CVE WATCH / VULNERABILITY DETAIL
CVE-2026-109619
CRITICALCVSS 9.8NVD feed
Published 21 October 2026 · tracked since 22 October 2026
Description
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on thi
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-76462 MEDIUM 5.5
- CVE-2026-20236 HIGH 7.5
- CVE-2026-20291 HIGH 7.8
- CVE-2026-20356 HIGH 7.5
- CVE-2026-20043 CRITICAL 9
- CVE-2026-20179 MEDIUM 5.8
- CVE-2026-20197 MEDIUM 5.8
- CVE-2026-20218 MEDIUM 5.8
- CVE-2026-20221 MEDIUM 5.8
- CVE-2026-20011 MEDIUM 5.8