0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
| Supplier | Product | Version (see Status) | Status CVE-2026-109618 | Status CVE-2026-109619 | Notes | Links |
|---|---|---|---|---|---|---|
| Kanboard project | Kanboard | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The server-side requirements distinguish PHP versions and extensions from ordinary browser/device requirements. |
source | |
| Kevin Papst / Kimai project | Kimai | Kimai 2.70.1 rebuilt supported Docker image tags | Fix | Fix | CVE assessment: Kimai's 2.70.1 release triggers patched PHP Docker rebuilds; the maintainer subsequently confirms that supported tags have been pushed. Self-hosted non-container installations still need their own PHP runtime update. Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references. |
source 1 source 2 source 3 source 4 source 5 source 6 |
| Kinsta | Kinsta managed WordPress PHP hosting | Platform-wide PHP security rollout completed 2026-10-22 08:26 UTC; covered branches 7.4 / 8.0 / 8.1 / 8.2 / 8.3 / 8.4 / 8.5 | Fix | Fix | CVE assessment: Kinsta's official incident reports the PHP security updates rolled out across the platform at 08:26 UTC on 22 October, following explicit branch-by-branch patch rollout updates. This records the vendor's completed managed-platform remediation, not a published independent package build ID or a guarantee about prior compromise. Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements. |
source 1 source 2 source 3 |
| Kirby CMS project | Kirby CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Kirby provides version-specific PHP support and required, recommended and optional extension lists. |
source | |
| Klemen Stirn / Hesk | Hesk Free self-hosted helpdesk | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The vendor identifies Hesk Free as self-hosted PHP/MySQL software and publishes its version and PHP range. |
source | |
| Kopano / Kopano-dev | Kopano WebApp | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official WebApp mirror explicitly lists PHP server dependencies and a separate native MAPI interface. |
source | |
| Krayin | Krayin CRM | Investigation | Investigation | CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown The official Krayin CRM repository requires PHP 8.3 or higher for the Laravel CRM, and GitHub exposes an SPDX dependency-graph SBOM for the repository. |
source 1 source 2 |