CVE-2026-109618: PHP
- Severity
- 9.2 (CRITICAL)
- Vendor
- PHP
- Affected versions
- 8.2.* through before 8.2.35; 8.3.* through before 8.3.36; 8.4.* through before 8.4.27
- Patch status
- Unknown
- Published
- 2026-10-21T14:17:09.357
Why it matters
This matters because the affected product may allow code execution. Prioritize systems that are internet-facing or have privileged access to other infrastructure.
Recommended admin actions
- Prioritize validation immediately due to critical CVSS severity.
- Compare installed versions against the affected version range in the advisory.
- Treat internet-facing systems as higher priority.
- Review logs for suspicious activity related to the affected application or component.
Technical summary
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
View the official NVD record for CVE-2026-109618
CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.
VULNERABILITY PULSE
493 RECORDS
SECURE FEED ACTIVE
| AFFECTED PRODUCT | ACTION | ||
|---|---|---|---|
| CVE-2026-110264 |
GitLab PATCH
Reporter: CVE
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-102785 |
YOOtheme Pro extension for Joomla
Reporter: SECURITY
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-79844 |
Unknown product
Reporter: SECURITY-ALERT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-79846 |
Unknown product
Reporter: SECURITY-ALERT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-79847 |
Unknown product
Reporter: SECURITY-ALERT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-79848 |
Unknown product
Reporter: SECURITY-ALERT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-79849 |
Unknown product
Reporter: SECURITY-ALERT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-79850 |
Unknown product
Reporter: SECURITY-ALERT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-79851 |
Unknown product
Reporter: SECURITY-ALERT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-110063 |
VM Inspector for Azure Virtual Machines
Reporter: SECURE
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-83938 |
Azure Kubernetes Configuration Service
Reporter: SECURE
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-97785 |
Microsoft Entra application proxy
Reporter: SECURE
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-114612 |
litellm PATCH
Reporter: SECURITY-ADVISORIES
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-112241 |
SureCart PATCH
Reporter: AUDIT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-112832 |
Rootblox PATCH
Reporter: AUDIT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79852 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79853 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79854 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79855 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79856 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79857 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79858 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79859 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79860 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79861 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79862 |
Unknown product
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-79863 |
Unknown product
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-79864 |
Unknown product
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-79865 |
Unknown product
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-79866 |
Unknown product
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-79867 |
Unknown product
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-79868 |
HPE
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-79869 |
HPE
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-79870 |
HPE
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-79871 |
HPE
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-97631 |
EDK2
Reporter: INFOSEC
|
9.5
CRITICAL
|
VIEW RECORD |
| CVE-2026-115375 |
Incus 7.0.0 PATCH
Reporter: DISCLOSURE
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-115377 |
Incus PATCH
Reporter: DISCLOSURE
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-115384 |
Wasmtime 39.0.0 PATCH
Reporter: DISCLOSURE
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-79872 |
HPE
Reporter: SECURITY-ALERT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-114625 |
VeloCloud Orchestrator (VCO) on-prem
Reporter: PSIRT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-109122 |
DHS
Reporter: ICS-CERT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-107861 |
DHS
Reporter: ICS-CERT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-110243 |
DHS
Reporter: ICS-CERT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-114575 |
A950RG
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-114220 |
NT OneAPP developed by NewType Infortech
Reporter: TWCERT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-112327 |
Amelia PATCH
Reporter: AUDIT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2021-48014 |
FineReport 9.0
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2021-48016 |
DedeCMS
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2022-51026 |
Bytebase 0.12.0 PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-79873 |
HPE
Reporter: SECURITY-ALERT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-79874 |
HPE
Reporter: SECURITY-ALERT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-79875 |
HPE
Reporter: SECURITY-ALERT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-79876 |
HPE
Reporter: SECURITY-ALERT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-115324 |
