agentprime: php

agentprime: phpEvery new CVE for php.https://agentprime.io/CVE-2026-109619: RCE via stale global statehttps://agentprime.io/advisories/CVE-2026-109619/https://agentprime.io/advisories/CVE-2026-109619/CVSS 9.2 (Critical). Critical: In CISA’s KEV catalogue since 26 Oct 2026: it is known to be exploited. CVSS score 9.2: 9.0 or more. CVSS score 9.2 (7.0 or more) and EPSS 1.00 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 13:54:43 GMTCVEcriticalKEVCVE-2026-109618: RCE via OOM corruptionhttps://agentprime.io/advisories/CVE-2026-109618/https://agentprime.io/advisories/CVE-2026-109618/CVSS 9.2 (Critical). Critical: In CISA’s KEV catalogue since 26 Oct 2026: it is known to be exploited. CVSS score 9.2: 9.0 or more. CVSS score 9.2 (7.0 or more) and EPSS 1.00 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 13:48:34 GMTCVEcriticalKEVCVE-2026-92842: OOB read / info leak in convert.* stream filters when line-break-chars contains NULhttps://agentprime.io/advisories/CVE-2026-92842/https://agentprime.io/advisories/CVE-2026-92842/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 21:11:57 GMTCVECVE-2026-91768: IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)https://agentprime.io/advisories/CVE-2026-91768/https://agentprime.io/advisories/CVE-2026-91768/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 21:07:30 GMTCVECVE-2026-91769: TLS Hostname Verification Falls Back to CN After SAN Mismatchhttps://agentprime.io/advisories/CVE-2026-91769/https://agentprime.io/advisories/CVE-2026-91769/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 20:59:39 GMTCVECVE-2026-91767: Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CNhttps://agentprime.io/advisories/CVE-2026-91767/https://agentprime.io/advisories/CVE-2026-91767/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 20:53:42 GMTCVECVE-2025-1218: Various packet overreads in mysqlnd_writeprotocol.chttps://agentprime.io/advisories/CVE-2025-1218/https://agentprime.io/advisories/CVE-2025-1218/CVSS 3.4 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 20:48:21 GMTCVECVE-2026-91766: Cross-origin credential leak in HTTP stream wrapper redirectshttps://agentprime.io/advisories/CVE-2026-91766/https://agentprime.io/advisories/CVE-2026-91766/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 20:40:25 GMTCVECVE-2026-91765: SOAP: Unbounded Recursion in Server-Side cleanup_xml_nodehttps://agentprime.io/advisories/CVE-2026-91765/https://agentprime.io/advisories/CVE-2026-91765/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 20:33:03 GMTCVECVE-2025-14181: Integer overflow to buffer overflow in soap HTTP parsinghttps://agentprime.io/advisories/CVE-2025-14181/https://agentprime.io/advisories/CVE-2025-14181/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 20:26:45 GMTCVECVE-2026-17545: PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoShttps://agentprime.io/advisories/CVE-2026-17545/https://agentprime.io/advisories/CVE-2026-17545/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 20:18:11 GMTCVECVE-2026-6103: Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injectionhttps://agentprime.io/advisories/CVE-2026-6103/https://agentprime.io/advisories/CVE-2026-6103/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 20:08:49 GMTCVECVE-2026-93682: Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location headerhttps://agentprime.io/advisories/CVE-2026-93682/https://agentprime.io/advisories/CVE-2026-93682/CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 20:02:11 GMTCVECVE-2026-7260: Stack overflow in phar with circular symlinkshttps://agentprime.io/advisories/CVE-2026-7260/https://agentprime.io/advisories/CVE-2026-7260/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 30 Jul 2026 11:22:53 GMTCVECVE-2026-17544: Out-of-bounds write in bccomp() via crafted operand and scalehttps://agentprime.io/advisories/CVE-2026-17544/https://agentprime.io/advisories/CVE-2026-17544/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 30 Jul 2026 11:22:24 GMTCVECVE-2026-17543: SQL injection in ext-pgsql via E'...' backslash breakouthttps://agentprime.io/advisories/CVE-2026-17543/https://agentprime.io/advisories/CVE-2026-17543/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 30 Jul 2026 11:22:04 GMTCVECVE-2026-14355: ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PADhttps://agentprime.io/advisories/CVE-2026-14355/https://agentprime.io/advisories/CVE-2026-14355/CVSS 5.