Critical9.2VulnerabilityActiveExploitedPatch availableEPSS 100%CVE-2026-109618CVE-2026-109619· updated Nov 6
On October 21, PHP released security updates patching CVE-2026-109618 and CVE-2026-109619, two vulnerabilities with CVSS v4.
2 results
On October 21, PHP released security updates patching CVE-2026-109618 and CVE-2026-109619, two vulnerabilities with CVSS v4.
Cisco disclosed on August 19, 2026 that the Open Client Interface (OCI) XML parser in BroadWorks resolves external entities by default, letting an unauthenticated remote attacker send crafted XML to the OCI-P service and read sensitive files with the privileges of the BroadWorks user .