mem0 0.1.117 PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-111497 |
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli
Reporter: CVE-COORDINATION
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-115353 |
Mistune PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-111594 |
InterSystems IRIS for Health
Reporter: ICS-CERT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-96355 |
Webform
Reporter: MLHESS
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-114219 |
NT OneAPP developed by NewType Infortech
Reporter: TWCERT
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-114607 |
better-auth PATCH
Reporter: SECURITY-ADVISORIES
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-114611 |
OCO-Server PATCH
Reporter: SECURITY-ADVISORIES
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-105014 |
a command ('command injection') in Azure Pipelines
Reporter: SECURE
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-114661 |
OpenRemote 1.2.0 PATCH
Reporter: DISCLOSURE
|
9
CRITICAL
|
VIEW RECORD |
| CVE-2026-115372 |
Incus from 7.3.0 PATCH
Reporter: DISCLOSURE
|
9
CRITICAL
|
VIEW RECORD |
| CVE-2026-114177 |
Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons
Reporter: AUDIT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-112242 |
Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder
Reporter: AUDIT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2019-25778 |
SeaCMS
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2022-51021 |
NotificationX PATCH
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2022-51022 |
YiShaAdmin 2.2 PATCH
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2022-51023 |
PHPOK 4.5.000 PATCH
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2024-58393 |
Readymade Unilevel Ecommerce MLM
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2025-71434 |
Weaver E-cology 8.0, 9.0, and 10.0 PATCH
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-108357 |
PhpSpreadsheet PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-108358 |
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-115392 |
Wasmtime PATCH
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-79877 |
HPE
Reporter: SECURITY-ALERT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-79878 |
HPE
Reporter: SECURITY-ALERT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-79879 |
HPE
Reporter: SECURITY-ALERT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-114658 |
Grav Login plugin from 3.6.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-105270 |
esaml
Reporter: 6B3AD84C-E1A6-4BF7-A703-F496B71E49DB
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-93471 |
esaml
Reporter: 6B3AD84C-E1A6-4BF7-A703-F496B71E49DB
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2017-20287 |
Javo Spot PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2018-25438 |
Intermesh Group-Office 3.3.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2018-25439 |
MetInfo CMS 6.0.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2019-25779 |
WooThemes Diarise
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2021-48013 |
Weaver E-cology 8.0
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2021-48015 |
JeeWMS
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2021-48017 |
OrbiTeam BSCW Server 5.x PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2022-51024 |
Kavita 0.5.2 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2024-58396 |
CPAS Audit Management System
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115325 |
Netmaker
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115328 |
JSON-SCADA PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115330 |
Lotus
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115331 |
Lotus
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115332 |
Lotus
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-113582 |
UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera
Reporter: SECURITY
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-108359 |
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files PATCH
Reporter: SECURITY-ADVISORIES
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-113873 |
HAPI FHIR
Reporter: 9119A7D8-5EAB-497F-8521-727C672E3725
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115347 |
Mistune PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
About the Vulnerability Pulse CVE Feed
The Vulnerability Pulse feed tracks live CVE advisories sourced from the National Vulnerability Database and vendor security disclosures. It is designed for SOC analysts, IT administrators, and security teams who need a fast, filterable view of current vulnerabilities without digging through raw NVD data.
How to Use the CVE Advisory Tracker
Use the severity filters to narrow results to Critical or High priority vulnerabilities. Filter by vendor to focus on software and hardware relevant to your environment. Export to CSV for reporting, ticketing, or patch prioritization workflows.
What Is a CVE Advisory?
A CVE (Common Vulnerabilities and Exposures) advisory is a public disclosure of a security vulnerability assigned a unique identifier by MITRE. Advisories include severity scores (CVSS), affected versions, and remediation guidance. Monitoring CVE advisories is a core function of vulnerability management programs and SOC operations.
CVE Analysis & Writeups
For in-depth analysis of specific vulnerabilities, visit the IT Knowledge Bases blog for CVE breakdowns, exploitation analysis, and remediation guidance written for security practitioners.