0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
| Supplier | Product | Version (see Status) | Status CVE-2026-109618 | Status CVE-2026-109619 | Notes | Links |
|---|---|---|---|---|---|---|
| Vance Lucas / Graham Campbell / phpdotenv contributors | phpdotenv | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The PHP library loads .env configuration and depends on PHP polyfill packages; boolean validation adds an optional filter requirement. |
source | |
| Vanderbilt University / REDCap Consortium | REDCap | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Official requirements identify PHP on the institution-managed server and PHP SMTP configuration; browser users are separate clients. |
source | |
| Vardot / Varbase project | Varbase Drupal distribution | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The guide uses PHP/Composer in DDEV and describes automatic Drupal installation and recipe application. |
source | |
| Virtualmin | Virtualmin hosted PHP execution modes | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown Virtualmin documents PHP-FPM and FCGId/CGI wrapper execution for customer PHP applications. |
source | |
| VirtueMart project | VirtueMart | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official description states that Joomla and VirtueMart are PHP applications and distinguishes the component from a preinstalled Joomla bundle. |
source | |
| VitalPBX | VitalPBX 4.0 PHP management runtime | VitalPBX 4.0 / 4.0.0 R4 on Debian 11 with unpatched PHP 8.1 | Vulnerable | Vulnerable | CVE assessment: VitalPBX staff confirms mitigation-only guidance for the legacy Debian 11/PHP 8.1 runtime and says no vendor patch will be provided for that PHP version. The 4.0.0 R4 release announcement identifies PHP 8.1. Both CVEs remain affected; the separately announced PHP 8.2.35 update for Debian 12 does not fix this legacy runtime. Follow VitalPBX's PHP 8.1 FPM mitigation guidance and plan migration to a supported platform with a verified patched runtime. The vendor states that the mitigations are not a full fix. |
source 1 source 2 source 3 source 4 |
| VitalPBX | VitalPBX 4.5 PHP management runtime (Debian 12) | VitalPBX 4.5 on Debian 12 with PHP 8.2.35 or a later patched 8.2 release | Fix | Fix | CVE assessment: VitalPBX confirms that updating its Debian 12 PHP 8.2 packages to PHP 8.2.35 fixes both PHP2Shell CVEs. The fix is a PHP package update; the VitalPBX application version alone does not establish that it has been applied. Apply the vendor PHP package update to each Debian 12 installation and verify PHP 8.2.35 or a later patched 8.2 release. Existing installations running older PHP require the update. |
source 1 source 2 source 3 source 4 |
| VitalPBX | VitXi server-side PHP component | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The VitXi changelog separately documents PHP8.2 support and later Swoole integration. |
source | |
| VK / VKCOM KPHP project | KPHP compiler and native runtime | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance The architecture separates a compiler, native runtime, HTTP server and development extension. |
source 1 source 2 |
|
| VK / VKCOM KPHP project | KPHP vkext development PHP extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown vkext exposes network and TL/RPC functions to PHP for development and is separate from the compiler. |
source 1 source 2 |
|
| Vtiger | Vtiger CRM Open Source | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The vendor's Open Source installation FAQ explicitly requires PHP and several modules. |
source | |
| VuFind project / Villanova University | VuFind | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official dev manifest declares PHP and application/autoload namespaces, including web APIs and console components. |
source |