-2026-7262 | NULL pointer dereference in SOAP apache:Map decoder with missing <value> | 2.9 | — | 2026-05-10 | |
| CVE-2023-3247 | Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP | 2.6 | — | 2023-07-22 | |
| CVE-2026-7259 | Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() | 2.1 | — | 2026-05-10 |
Отслеживайте эти версии на своих серверах
InfraGuard собирает версии установленного ПО со всех серверов и отмечает версии с известными уязвимостями. Self-hosted — данные не покидают вашу сеть.
Данные: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (об EPSS см. https://www.first.org/epss), endoflife.date. Список ПО: awesome-selfhosted (CC BY-SA 3.0).