GO-2026-5444 vulnerabilities

Vulnerabilities for packages: frankenphp-8.2, frankenphp-8.3, frankenphp-8.4, frankenphp-8.5...

GO-2026-4775 vulnerabilities

Vulnerabilities for packages: step-issuer-fips, frankenphp-8.2, frankenphp-8.5, frankenphp-8.4, step-ca-fips, caddy-fips, caddy, frankenphp-8.3...

GO-2026-4923 vulnerabilities

Vulnerabilities for packages: grafana, commercial-grafana, containerd, k3s, elastic-agent, kine, loki, mattermost-fips, mattermost, frankenphp-8.3, cloudbeat-fips, rke2-runtime, frankenphp-8.2, beats, grafana-fips, consul, rke2-runtime-fips, datadog-agent-fips, commercial-expanso-edge, consul-fip...

GHSA-JPCW-4WR7-C3VQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-s3control-fips, crossplane-provider-aws-route53, crossplane-provider-aws-elasticbeanstalk, crossplane-provider-azure-securityinsights, crossplane-provider-azure-portal, crossplane-provider-aws-ce-fips, crossplane-provider-aws-dataexchange,...

GHSA-R277-6W6Q-XMQW vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-s3control-fips, crossplane-provider-aws-route53, crossplane-provider-aws-elasticbeanstalk, crossplane-provider-azure-securityinsights, crossplane-provider-azure-portal, crossplane-provider-aws-ce-fips, crossplane-provider-aws-dataexchange,...

GHSA-XCGV-8MV7-V8C7 vulnerabilities

Vulnerabilities for packages: cluster-api, nerdctl, terraform-fips, knative-serving-fips, zarf-fips, ocm-kubernetes-controller-fips, grype-fips, loki, mattermost-fips, dask-gateway, kube-arangodb-fips, frankenphp-8.3, mattermost, azure-aad-pod-identity-mic, ocm-cli, cilium-envoy-fips,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: k9s, nerdctl, chisel, knative-serving-fips, zarf-fips, flux-image-automation-controller-fips, loki, mattermost-fips, minio, kube-arangodb-fips, mattermost, frankenphp-8.3, skaffold, reports-server, frankenphp-8.2, kubernetes-fips, gitea-fips, omnictl-multiarch-fips,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: k9s, nerdctl, chisel, knative-serving-fips, zarf-fips, flux-image-automation-controller-fips, loki, mattermost-fips, minio, kube-arangodb-fips, mattermost, frankenphp-8.3, skaffold, reports-server, frankenphp-8.2, kubernetes-fips, gitea-fips, omnictl-multiarch-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: flux-notification-controller-fips, k9s, nerdctl, chisel, terraform-fips, teleport, trivy-fips, crossplane-provider-azure-securityinsights, knative-serving-fips, zarf-fips, falcoctl, crossplane-provider-azure-portal, flux-image-automation-controller-fips, grype-fips,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: k9s, nerdctl, terraform-fips, knative-serving-fips, zarf-fips, flux-image-automation-controller-fips, grype-fips, loki, mattermost-fips, minio, kube-arangodb-fips, mattermost, frankenphp-8.3, skaffold, reports-server, frankenphp-8.2, witness, kubernetes-fips,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-s3control-fips, chisel, crossplane-provider-aws-route53, crossplane-provider-azure-securityinsights, crossplane-provider-azure-portal, grype-fips, crossplane-provider-azure-servicelinker, crossplane-provider-azure-servicenetworking, gatekeeper...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-s3control-fips, chisel, crossplane-provider-aws-route53, crossplane-provider-azure-securityinsights, crossplane-provider-azure-portal, grype-fips, crossplane-provider-azure-servicelinker, crossplane-provider-azure-servicenetworking, gatekeeper...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: nerdctl, terraform-fips, knative-serving-fips, loki, mattermost-fips, minio, kube-arangodb-fips, mattermost, frankenphp-8.3, reports-server, frankenphp-8.2, kubernetes-fips, docker-cli-buildx-fips, omnictl-multiarch-fips, tekton-pipelines, argo-cd-fips, gatekeeper,...

SUSE CVE-2026-24895

FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP's CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index for finding .php on a lowercased copy of the request path but applies that byte index to the...

CVE-2026-45062 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...

EUVD-2026-36075

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...

CVE-2026-45062

CVE-2026-45062 affects FrankenPHP (versions 1.11.2–1.12.2). The vulnerability arises in the CGI path splitting logic (splitPos in cgi.go), where fallback matching uses golang.org/x/text/search with ignore-case, and engages when the request path contains non-ASCII bytes. Two flaws enable an attack...

CVE-2026-45062 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...

CVE-2026-45062 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...

FrankenPHP 输入验证错误漏洞

FrankenPHP is an open-source PHP application server developed by phpnet. In versions 1.11.2 to 1.2.3 of FrankenPHP, there was a vulnerability related to input validation errors. This vulnerability stemmed from the incorrect use of the splitPos function in cgi.go when the request path contained...