https://patchfirst.co/vendor/thinkphp/New and newly exploited ThinkPHP CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 13:00:36 GMThttps://patchfirst.co/cve/CVE-2018-25270/CVE-2018-25270Wed, 22 Apr 2026 00:00:00 GMTThinkphp · ThinkPHP. Not in CISA KEV. EPSS 0.9% (higher than 59.3% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 65.8 of 100.public-exploithttps://patchfirst.co/cve/CVE-2018-20062/CVE-2018-20062#kevWed, 03 Nov 2021 00:00:00 GMTThinkPHP · noneCms. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 99.5% (higher than 99.95% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1190 Exploit Public-Facing Application. Named in 1 threat report. Priority 73.7 of 100.kevpublic-exploitT1059T1190https://patchfirst.co/cve/CVE-2019-9082/CVE-2019-9082#kevWed, 03 Nov 2021 00:00:00 GMTThinkPHP · ThinkPHP. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 97.4% (higher than 99.9% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter. Priority 69.1 of 100.kevpublic-exploitT1059