0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
| Supplier | Product | Version (see Status) | Status CVE-2026-109618 | Status CVE-2026-109619 | Notes | Links |
|---|---|---|---|---|---|---|
| m0n0wall project | m0n0wall legacy PHP-CGI management appliance | Investigation | Investigation | CVE assessment: Historical scope; current use unknown The project's facts page lists PHP-CGI; its closure announcement ends further development/releases. |
source 1 source 2 |
|
| Mage-OS project | Mage-OS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official page lists PHP runtime requirements and identifies the Magento base for Mage-OS release families. |
source | |
| Magento / Adobe | Magento Open Source | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade. Adobe's shared PHP settings page supplies a separate Magento Open Source extension list and makes pcntl conditional on parallel indexing. |
source 1 source 2 |
|
| MailWatch project | MailWatch for MailScanner | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official repository explicitly describes a PHP web front end to the separate MailScanner system. |
source | |
| MAMP GmbH | MAMP local server environment | MAMP / MAMP PRO 5.0.7 for Windows with PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 selected | Fix | Fix | CVE assessment: MAMP's 2026-10-23 Windows release adds the PHP versions identified by upstream as fixing both CVEs. The installer also retains older PHP choices; this confirmation does not cover macOS or use of an older bundled runtime. Install the Windows 5.0.7 release, select one of its fixed PHP versions and restart the services. |
source 1 source 2 source 3 source 4 |
| MantisBT project | MantisBT | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The project's own installation requirements explicitly identify PHP for the bug tracker server. |
source | |
| Matomo | Matomo On-Premise | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The vendor FAQ confirms PHP web/CLI processing and upcoming beta requirements; the 5.x source root preserves a lower declared PHP floor. |
source 1 source 2 |
|
| Matomo / InnoCraft | Matomo Analytics for WordPress | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The publisher listing identifies server-side analytics processing in WordPress and version-gated PHP requirements for the coming Matomo-6 update. |
source | |
| Matomo team | Matomo PHP tracking client | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown The tracking package requires PHP ^8.1 and json, and suggests curl for HTTPS tracking requests. |
source | |
| Mautic project | Mautic | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official installation guide documents PHP web settings and console execution for marketing automation. |
source 1 source 2 source 3 |
|
| Mautic project | Mautic official Docker images (PHP security rebuilds) | Mautic 5 / 6 / 7 Docker image rebuilds announced 2026-10-21 | Fix | Fix | CVE assessment: Mautic confirms security rebuilds of its 5, 6 and 7 Docker images were released on 2026-10-21 following the fixes for both CVEs. Pull and recreate the announced security rebuilds. Historic or cached images and independent PHP installations are outside this fix scope. |
source |
| MediaWiki project | MediaWiki | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade. MediaWiki explicitly requires PHP, lists native modules and distinguishes recommended modules from a 32-bit arithmetic alternative. |
source | |
| MessageBird | MessageBird PHP REST API client | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown The publisher client requires PHP >=8.0, curl/json and Firebase JWT support. |
source | |
| Metaways / tine project | tine groupware | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The project requires PHP for the groupware server and lists mandatory and optional modules separately from browser/native clients. |
source | |
| Microsoft | Azure App Service PHP on Linux | Linux built-in PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 on Latest and Standard | Fix | Fix | CVE assessment: The Azure App Service team confirms completed rollout of fixed built-in Linux PHP images to Latest and Standard. Extended, EOL runtimes and customer-maintained containers are not covered by that completion statement. Use a supported runtime on Latest or Standard and verify the running PHP patch version; rebuild custom containers separately. |
source 1 source 2 source 3 |
| Microsoft Azure Storage | Microsoft Azure Storage PHP blob client package (retired) | Investigation | Investigation | CVE assessment: Historical scope; current use unknown The published blob package declares PHP >=5.6.0. The official family notice marks the Storage PHP clients retired; this is a caller-side legacy package. |
source 1 source 2 |
|
| Microsoft Azure Storage | Microsoft Azure Storage PHP common client package (retired) | Investigation | Investigation | CVE assessment: Historical scope; current use unknown The published common package declares PHP >=5.6.0. The official family notice marks the Storage PHP clients retired; this is a caller-side legacy package. |
source 1 source 2 |
|
| Microsoft Azure Storage | Microsoft Azure Storage PHP file client package (retired) | Investigation | Investigation | CVE assessment: Historical scope; current use unknown The published file package declares PHP >=5.6.0. The official family notice marks the Storage PHP clients retired; this is a caller-side legacy package. |
