GO-2026-5444 vulnerabilities

Vulnerabilities for packages: frankenphp-8.4, frankenphp-8.3, frankenphp-8.5, frankenphp-8.2...

GO-2026-4775 vulnerabilities

Vulnerabilities for packages: step-issuer-fips, frankenphp-8.4, frankenphp-8.3, frankenphp-8.5, frankenphp-8.2, caddy, step-ca-fips, caddy-fips...

GO-2026-4923 vulnerabilities

Vulnerabilities for packages: containerd, frankenphp-8.3, commercial-expanso-edge, elastic-agent, frankenphp-8.4, commercial-grafana, elastic-agent-fips, vault, kine, frankenphp-8.5, consul, grafana-fips, loki, rke2-runtime, zot, grafana, mattermost, fuse-overlayfs-snapshotter, beats,...

GHSA-R277-6W6Q-XMQW vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-applicationinsights, crossplane-provider-aws-kafka-fips, crossplane-provider-aws-networkmanager, crossplane-provider-aws-kms, crossplane-provider-aws-inspector2-fips, crossplane-provider-aws-deploy, crossplane-provider-aws-mediapackage-fips,...

GHSA-JPCW-4WR7-C3VQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-applicationinsights, crossplane-provider-aws-kafka-fips, crossplane-provider-aws-networkmanager, crossplane-provider-aws-kms, crossplane-provider-aws-inspector2-fips, crossplane-provider-aws-deploy, crossplane-provider-aws-mediapackage-fips,...

GHSA-XCGV-8MV7-V8C7 vulnerabilities

Vulnerabilities for packages: ocm-cli, kubernetes, kyverno-policy-reporter-plugins-kyverno-fips, falco-no-driver, cluster-api, harbor, authentik-fips, flux-fips, ocm-kubernetes-controller-fips, kubernetes-fips, cilium-envoy-fips, cloud-sql-proxy, prometheus-fips, art, undock, commercial-grafana,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: kubernetes, cilium, falco-no-driver, harbor, flux-fips, knative-kafka-broker, kubernetes-fips, kuma, prometheus-fips, tekton-pipelines, commercial-grafana, gatekeeper, flux, etcd, kube-conformance, knative-serving-fips, kube-arangodb-fips, kube-state-metrics,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: kubernetes, cilium, falco-no-driver, harbor, flux-fips, knative-kafka-broker, kubernetes-fips, kuma, prometheus-fips, tekton-pipelines, commercial-grafana, gatekeeper, flux, etcd, kube-conformance, knative-serving-fips, kube-arangodb-fips, kube-state-metrics,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: kubernetes, kyverno-policy-reporter-plugins-kyverno-fips, cilium, falco-no-driver, redpanda-console, harbor, flux-fips, knative-kafka-broker, terraform-provider-tls-fips, kubernetes-fips, crossplane-provider-azure-storage, kuma, dagger, syft-fips,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: kubernetes, cilium, falco-no-driver, redpanda-console, harbor, flux-fips, knative-kafka-broker, kubernetes-fips, kuma, dagger, syft-fips, prometheus-fips, argo-events-fips, tekton-pipelines, commercial-grafana, gatekeeper, flux, etcd, grype, kube-conformance,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kafka-fips, crossplane-provider-aws-networkmanager, falco-no-driver, crossplane-provider-aws-kms, knative-kafka-broker, restic-fips, dagger, docker-compose, crossplane-provider-aws-mediapackage-fips, crossplane-provider-aws-s3control,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kafka-fips, crossplane-provider-aws-networkmanager, falco-no-driver, crossplane-provider-aws-kms, knative-kafka-broker, restic-fips, dagger, docker-compose, crossplane-provider-aws-mediapackage-fips, crossplane-provider-aws-s3control,...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: kubernetes, cilium, falco-no-driver, harbor, knative-kafka-broker, kubernetes-fips, kuma, prometheus-fips, tekton-pipelines, commercial-grafana, gatekeeper, flux, etcd, kube-conformance, knative-serving-fips, kube-arangodb-fips, kube-state-metrics,...

SUSE CVE-2026-24895

FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP's CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index for finding .php on a lowercased copy of the request path but applies that byte index to the...

EUVD-2026-36075

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...

CVE-2026-45062

CVE-2026-45062 affects FrankenPHP (versions 1.11.2–1.12.2). The vulnerability arises in the CGI path splitting logic (splitPos in cgi.go), where fallback matching uses golang.org/x/text/search with ignore-case, and engages when the request path contains non-ASCII bytes. Two flaws enable an attack...

CVE-2026-45062 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...

CVE-2026-45062 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...

CVE-2026-45062 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...

FrankenPHP 输入验证错误漏洞

FrankenPHP is an open-source PHP application server developed by phpnet. In versions 1.11.2 to 1.2.3 of FrankenPHP, there was a vulnerability related to input validation errors. This vulnerability stemmed from the incorrect use of the splitPos function in cgi.go when the request path contained...