frankenphp

Every one of the 20 is a mark on the map. Named now: 1 to 20, most at risk first.

1. FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP FilesCVE-2026-45062php · CVSS 8.1 · 0.7% likely

   CWE-176

2. FrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary filesCVE-2026-24895php · CVSS 8.9 · 0.6% likely

   CWE-180

3. FrankenPHP leaks session data between requests in worker modeCVE-2026-24894php · CVSS 8.7 · 0.5% likely

   CWE-269

4. FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared moduleCVE-2026-82416php · CVSS 7.7 · 0.3% likely

   CWE-362

5. FrankenPHP: Docker images serve phpinfo() as the default index.php, leaking environment variablesCVE-2026-85733php · CVSS 5.3 · 0.2% likely

   CWE-200

6. FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker ModeCVE-2026-122233php · CVSS 3.7 · 0.2% likely

   CWE-488

7. FrankenPHP before 1.1.11 Delayed Propagation of Base Image Security FixesCVE-2026-128027php · CVSS 9.8

   CWE-1395

8. FrankenPHP 1.5.0 before 1.13.0 Cross-Request Environment Leakage via putenvCVE-2026-128026php · CVSS 6.4

   CWE-488

9. FrankenPHP before 1.13.0 CGI Path-Split Boundary Bypass via splitPosCVE-2026-128025php · CVSS 6.5

   CWE-436

10. FrankenPHP before 1.13.0 Denial of Service via goArray Nil Type AssertionCVE-2026-128024php · CVSS 5.9

    CWE-248

11. FrankenPHP before 1.13.0 Authentication Bypass via Dot-Form Header Name AliasingCVE-2026-128023php · CVSS 7.4

    CWE-290

12. FrankenPHP before 1.13.2 Denial of Service via Queued Disconnected RequestsCVE-2026-128022php · CVSS 5.3

    CWE-400

13. FrankenPHP before 1.13.2 Information Disclosure via libxml Error State in Worker ModeCVE-2026-128021php · CVSS 3.7

    CWE-200

14. FrankenPHP before 1.13.2 Denial of Service via Cyclic Array ConversionCVE-2026-128020php · CVSS 5.9

    CWE-674

15. FrankenPHP before 1.13.4 Information Disclosure via Per-Request Environment Variable LeakCVE-2026-128019php · CVSS 4.8

    CWE-200

16. FrankenPHP before 1.13.4 Pending Worker Request Denial of ServiceCVE-2026-128018php · CVSS 3.7

    CWE-404

17. FrankenPHP before 1.13.4 Double Free in Worker Mode via Non-Form POSTCVE-2026-128017php · CVSS 3.7

    CWE-415

18. FrankenPHP before 1.13.4 Use-After-Free of SplTempFileObject Streams in Worker ModeCVE-2026-128016php · CVSS 6.5

    CWE-416

19. FrankenPHP before 1.13.4 Use-After-Free via putenv() During Request ShutdownCVE-2026-128015php · CVSS 6.5

    CWE-416

20. FrankenPHP 1.8.0 before 1.13.2 Out-of-Bounds Write via Bundled Brotli DecoderCVE-2026-128014php · CVSS 8.1

    CWE-787

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.