GO-2026-5444 vulnerabilities

Vulnerabilities for packages: frankenphp-8.3, frankenphp-8.2, frankenphp-8.4, frankenphp-8.5...

GO-2026-4775 vulnerabilities

Vulnerabilities for packages: frankenphp-8.2, caddy, step-ca-fips, step-issuer-fips, frankenphp-8.3, frankenphp-8.4, frankenphp-8.5, caddy-fips...

GO-2026-4923 vulnerabilities

Vulnerabilities for packages: rke2-runtime, datadog-agent, consul-fips, beats, commercial-grafana, containerd, rke2-runtime-fips, mattermost, datadog-agent-fips, frankenphp-8.5, frankenphp-8.2, zot, elastic-agent-fips, cloudbeat-fips, loki, cloudbeat, frankenphp-8.3, beats-fips,...

GHSA-JPCW-4WR7-C3VQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-sfn, crossplane-provider-aws-route53recoveryreadiness, crossplane-provider-aws-mediastore-fips, crossplane-provider-azure-servicelinker, crossplane-provider-aws-quicksight, crossplane-provider-aws-ecr-fips,...

GHSA-R277-6W6Q-XMQW vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-sfn, crossplane-provider-aws-route53recoveryreadiness, crossplane-provider-aws-mediastore-fips, crossplane-provider-azure-servicelinker, crossplane-provider-aws-quicksight, crossplane-provider-aws-ecr-fips,...

GHSA-XCGV-8MV7-V8C7 vulnerabilities

Vulnerabilities for packages: knative-operator-fips, terraform, k9s-fips, authentik-fips, argo-workflows-fips, cloud-provider-azure, flux-source-watcher-fips, ingress-nginx-controller-fips, atlantis-fips, timestamp-authority-fips, dataplaneapi-fips, art, prometheus-operator, harbor-fips, undock,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: terraform, k9s-fips, argo-workflows-fips, flux-source-controller, drone, prometheus-operator, harbor-fips, gitlab-kas, knative-kafka-broker, kubernetes, osv-scanner, seaweedfs-rocksdb-fips, flux, knative-kafka-broker-fips, gitlab-rails-ce, frankenphp-8.5, prometheus,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: terraform, k9s-fips, splunk-otel-collector, argo-workflows-fips, flux-source-controller, ollama-fips, nuclei, drone, crossplane-provider-azure-servicelinker, atlantis-fips, prometheus-podman-exporter-fips, tflint, crossplane-provider-azure-servicefabric, go-discover,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: terraform, k9s-fips, argo-workflows-fips, flux-source-controller, drone, prometheus-operator, harbor-fips, gitlab-kas, knative-kafka-broker, kubernetes, osv-scanner, seaweedfs-rocksdb-fips, flux, knative-kafka-broker-fips, gitlab-rails-ce, frankenphp-8.5, prometheus,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-servicelinker, crossplane-provider-aws-ecr-fips, knative-kafka-broker, flux, datadog-agent-fips, atlantis, kueue-fips, gitlab-rails-ce, buildah, prometheus, helmfile, knative-serving, crossplane-provider-azure-policyinsights,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-servicelinker, crossplane-provider-aws-ecr-fips, knative-kafka-broker, flux, datadog-agent-fips, atlantis, kueue-fips, gitlab-rails-ce, buildah, prometheus, helmfile, knative-serving, crossplane-provider-azure-policyinsights,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: terraform, k9s-fips, splunk-otel-collector, argo-workflows-fips, flux-source-controller, nuclei, prometheus-podman-exporter-fips, prometheus-operator, harbor-fips, gitlab-kas, knative-kafka-broker, kubernetes, osv-scanner, flux, terragrunt-fips,...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: terraform, argo-workflows-fips, prometheus-operator, harbor-fips, gitlab-kas, knative-kafka-broker, kubernetes, flux, knative-kafka-broker-fips, gitlab-rails-ce, buildah, frankenphp-8.5, prometheus, knative-serving, loki, external-secrets-operator-fips, snyk-cli,...

SUSE CVE-2026-24895

FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP's CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index for finding .php on a lowercased copy of the request path but applies that byte index to the...

CVE-2026-45062

CVE-2026-45062 affects FrankenPHP (versions 1.11.2–1.12.2). The vulnerability arises in the CGI path splitting logic (splitPos in cgi.go), where fallback matching uses golang.org/x/text/search with ignore-case, and engages when the request path contains non-ASCII bytes. Two flaws enable an attack...

CVE-2026-45062 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...

EUVD-2026-36075

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...

CVE-2026-45062 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...

CVE-2026-45062 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...

FrankenPHP 输入验证错误漏洞

FrankenPHP is an open-source PHP application server developed by phpnet. In versions 1.11.2 to 1.2.3 of FrankenPHP, there was a vulnerability related to input validation errors. This vulnerability stemmed from the incorrect use of the splitPos function in cgi.go when the request path contained...