0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
| Supplier | Product | Version (see Status) | Status CVE-2026-109618 | Status CVE-2026-109619 | Notes | Links |
|---|---|---|---|---|---|---|
| Vance Lucas / Graham Campbell / phpdotenv contributors | phpdotenv | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The PHP library loads .env configuration and depends on PHP polyfill packages; boolean validation adds an optional filter requirement. |
source | |
| Vanderbilt University / REDCap Consortium | REDCap | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Official requirements identify PHP on the institution-managed server and PHP SMTP configuration; browser users are separate clients. |
source | |
| Vardot / Varbase project | Varbase Drupal distribution | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The guide uses PHP/Composer in DDEV and describes automatic Drupal installation and recipe application. |
source | |
| Virtualmin | Virtualmin hosted PHP execution modes | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown Virtualmin documents PHP-FPM and FCGId/CGI wrapper execution for customer PHP applications. |
source | |
| VirtueMart project | VirtueMart | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official description states that Joomla and VirtueMart are PHP applications and distinguishes the component from a preinstalled Joomla bundle. |
source | |
| VitalPBX | VitalPBX 4.0 PHP management runtime | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The vendor's4.0.0R4 announcement explicitly records a PHP8.1 upgrade. |
source | |
| VitalPBX | VitXi server-side PHP component | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The VitXi changelog separately documents PHP8.2 support and later Swoole integration. |
source | |
| VK / VKCOM KPHP project | KPHP compiler and native runtime | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance The architecture separates a compiler, native runtime, HTTP server and development extension. |
source 1 source 2 |
|
| VK / VKCOM KPHP project | KPHP vkext development PHP extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown vkext exposes network and TL/RPC functions to PHP for development and is separate from the compiler. |
source 1 source 2 |
|
| Vtiger | Vtiger CRM Open Source | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The vendor's Open Source installation FAQ explicitly requires PHP and several modules. |
source | |
| VuFind project / Villanova University | VuFind | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official dev manifest declares PHP and application/autoload namespaces, including web APIs and console components. |
source |