source 1 source 2 |
|
| Microsoft Azure Storage | Microsoft Azure Storage PHP queue client package (retired) | Investigation | Investigation | CVE assessment: Historical scope; current use unknown The published queue package declares PHP >=5.6.0. The official family notice marks the Storage PHP clients retired; this is a caller-side legacy package. |
source 1 source 2 |
|
| Microsoft Azure Storage | Microsoft Azure Storage PHP table client package (retired) | Investigation | Investigation | CVE assessment: Historical scope; current use unknown The published table package declares PHP >=5.6.0. The official family notice marks the Storage PHP clients retired; this is a caller-side legacy package. |
source 1 source 2 |
|
| Microsoft Graph Client Tooling | Microsoft Graph PHP SDK | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown The SDK declares PHP ^8.2 and microsoft/microsoft-graph-core ^3.0.0 for caller-side Graph access. |
source | |
| MISP project / CIRCL | MISP 2.5 core PHP server | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Official requirements distinguish mandatory PHP extensions from recommended modules for MISP2.5. |
source 1 source 2 |
|
| Mockery project | Mockery PHP test-double framework | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for mockery/mockery 1.6.15 declares PHP >=7.3 for this tool/library. |
source | |
| MODX project | MODX Revolution | Installations served by unpatched PHP; application versions are not the patch boundary | Vulnerable | Vulnerable | CVE assessment: MODX confirms that these PHP vulnerabilities affect the runtime serving MODX; updating MODX alone does not fix them. MODX Cloud is a separate scope for which the vendor confirms deployed PHP patches. MODX confirms that these PHP vulnerabilities affect the runtime serving MODX; updating MODX alone does not fix them. MODX Cloud is a separate scope for which the vendor confirms deployed PHP patches. |
source 1 source 2 |
| Mollie | Mollie Payments for WooCommerce | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The publisher's listing requires PHP, cURL and JSON and documents merchant API keys and payment-status webhooks. |
source | |
| Mollie B.V. | Mollie API PHP client | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown Mollie's PHP client declares PHP ^8.2, curl/json/openssl and PSR transport interfaces. A separate Mollie OAuth package is suggested for some endpoints. |
source | |
| MongoDB PHP driver team | MongoDB native PHP driver extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PECL identifies the native glue layer and native-library updates; the PHP manual supplies a version-qualified family minimum and default bundled/native options. Userland mongodb/mongodb requirements remain separate. |
source 1 source 2 |
|
| MongoDB PHP driver team | MongoDB PHP userland library | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown The userland library requires PHP ^8.1 and ext-mongodb ^2.5; its metadata replaces mongodb/builder. |
source | |
| Monica project | Monica | Investigation | Investigation | CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown The official Monica Composer manifest declares PHP ^8.3 for the personal CRM, and GitHub exposes an SPDX dependency-graph SBOM for the repository. |
source 1 source 2 |
|
| Montala / ResourceSpace | ResourceSpace | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The vendor identifies PHP as the server language, gives per-release bands and required distro packages, and separates external media tools. |
source | |
| Moodle project | Moodle | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Official 5.3 notes specify PHP 8.3.0+, additional 8.4.x support, sodium and 64-bit PHP. The download catalogue separates the 5.3 release from weekly 5.3+ packages and publishes a release checksum. |
source 1 source 2 source 3 source 4 |
|
| Moodle project / complete-installer packagers | Moodle Windows complete installer family | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Moodle publishes Windows installers containing Apache, MySQL and PHP, built using XAMPP. Its catalogue warns of component requirements mismatches and against production use. |
source | |
| Moodle project / Ralf Krause | Moodle4Mac complete installer family | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Moodle publishes MAMP-based installers containing Apache, MySQL and PHP. The linked guide restricts them to local testing/development and documents modified environment checks. |
source 1 source 2 |
|
| msgpack-php project | MessagePack native PHP serialization extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official catalogue describes a PHP MessagePack API and declares the selected 3.0.1 release minimum. |
source | |
| MyBB Group | MyBB | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official MyBB 1.8 installation requirements identify PHP and three named extensions plus a selected database driver. |
source | |
| MyBB Group | MyBB Merge System | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official requirements name Merge System separately from the running MyBB forum and require PHP for the migration tool. |
source |