PHP CVE lookup

What’s covered

PatchScope tracks vulnerabilities in the PHP interpreter and its bundled extensions (php-src). Framework, CMS, plugin and library vulnerabilities are out of scope — use the official CVE and NVD records for those.

• PHP supported versions
• PHP unsupported branches
• php-src security advisories
• PHP 8 ChangeLog
• CVE Program
• NIST National Vulnerability Database

Reading CVSS scores

CVSS rates technical severity from 0 to 10. Different organizations sometimes score the same CVE differently, so PatchScope shows each score with its source. Severity is not the same as risk: a critical bug in an extension you don’t use, or a Windows-only flaw on a Linux server, may not affect you.