GO-2026-5444 vulnerabilities

Vulnerabilities for packages: frankenphp-8.2, frankenphp-8.5, frankenphp-8.3, frankenphp-8.4...

GO-2026-4775 vulnerabilities

Vulnerabilities for packages: step-ca-fips, frankenphp-8.4, frankenphp-8.5, caddy, caddy-fips, frankenphp-8.2, step-issuer-fips, frankenphp-8.3...

GO-2026-4923 vulnerabilities

Vulnerabilities for packages: containerd, beats-fips, commercial-expanso-edge, zot, elastic-agent, loki, consul, frankenphp-8.4, frankenphp-8.5, frankenphp-8.2, frankenphp-8.3, datadog-agent-fips, grafana-fips, grafana, k3s, rke2-runtime, commercial-grafana, elastic-agent-fips, mattermost, kine,...

GHSA-JPCW-4WR7-C3VQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53, crossplane-provider-family-aws, crossplane-provider-aws-backup, crossplane-provider-aws-appmesh, crossplane-provider-aws-dataexchange, crossplane-provider-aws-transfer, crossplane-provider-azure-securityinsights,...

GHSA-R277-6W6Q-XMQW vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53, crossplane-provider-family-aws, crossplane-provider-aws-backup, crossplane-provider-aws-appmesh, crossplane-provider-aws-dataexchange, crossplane-provider-aws-transfer, crossplane-provider-azure-securityinsights,...

GHSA-XCGV-8MV7-V8C7 vulnerabilities

Vulnerabilities for packages: snyk-cli, rekor-fips, beats-fips, commercial-expanso-edge, cilium-envoy-fips, kube-arangodb-fips, etcd-fips, kubernetes-csi-node-driver-registrar, knative-eventing-fips, fleet-server-fips, rclone-fips, cloud-provider-aws-fips, cilium-fips, melange, virt-operator, apk...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: snyk-cli, cloudbeat, commercial-expanso-edge, kube-arangodb-fips, etcd-fips, knative-eventing-fips, omnictl-multiarch, minio-fips, tigera-operator, istio, rancher, kuma, flux-image-automation-controller-fips, helm, seaweedfs-rocksdb, skaffold-fips, chisel,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: snyk-cli, chainctl, cloudbeat, syft-fips, commercial-expanso-edge, crossplane-provider-azure-security, kube-arangodb-fips, neuvector-sigstore-interface, etcd-fips, terragrunt-fips, crossplane-provider-azure-web, hcloud, crossplane-provider-azure-securityinsights,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: snyk-cli, cloudbeat, commercial-expanso-edge, kube-arangodb-fips, etcd-fips, knative-eventing-fips, omnictl-multiarch, minio-fips, tigera-operator, istio, rancher, kuma, flux-image-automation-controller-fips, helm, seaweedfs-rocksdb, skaffold-fips, chisel,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53, crossplane-provider-family-aws, chainctl, longhorn-cli-fips, crossplane-provider-aws-backup, snyk-cli, commercial-expanso-edge, docker-compose, terragrunt-fips, hcloud, crossplane-provider-azure-securityinsights,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53, crossplane-provider-family-aws, chainctl, longhorn-cli-fips, crossplane-provider-aws-backup, snyk-cli, commercial-expanso-edge, docker-compose, terragrunt-fips, hcloud, crossplane-provider-azure-securityinsights,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: snyk-cli, chainctl, cloudbeat, syft-fips, commercial-expanso-edge, kube-arangodb-fips, etcd-fips, terragrunt-fips, knative-eventing-fips, pulumi-kubernetes-operator, omnictl-multiarch, apply-cve-bump, minio-fips, melange, tigera-operator, trufflehog-fips, apko, istio...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: snyk-cli, commercial-expanso-edge, kube-arangodb-fips, etcd-fips, knative-eventing-fips, omnictl-multiarch, tigera-operator, istio, rancher, kuma, buildah-fips, helm, teleport-operator-fips, docker-cli-buildx-fips, knative-serving, harbor, buildah,...

SUSE CVE-2026-24895

FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP's CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index for finding .php on a lowercased copy of the request path but applies that byte index to the...

CVE-2026-45062

CVE-2026-45062 affects FrankenPHP (versions 1.11.2–1.12.2). The vulnerability arises in the CGI path splitting logic (splitPos in cgi.go), where fallback matching uses golang.org/x/text/search with ignore-case, and engages when the request path contains non-ASCII bytes. Two flaws enable an attack...

CVE-2026-45062 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...

EUVD-2026-36075

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...

CVE-2026-45062 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...

CVE-2026-45062 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...

FrankenPHP 输入验证错误漏洞

FrankenPHP is an open-source PHP application server developed by phpnet. In versions 1.11.2 to 1.2.3 of FrankenPHP, there was a vulnerability related to input validation errors. This vulnerability stemmed from the incorrect use of the splitPos function in cgi.go when the request path contained...