GO-2026-5444 vulnerabilities

Vulnerabilities for packages: frankenphp-8.5, frankenphp-8.4, frankenphp-8.3, frankenphp-8.2...

GO-2026-4775 vulnerabilities

Vulnerabilities for packages: step-ca-fips, step-issuer-fips, frankenphp-8.2, caddy-fips, frankenphp-8.3, frankenphp-8.5, frankenphp-8.4, caddy...

GO-2026-4923 vulnerabilities

Vulnerabilities for packages: beats-fips, containerd, rke2-runtime, k3s, frankenphp-8.3, loki, elastic-agent, commercial-grafana, consul, grafana-fips, beats, grafana, fuse-overlayfs-snapshotter, frankenphp-8.2, vault, kine, frankenphp-8.4, elastic-agent-fips, datadog-agent,...

SUSE CVE-2026-45062

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...

GHSA-R277-6W6Q-XMQW vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-directconnect, crossplane-provider-aws-devicefarm-fips, crossplane-provider-aws-ssoadmin-fips, crossplane-provider-aws-appstream, crossplane-provider-aws-kinesisanalyticsv2-fips, crossplane-provider-aws-backup-fips,...

GHSA-JPCW-4WR7-C3VQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-directconnect, crossplane-provider-aws-devicefarm-fips, crossplane-provider-aws-ssoadmin-fips, crossplane-provider-aws-appstream, crossplane-provider-aws-kinesisanalyticsv2-fips, crossplane-provider-aws-backup-fips,...

GHSA-XCGV-8MV7-V8C7 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter-plugins-kyverno, buildkite-agent-fips, cluster-api, grype-fips, vault-secrets-operator-fips, calico-fips, cerbos, gitlab-rails-ce, argo-workflows-fips, prometheus-operator, argo-cd-fips, helm, libnvidia-container, rke2-runtime, cluster-api-fip...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: calico-fips, gitlab-rails-ce, argo-workflows-fips, prometheus-operator, argo-cd-fips, helm, cilium, knative-serving, kyverno-fips, opentofu, gitlab-kas, cloudbeat-fips, loki, seaweedfs-rocksdb-fips, trivy, gitlab-workhorse-ce, kubescape, gitlab-rails-ce-fips,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: calico-fips, gitlab-rails-ce, argo-workflows-fips, prometheus-operator, argo-cd-fips, helm, cilium, knative-serving, kyverno-fips, opentofu, gitlab-kas, cloudbeat-fips, loki, seaweedfs-rocksdb-fips, trivy, gitlab-workhorse-ce, kubescape, gitlab-rails-ce-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter-plugins-kyverno, google-guest-agent-manager, crossplane-aws-provider-fips, crossplane-aws-provider, grype-fips, calico-fips, gitlab-rails-ce, argo-workflows-fips, witness, prometheus-operator, argo-cd-fips, helm, cilium, scorecard, terragrunt,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: google-guest-agent-manager, grype-fips, crossplane-provider-aws-directconnect, scorecard, cilium, knative-serving, kyverno-fips, gitlab-kas, crossplane-provider-aws-backup-fips, crossplane-provider-aws-elasticache, crossplane-provider-aws-secretsmanager-fips,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: google-guest-agent-manager, grype-fips, crossplane-provider-aws-directconnect, scorecard, cilium, knative-serving, kyverno-fips, gitlab-kas, crossplane-provider-aws-backup-fips, crossplane-provider-aws-elasticache, crossplane-provider-aws-secretsmanager-fips,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: grype-fips, calico-fips, gitlab-rails-ce, argo-workflows-fips, witness, prometheus-operator, argo-cd-fips, helm, cilium, scorecard, terragrunt, knative-serving, kyverno-fips, opentofu, gitlab-kas, cloudbeat-fips, loki, trivy, gitlab-workhorse-ce, nfpm, act, kubescape...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: calico-fips, gitlab-rails-ce, argo-workflows-fips, prometheus-operator, argo-cd-fips, helm, cilium, knative-serving, kyverno-fips, opentofu, gitlab-kas, loki, buildah-fips, gitlab-workhorse-ce, gitlab-rails-ce-fips, podman-fips, kubernetes-fips, gatekeeper-fips,...

GO-2026-5084 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files in github.com/dunglas/frankenphp

FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files in github.com/dunglas/frankenphp...

SUSE CVE-2026-24895

FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP's CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index for finding .php on a lowercased copy of the request path but applies that byte index to the...

CVE-2026-45062 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...

EUVD-2026-36075

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...

CVE-2026-45062

CVE-2026-45062 affects FrankenPHP (versions 1.11.2–1.12.2). The vulnerability arises in the CGI path splitting logic (splitPos in cgi.go), where fallback matching uses golang.org/x/text/search with ignore-case, and engages when the request path contains non-ASCII bytes. Two flaws enable an attack...

CVE-2026-45062 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...