{"items":[{"id":"CVE-2026-122233","published":"2026-11-04T21:06:41.065Z","updated":"2026-11-04T21:06:41.065Z","title":"FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Mode","severity":"MEDIUM","score":6.3,"vendor":"php","product":"frankenphp","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2026-85733","published":"2026-10-13T16:23:07.177Z","updated":"2026-10-13T17:15:18.579Z","title":"FrankenPHP: Docker images serve phpinfo() as the default index.php, leaking environment variables","severity":"MEDIUM","score":5.3,"vendor":"php","product":"frankenphp","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2026-82416","published":"2026-10-13T16:20:53.439Z","updated":"2026-10-13T20:22:02.706Z","title":"FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module","severity":"HIGH","score":7.7,"vendor":"php","product":"frankenphp","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2026-14355","published":"2026-07-03T20:57:31.958Z","updated":"2026-07-06T13:57:58.387Z","title":"ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD","severity":"MEDIUM","score":5.6,"vendor":"php","product":"php","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-45062","published":"2026-06-10T17:38:42.454Z","updated":"2026-06-11T14:00:50.845Z","title":"FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files","severity":"HIGH","score":8.1,"vendor":"php","product":"frankenphp","kev":false,"epss":0.00714,"kevAdded":null},{"id":"CVE-2026-24895","published":"2026-02-12T19:16:06.618Z","updated":"2026-02-12T20:04:07.435Z","title":"FrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary files","severity":"HIGH","score":8.9,"vendor":"php","product":"frankenphp","kev":false,"epss":0.0065,"kevAdded":null},{"id":"CVE-2026-24894","published":"2026-02-12T19:12:04.387Z","updated":"2026-02-12T20:04:57.869Z","title":"FrankenPHP leaks session data between requests in worker mode","severity":"HIGH","score":8.7,"vendor":"php","product":"frankenphp","kev":false,"epss":0.00497,"kevAdded":null},{"id":"CVE-2014-3622","published":"2020-02-19T12:46:23.000Z","updated":"2024-08-06T10:50:17.792Z","title":"Use-after-free vulnerability in the add_post_var function in the Posthandler component in PHP 5.6.x before 5.6.1 might allow remote attackers to execute…","severity":"CRITICAL","score":9.8,"vendor":"PHP","product":"PHP","kev":false,"epss":0.03121,"kevAdded":null},{"id":"CVE-2019-11043","published":"2019-10-28T14:19:04.252Z","updated":"2025-10-21T23:45:28.408Z","title":"Underflow in PHP-FPM can lead to RCE","severity":"HIGH","score":8.7,"vendor":"PHP","product":"PHP","kev":true,"epss":0.99783,"kevAdded":"2022-03-25"}]}