{"cves":["CVE-2026-6722","CVE-2026-6735","CVE-2026-7258","CVE-2026-7259","CVE-2026-7261","CVE-2026-7262","CVE-2026-7568"],"cvss":0.0,"database_specific":{"severity":"IMPORTANT"},"description":"[8.0.30-6]\n- Fix XSS within status endpoint\n  CVE-2026-6735\n- Fix Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()\n  CVE-2026-7259\n- Fix Stale SOAP_GLOBAL(ref_map) pointer with Apache Map\n  CVE-2026-6722\n- Fix Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION\n  CVE-2026-7261\n- Fix Broken Apache map value NULL check\n  CVE-2026-7262\n- Fix Signed integer overflow of char array offset\n  CVE-2026-7568\n- Fix Consistently pass unsigned char to ctype.h functions\n  CVE-2026-7258","id":"ELSA-2026-33449","ovalId":"oval:com.oracle.elsa:def:202633449","source":"oracle_linux","title":"ELSA-2026-33449:  php security update (IMPORTANT)","url":"https://linux.oracle.com/errata/ELSA-2026-33449.html"}