Product by PHP Group
Frankenphp
5 known vulnerabilities in Frankenphp (PHP Group), 0 of them actively exploited (CISA KEV).
Key figures
5
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2026-24895 | PHP Group Frankenphp: Incorrect Behavior Order: Validate Before Canonicalize | 9.8 | |
| High | CVE-2026-45062 | FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files | 8.1 | |
| High | CVE-2026-82416 | PHP Group Frankenphp: Exposure of Data Element to Wrong Session | 7.7 | |
| High | CVE-2026-24894 | FrankenPHP leaks session data between requests in worker mode | 7.5 | |
| Medium | CVE-2026-85733 | FrankenPHP: Docker images serve phpinfo() as the default index.php, leaking environment variables | 5.3 |