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 03 Jul 2026 20:57:31 GMTCVECVE-2026-7263: DoS attack via DOMNode::C14N()https://agentprime.io/advisories/CVE-2026-7263/https://agentprime.io/advisories/CVE-2026-7263/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 10 May 2026 04:43:04 GMTCVECVE-2026-6104: Global buffer over-read in mb_convert_encoding() with attacker-supplied encodinghttps://agentprime.io/advisories/CVE-2026-6104/https://agentprime.io/advisories/CVE-2026-6104/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 10 May 2026 04:35:17 GMTCVECVE-2026-7258: Out-of-bounds read in urldecode() on NetBSDhttps://agentprime.io/advisories/CVE-2026-7258/https://agentprime.io/advisories/CVE-2026-7258/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 10 May 2026 04:28:14 GMTCVECVE-2026-6722: Use-After-Free in SOAP using Apache maphttps://agentprime.io/advisories/CVE-2026-6722/https://agentprime.io/advisories/CVE-2026-6722/CVSS 9.5 (Critical). Critical: CVSS score 9.5: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sun, 10 May 2026 04:19:15 GMTCVEcriticalCVE-2026-7259: Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()https://agentprime.io/advisories/CVE-2026-7259/https://agentprime.io/advisories/CVE-2026-7259/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Sun, 10 May 2026 04:13:26 GMTCVECVE-2026-7261: SoapServer session-persisted object use-after-free via SOAP header faulthttps://agentprime.io/advisories/CVE-2026-7261/https://agentprime.io/advisories/CVE-2026-7261/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 10 May 2026 04:07:25 GMTCVECVE-2026-7262: NULL pointer dereference in SOAP apache:Map decoder with missing <value>https://agentprime.io/advisories/CVE-2026-7262/https://agentprime.io/advisories/CVE-2026-7262/CVSS 2.9 (Low). Published by the CVE Program. Not analysed by agentprime yet.Sun, 10 May 2026 04:00:09 GMTCVECVE-2025-14179: SQL injection in pdo_firebird via NUL bytes in quoted stringshttps://agentprime.io/advisories/CVE-2025-14179/https://agentprime.io/advisories/CVE-2025-14179/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Sun, 10 May 2026 03:51:14 GMTCVECVE-2026-7568: Signed integer overflow in metaphone()https://agentprime.io/advisories/CVE-2026-7568/https://agentprime.io/advisories/CVE-2026-7568/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 10 May 2026 03:42:36 GMTCVECVE-2026-6735: XSS within PHP-FPM status endpointhttps://agentprime.io/advisories/CVE-2026-6735/https://agentprime.io/advisories/CVE-2026-6735/CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Sun, 10 May 2026 03:27:00 GMTCVECVE-2025-14177: Information Leak of Memory in getimagesizehttps://agentprime.io/advisories/CVE-2025-14177/https://agentprime.io/advisories/CVE-2025-14177/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 27 Dec 2025 19:33:23 GMTCVECVE-2025-14178: Heap buffer overflow in array_merge()https://agentprime.io/advisories/CVE-2025-14178/https://agentprime.io/advisories/CVE-2025-14178/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 27 Dec 2025 19:27:41 GMTCVECVE-2025-14180: NULL Pointer Dereference in PDO quotinghttps://agentprime.io/advisories/CVE-2025-14180/https://agentprime.io/advisories/CVE-2025-14180/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 27 Dec 2025 19:21:20 GMTCVECVE-2025-1735: pgsql extension does not check for errors during escapinghttps://agentprime.io/advisories/CVE-2025-1735/https://agentprime.io/advisories/CVE-2025-1735/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 13 Jul 2025 22:27:48 GMTCVECVE-2025-1220: Null byte termination in hostnameshttps://agentprime.io/advisories/CVE-2025-1220/https://agentprime.io/advisories/CVE-2025-1220/CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Sun, 13 Jul 2025 22:18:36 GMTCVECVE-2025-6491: NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefixhttps://agentprime.io/advisories/CVE-2025-6491/https://agentprime.io/advisories/CVE-2025-6491/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 13 Jul 2025 22:10:15 GMTCVECVE-2024-11235: Reference counting in php_request_shutdown