GO-2026-5444 vulnerabilities

Vulnerabilities for packages: frankenphp-8.2, frankenphp-8.5, frankenphp-8.3, frankenphp-8.4...

GO-2026-4775 vulnerabilities

Vulnerabilities for packages: frankenphp-8.2, frankenphp-8.5, caddy, frankenphp-8.4, step-ca-fips, frankenphp-8.3, caddy-fips, step-issuer-fips...

GO-2026-4923 vulnerabilities

Vulnerabilities for packages: frankenphp-8.3, beats-fips, vault, loki, commercial-grafana, commercial-expanso-edge, zot, rke2-runtime-fips, grafana-fips, k3s, consul, mattermost-fips, fuse-overlayfs-snapshotter, mattermost, beats, grafana, containerd, elastic-agent-fips, rke2-runtime,...

SUSE CVE-2026-45062

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...

GHSA-R277-6W6Q-XMQW vulnerabilities

Vulnerabilities for packages: crossplane-provider-gcp-fips, crossplane-provider-aws-cloudsearch-fips, crossplane-provider-aws-dax-fips, crossplane-provider-aws-mwaa-fips, crossplane-provider-aws-sesv2-fips, crossplane-provider-aws-dataexchange-fips, crossplane-provider-aws-appflow-fips,...

GHSA-JPCW-4WR7-C3VQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-gcp-fips, crossplane-provider-aws-cloudsearch-fips, crossplane-provider-aws-dax-fips, crossplane-provider-aws-mwaa-fips, crossplane-provider-aws-sesv2-fips, crossplane-provider-aws-dataexchange-fips, crossplane-provider-aws-appflow-fips,...

GHSA-XCGV-8MV7-V8C7 vulnerabilities

Vulnerabilities for packages: rclone-fips, azurefile-csi, hubble, gatekeeper, karpenter, knative-operator-fips, gatekeeper-fips, flux, langfuse, dataplaneapi-fips, kube-arangodb-fips, rekor, loki, fleet-server, commercial-expanso-edge, azuredisk-csi, docker-cli-fips, k8s-device-plugin, podman-fip...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: argo-workflows, chisel, minio-fips, gatekeeper, gatekeeper-fips, flux, kube-arangodb-fips, loki, aactl, spire-server, commercial-expanso-edge, external-secrets-operator-fips, skaffold, coder-fips, k9s-fips, argo-cd, commercial-kyverno, seaweedfs-rocksdb-fips,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: argo-workflows, chisel, minio-fips, gatekeeper, gatekeeper-fips, flux, kube-arangodb-fips, loki, aactl, spire-server, commercial-expanso-edge, external-secrets-operator-fips, skaffold, coder-fips, k9s-fips, argo-cd, commercial-kyverno, seaweedfs-rocksdb-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: ollama-fips, argo-workflows, chisel, crossplane-provider-azure-securityinsights, minio-fips, gatekeeper, crossplane-provider-azure-authorization, gatekeeper-fips, tkn, flux, fulcio-fips, kube-arangodb-fips, flux-operator-fips, openbao, loki, witness, aactl,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: argo-workflows, minio-fips, gatekeeper, gatekeeper-fips, flux, kube-arangodb-fips, loki, witness, aactl, argo-events, spire-server, chezmoi, commercial-expanso-edge, podman-fips, external-secrets-operator-fips, skaffold, k9s-fips, argo-cd, gptscript,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: minio-fips, crossplane-provider-aws-cloudsearch-fips, gatekeeper, gatekeeper-fips, crossplane-provider-aws-sesv2-fips, kube-arangodb-fips, loki, crossplane-provider-aws-appflow-fips, aactl, crossplane-provider-aws-cloudformation-fips, crossplane-provider-aws-emr,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: minio-fips, crossplane-provider-aws-cloudsearch-fips, gatekeeper, gatekeeper-fips, crossplane-provider-aws-sesv2-fips, kube-arangodb-fips, loki, crossplane-provider-aws-appflow-fips, aactl, crossplane-provider-aws-cloudformation-fips, crossplane-provider-aws-emr,...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: argo-workflows, gatekeeper, gatekeeper-fips, flux, kube-arangodb-fips, loki, aactl, spire-server, commercial-expanso-edge, podman-fips, external-secrets-operator-fips, argo-cd, commercial-kyverno, prometheus-fips, gitlab-rails-ce-fips, vitess, containerd,...

GO-2026-5084 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files in github.com/dunglas/frankenphp

FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files in github.com/dunglas/frankenphp...

SUSE CVE-2026-24895

FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP's CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index for finding .php on a lowercased copy of the request path but applies that byte index to the...

CVE-2026-45062

CVE-2026-45062 affects FrankenPHP (versions 1.11.2–1.12.2). The vulnerability arises in the CGI path splitting logic (splitPos in cgi.go), where fallback matching uses golang.org/x/text/search with ignore-case, and engages when the request path contains non-ASCII bytes. Two flaws enable an attack...

CVE-2026-45062 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...

EUVD-2026-36075

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...

CVE-2026-45062 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...