PHP · weakness class
Information Disclosure
8 CVEs
Out of date: the sync last ran 4 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 8 is a mark on the map. Named now: 1 to 8, most at risk first.
- Leak partial content of the heap through heap buffer over-read in mysqlnd
- PHP is vulnerable to the Marvin Attack
- Cross-origin credential leak in HTTP stream wrapper redirects
- FrankenPHP: Docker images serve phpinfo() as the default index.php, leaking environment variables
- FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Mode
- FrankenPHP 1.5.0 before 1.13.0 Cross-Request Environment Leakage via putenv
- FrankenPHP before 1.13.2 Information Disclosure via libxml Error State in Worker Mode
- FrankenPHP before 1.13.4 Information Disclosure via Per-Request Environment Variable Leak
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.