causes Use-After-Freehttps://agentprime.io/advisories/CVE-2024-11235/https://agentprime.io/advisories/CVE-2024-11235/CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 04 Apr 2025 17:51:07 GMTCVEcriticalCVE-2025-1861: Stream HTTP wrapper truncates redirect location to 1024 byteshttps://agentprime.io/advisories/CVE-2025-1861/https://agentprime.io/advisories/CVE-2025-1861/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 30 Mar 2025 05:57:57 GMTCVECVE-2025-1736: Stream HTTP wrapper header check might omit basic auth headerhttps://agentprime.io/advisories/CVE-2025-1736/https://agentprime.io/advisories/CVE-2025-1736/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 30 Mar 2025 05:49:14 GMTCVECVE-2025-1734: Streams HTTP wrapper does not fail for headers with invalid name and no colonhttps://agentprime.io/advisories/CVE-2025-1734/https://agentprime.io/advisories/CVE-2025-1734/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 30 Mar 2025 05:43:35 GMTCVECVE-2025-1219: libxml streams use wrong content-type header when requesting a redirected resourcehttps://agentprime.io/advisories/CVE-2025-1219/https://agentprime.io/advisories/CVE-2025-1219/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 30 Mar 2025 05:33:13 GMTCVECVE-2025-1217: Header parser of http stream wrapper does not handle folded headershttps://agentprime.io/advisories/CVE-2025-1217/https://agentprime.io/advisories/CVE-2025-1217/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 29 Mar 2025 05:19:33 GMTCVECVE-2022-31631: PDO::quote() may return unquoted stringhttps://agentprime.io/advisories/CVE-2022-31631/https://agentprime.io/advisories/CVE-2022-31631/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Feb 2025 22:10:45 GMTCVEcriticalCVE-2024-11233: Single byte overread with convert.quoted-printable-decode filterhttps://agentprime.io/advisories/CVE-2024-11233/https://agentprime.io/advisories/CVE-2024-11233/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 24 Nov 2024 01:08:28 GMTCVECVE-2024-11234: Configuring a proxy in a stream context might allow for CRLF injection in URIshttps://agentprime.io/advisories/CVE-2024-11234/https://agentprime.io/advisories/CVE-2024-11234/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 24 Nov 2024 00:57:39 GMTCVECVE-2024-11236: Integer overflow in the firebird and dblib quoters causing OOB writeshttps://agentprime.io/advisories/CVE-2024-11236/https://agentprime.io/advisories/CVE-2024-11236/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sun, 24 Nov 2024 00:44:54 GMTCVEcriticalCVE-2024-8929: Leak partial content of the heap through heap buffer over-read in mysqlndhttps://agentprime.io/advisories/CVE-2024-8929/https://agentprime.io/advisories/CVE-2024-8929/CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 22 Nov 2024 06:15:29 GMTCVECVE-2024-8932: OOB access in ldap_escapehttps://agentprime.io/advisories/CVE-2024-8932/https://agentprime.io/advisories/CVE-2024-8932/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 22 Nov 2024 06:03:29 GMTCVEcriticalCVE-2024-9026: PHP-FPM logs from children may be alteredhttps://agentprime.io/advisories/CVE-2024-9026/https://agentprime.io/advisories/CVE-2024-9026/CVSS 3.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 08 Oct 2024 04:07:33 GMTCVECVE-2024-8927: cgi.force_redirect configuration is bypassable due to the environment variable collisionhttps://agentprime.io/advisories/CVE-2024-8927/https://agentprime.io/advisories/CVE-2024-8927/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 08 Oct 2024 03:56:31 GMTCVECVE-2024-8926: PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)https://agentprime.io/advisories/CVE-2024-8926/https://agentprime.io/advisories/CVE-2024-8926/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 08 Oct 2024 03:48:53 GMTCVECVE-2024-8925: Erroneous parsing of multipart form datahttps://agentprime.io/advisories/CVE-2024-8925/https://agentprime.io/advisories/CVE-2024-8925/CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 08 Oct 2024 03:35:02 GMTCVECVE-2024-2408: PHP is vulnerable to the Marvin Attackhttps://agentprime.io/advisories/CVE-2024-2408/https://agentprime.io/advisories/CVE-2024-2408/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 09 Jun 2024 19:55:51 GMTCVE