Pear

Pear, a PHP library and component project, maintains a distributed set of reusable packages spanning web infrastructure, cryptography, and data-handling utilities, making its vulnerabilities relevant across a broad ecosystem of downstream applications despite its modest direct product count. Vulnerabilities affecting this vendor skew strongly toward critical severity, reflecting the foundational role these libraries play in application logic, data processing, and security operations. The exposure recurs through structural weaknesses endemic to dynamic code and data handling: SQL injection in database abstraction layers, code injection in templating and evaluation contexts, regular-expression denial-of-service conditions, and exposure of sensitive information through improper access controls, patterns that arise repeatedly across products such as PearWeb, the core Pear framework, DataGrid datasources, GPG cryptography handling, and HTML/AJAX components. Defenders should treat Pear package updates with urgency, particularly in legacy deployments where multiple older components may coexist, since remediation requires coordinated rebuilds across dependent applications rather than a single vendor patch. Current severity, exploitation activity, and exposure counts are shown alongside this summary.