PHP 7.0

Vulnerabilities in PHP 7.0

151 vulnerabilities from the NVD affect at least one version of this branch. Last checked on 03/11/2026.

• CVE-2026-109619, CVSS 4.0: 9.2, actively exploited: still open in 7.0.33
• CVE-2024-3566, CVSS 3.1: 9.8: still open in 7.0.33
• CVE-2019-9641, CVSS 3.1: 9.8: still open in 7.0.33
• CVE-2019-9023, CVSS 3.0: 9.8: still open in 7.0.33
• CVE-2019-9021, CVSS 3.0: 9.8: still open in 7.0.33
• CVE-2019-9020, CVSS 3.0: 9.8: still open in 7.0.33
• CVE-2017-9225, CVSS 3.0: 9.8: still open in 7.0.33
• CVE-2017-9120, CVSS 3.1: 9.8: still open in 7.0.33
• CVE-2017-8923, CVSS 3.1: 9.8: still open in 7.0.33
• CVE-2019-6977, CVSS 3.0: 8.8: still open in 7.0.33
• CVE-2019-9675, CVSS 3.0: 8.1: still open in 7.0.33
• CVE-2019-9639, CVSS 3.1: 7.5: still open in 7.0.33
• CVE-2019-9638, CVSS 3.1: 7.5: still open in 7.0.33
• CVE-2019-9637, CVSS 3.0: 7.5: still open in 7.0.33
• CVE-2019-9024, CVSS 3.0: 7.5: still open in 7.0.33
• CVE-2019-9022, CVSS 3.0: 7.5: still open in 7.0.33
• CVE-2018-19396, CVSS 3.0: 7.5: still open in 7.0.33
• CVE-2018-19395, CVSS 3.0: 7.5: still open in 7.0.33
• CVE-2017-9229, CVSS 3.1: 7.5: still open in 7.0.33
• CVE-2017-7963, CVSS 3.0: 7.5: still open in 7.0.33
• CVE-2017-7272, CVSS 3.0: 7.4: still open in 7.0.33
• CVE-2022-31629, CVSS 3.1: 6.5: still open in 7.0.33
• CVE-2015-9253, CVSS 3.0: 6.5: still open in 7.0.33
• CVE-2022-4900, CVSS 3.1: 5.5: still open in 7.0.33
• CVE-2022-31628, CVSS 3.1: 5.5: still open in 7.0.33
• CVE-2018-7584, CVSS 3.0: 9.8: fixed in 7.0.28
• CVE-2017-9228, CVSS 3.1: 9.8: fixed in 7.0.21
• CVE-2017-9227, CVSS 3.1: 9.8: fixed in 7.0.21
• CVE-2017-9226, CVSS 3.1: 9.8: fixed in 7.0.21
• CVE-2017-9224, CVSS 3.1: 9.8: fixed in 7.0.21
• CVE-2017-5340, CVSS 3.1: 9.8: fixed in 7.0.15
• CVE-2017-12933, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2017-12932, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2017-11362, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-9936, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-9935, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-9138, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-9137, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-7568, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-7480, CVSS 3.1: 9.8: fixed in 7.0.11
• CVE-2016-7479, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-7417, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-7414, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-7413, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-7134, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-7129, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-7127, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-7126, CVSS 3.1: 9.8: not affected in 7.0.33
• CVE-2016-7124, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-6296, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-6295, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-6294, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-6291, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-6290, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-5773, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-5772, CVSS 3.1: 9.8: fixed in 7.0.8
• CVE-2016-5771, CVSS 3.1: 9.8: fixed in 7.0.8
• CVE-2016-5770, CVSS 3.1: 9.8: fixed in 7.0.8
• CVE-2016-5769, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-5768, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-4544, CVSS 3.1: 9.8: fixed in 7.0.6
• CVE-2016-4543, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-4542, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-4541, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-4540, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-4539, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-4538, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-4537, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-4473, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-4346, CVSS 3.1: 9.8: fixed in 7.0.4
• CVE-2016-4345, CVSS 3.1: 9.8: fixed in 7.0.4
• CVE-2016-4344, CVSS 3.1: 9.8: fixed in 7.0.4
• CVE-2016-4073, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-4072, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-4071, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-3132, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-3078, CVSS 3.1: 9.8: fixed in 7.0.6
• CVE-2016-3074, CVSS 3.1: 9.8: fixed in 7.0.6
• CVE-2016-2554, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2016-1283, CVSS 3.1: 9.8: fixed in 7.0.25
• CVE-2016-10160, CVSS 3.1: 9.8: fixed in 7.0.15
• CVE-2015-8880, CVSS 3.1: 9.8: not affected in 7.0.33
• CVE-2015-8617, CVSS 3.0: 9.8: not affected in 7.0.33
• CVE-2015-8394, CVSS 3.1: 9.8: fixed in 7.0.3
• CVE-2015-8391, CVSS 3.1: 9.8: fixed in 7.0.3
• CVE-2015-8390, CVSS 3.1: 9.8: fixed in 7.0.3
• CVE-2015-8389, CVSS 3.1: 9.8: fixed in 7.0.3
• CVE-2015-8386, CVSS 3.1: 9.8: fixed in 7.0.3
• CVE-2015-8383, CVSS 3.1: 9.8: fixed in 7.0.3
• CVE-2015-8866, CVSS 3.1: 9.6: fixed in 7.0.27
• CVE-2017-11147, CVSS 3.1: 9.1: fixed in 7.0.15
• CVE-2016-5114, CVSS 3.0: 9.1: not affected in 7.0.33
• CVE-2016-1903, CVSS 3.0: 9.1: not affected in 7.0.33
• CVE-2018-10549, CVSS 3.0: 8.8: fixed in 7.0.30
• CVE-2016-6297, CVSS 3.0: 8.8: not affected in 7.0.33
• CVE-2016-4343, CVSS 3.1: 8.8: fixed in 7.0.3
• CVE-2016-4342, CVSS 3.0: 8.8: not affected in 7.0.33
• CVE-2016-5093, CVSS 3.0: 8.6: not affected in 7.0.33
• CVE-2015-8616, CVSS 3.0: 8.6: not affected in 7.0.33
• CVE-2016-7412, CVSS 3.0: 8.1: not affected in 7.0.33

And 51 more.

23 vulnerabilities of PHP have no version information in the NVD and are not assigned to any branch.

Known vulnerabilities in PHP

• PHP2Shell (CVE-2026-109618, CVE-2026-109619)