GHSA-R277-6W6Q-XMQW vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53recoveryreadiness, crossplane-provider-aws-wafregional, crossplane-provider-aws-emr-fips, crossplane-provider-aws-ram, crossplane-provider-family-aws, crossplane-provider-aws-pipes, crossplane-provider-aws-guardduty,...

GHSA-JPCW-4WR7-C3VQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53recoveryreadiness, crossplane-provider-aws-wafregional, crossplane-provider-aws-emr-fips, crossplane-provider-aws-ram, crossplane-provider-family-aws, crossplane-provider-aws-pipes, crossplane-provider-aws-guardduty,...

GHSA-XCGV-8MV7-V8C7 vulnerabilities

Vulnerabilities for packages: ocm-kubernetes-controller, flux-source-watcher-fips, k8s-device-plugin, src, chainloop-cli-fips, pinact, elastic-agent, cilium-cli, kube-conformance, harbor, tekton-pipelines-fips, consul, eks-distro-fips, consul-fips, envoy-gateway-fips, gatekeeper,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: cilium-cli, trivy, harbor, tekton-pipelines-fips, gatekeeper, knative-serving-fips, gitea-fips, commercial-expanso-edge, helm, argocd-image-updater-fips, trivy-fips, cert-manager, flux-source-controller-fips, kubescape-server-fips, flux-image-automation-controller,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: cilium-cli, trivy, harbor, tekton-pipelines-fips, gatekeeper, knative-serving-fips, gitea-fips, commercial-expanso-edge, helm, argocd-image-updater-fips, trivy-fips, cert-manager, flux-source-controller-fips, kubescape-server-fips, flux-image-automation-controller,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: sops, gatus, neuvector-sigstore-interface, ko-fips, clickhouse-backup-fips, vault, chainloop-cli-fips, cilium-cli, trivy, vault-benchmark, apply-cve-bump, gitlab-runner-fips, juicefs, crossplane-provider-azure-notificationhubs, witness, harbor, tekton-pipelines-fips,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: chainloop-cli-fips, cilium-cli, trivy, apply-cve-bump, witness, harbor, tekton-pipelines-fips, gatekeeper, jfrog-cli, knative-serving-fips, gitea-fips, gomplate-fips, commercial-expanso-edge, helm, argocd-image-updater-fips, trivy-fips, packer-fips, cert-manager,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: gatus, src, crossplane-provider-aws-emr-fips, crossplane-provider-aws-ram, crossplane-provider-family-aws, longhorn-cli-fips, vault-benchmark, apply-cve-bump, gitlab-runner-fips, witness, consul-fips, google-guest-agent-manager, jfrog-cli,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: gatus, src, crossplane-provider-aws-emr-fips, crossplane-provider-aws-ram, crossplane-provider-family-aws, longhorn-cli-fips, vault-benchmark, apply-cve-bump, gitlab-runner-fips, witness, consul-fips, google-guest-agent-manager, jfrog-cli,...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: cilium-cli, harbor, tekton-pipelines-fips, gatekeeper, knative-serving-fips, commercial-expanso-edge, helm, packer-fips, cert-manager, teleport-operator-fips, tigera-operator, gitlab-workhorse-ce-fips, docker-cli-buildx-fips, etcd-fips, containerd,...

SUSE CVE-2026-24895

FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP's CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index for finding .php on a lowercased copy of the request path but applies that byte index to the...

CVE-2026-45062 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...

EUVD-2026-36075

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...

CVE-2026-45062

CVE-2026-45062 affects FrankenPHP (versions 1.11.2–1.12.2). The vulnerability arises in the CGI path splitting logic (splitPos in cgi.go), where fallback matching uses golang.org/x/text/search with ignore-case, and engages when the request path contains non-ASCII bytes. Two flaws enable an attack...

CVE-2026-45062 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...

CVE-2026-45062 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...

FrankenPHP 输入验证错误漏洞

FrankenPHP is an open-source PHP application server developed by phpnet. In versions 1.11.2 to 1.2.3 of FrankenPHP, there was a vulnerability related to input validation errors. This vulnerability stemmed from the incorrect use of the splitPos function in cgi.go when the request path contained...

PT-2026-46233

Name of the Vulnerable Software and Affected Versions API Platform Core versions 2.6.0 through 4.1.28 API Platform Core versions 4.2.0 through 4.2.25 API Platform Core versions 4.3.0 through 4.3.11 Description A missing isCacheKeySafe gate in the JSON:API and HAL item normalizers leads to a...

GHSA-M675-2P33-XV9G Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files

Summary The FastCGI transport's splitPos in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treatin...

FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

Summary The splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead FrankenPHP into treating a non-.php file as a .php script. In any deployment where the...