What’s Vulnerable › Products

phalcon cphalcon vulnerabilities

3 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 3 published in the last 12 months.

Check whether your phalcon cphalcon version is affected

Latest phalcon cphalcon vulnerabilities

• CVE-2026-59989 — Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE) (CVSS 9.2)
• CVE-2026-57584 — Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS (CVSS 8.7)
• CVE-2026-54736 — Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel) (CVSS 8.2)