CVE Tools
Track your stack

Phpoffice

13 CVEs tracked since 2024. Since Oct 2024, none of them reached CISA KEV.

Phpoffice CVEs per month

Oct 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Phpoffice CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2024-1050
2024-114 or fewer
2024-123 or fewer
2025-0180
2025-023 or fewer
2025-035 or fewer
2025-044 or fewer
2025-054 or fewer
2025-064 or fewer
2025-075 or fewer
2025-084 or fewer
2025-094 or fewer
2025-104 or fewer
2025-114 or fewer
2025-125 or fewer
2026-015 or fewer
2026-025 or fewer
2026-037 or fewer
2026-046 or fewer
2026-057 or fewer
2026-067 or fewer
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-106 or fewer

Products

The products that kept showing up in Phpoffice's monthly top three, with their CVEs summed over those months.

  1. Phpspreadsheet132 months

Latest CVEs

The 15 most recently published vulnerabilities affecting Phpoffice.

  1. CVE-2026-108357PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service—
  2. CVE-2026-108359PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)—
  3. CVE-2026-108358PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service—
  4. CVE-2026-108360PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading6.4
  5. CVE-2026-114404PHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and Descriptions6.1
  6. CVE-2026-114403PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load8.1
  7. CVE-2026-59932PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion7.5
  8. CVE-2026-59933PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion7.5
  9. CVE-2026-59931PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist7.7
  10. CVE-2026-45034PhpSpreadsheet: File::prohibitWrappers bypass—
  11. CVE-2026-40863PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader7.5
  12. CVE-2026-40902PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions7.5
  13. CVE-2026-40296PhpSpreadsheet vulnerable to XSS in HTML writer via custom number format codes5.4
  14. CVE-2026-35453PhpSpreadsheet XSS via number format text substitution in HTML Writer5.4
  15. CVE-2026-34084PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load9.8

The record

Peak rank
#107 in Jan 2025
Busiest month shown
Jan 2025, 8 CVEs
Months with a KEV entry
0 since Oct 2024
Monthly snapshots
2 since 2024
Phpoffice's full record, month by month