CVE-2026-127093

Rustrak before 0.26.0 SSRF via Alert Integration Test routing_override.url

Rustrak before 0.26.0 contains a server-side request forgery vulnerability that allows users with integrations update permission to send requests to arbitrary destinations by supplying routing_override.url to POST /api/integrations/{id}/test. Attackers can target loopback, private-network and cloud metadata addresses with custom headers and redirects followed, reading non-2xx response bodies returned in the API response.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128014

FrankenPHP 1.8.0 before 1.13.2 Out-of-Bounds Write via Bundled Brotli Decoder

FrankenPHP standalone static binaries 1.8.0 before 1.13.2 bundle the PHP brotli extension statically linked with Brotli 1.2.0, whose decoder contains an out-of-bounds write (CVE-2026-111497). Unauthenticated remote attackers can send crafted data to applications that pass it to brotli_uncompress_add() to crash the entire FrankenPHP process, and possibly cause memory disclosure or code execution.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Php

Products

Frankenphp

CVE-2026-128015

FrankenPHP before 1.13.4 Use-After-Free via putenv() During Request Shutdown

FrankenPHP before 1.13.4 contains a use-after-free vulnerability that leaves a dangling pointer to a freed environment table when putenv() is called during request shutdown. Attackers triggering putenv() in shutdown functions, destructors, or session handlers can crash the process on the next getenv() call or leak previous request environment values.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Php

Products

Frankenphp

CVE-2026-128016

FrankenPHP before 1.13.4 Use-After-Free of SplTempFileObject Streams in Worker Mode

FrankenPHP before 1.13.4 contains a use-after-free vulnerability in worker mode that frees internal streams of SplTempFileObject or SplFileObject on php://temp instances surviving across requests. Remote clients can send requests reaching code that uses such persisted objects, causing reads of freed memory that leak garbage data or crash the process.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Php

Products

Frankenphp

CVE-2026-128017

FrankenPHP before 1.13.4 Double Free in Worker Mode via Non-Form POST

FrankenPHP before 1.13.4 contains a double free vulnerability in worker mode that frees SG(request_info).content_type_dup twice when a worker script ends its loop after a non-form POST request. Unauthenticated attackers can send repeated JSON POST requests until the worker loop ends, aborting the whole process when USE_ZEND_ALLOC=0 is set.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Php

Products

Frankenphp

CVE-2026-128018

FrankenPHP before 1.13.4 Pending Worker Request Denial of Service

FrankenPHP before 1.13.4 contains a denial of service vulnerability in worker mode where frankenphp_handle_request() returns false without finishing the dequeued request after a fatal error during request startup. Attackers who trigger startup fatal errors against worker scripts that keep calling frankenphp_handle_request() can leave client requests hanging indefinitely while the worker continues running.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Php

Products

Frankenphp

CVE-2026-128019

FrankenPHP before 1.13.4 Information Disclosure via Per-Request Environment Variable Leak

FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that leaks per-request environment variables into later requests on the same PHP thread. Attackers can read values set via env directives with request placeholders or WithRequestEnv() through getenv() or $_SERVER, causing applications to act on another user's routing, tenant, or authorization values.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Php

Products

Frankenphp

CVE-2026-128020

FrankenPHP before 1.13.2 Denial of Service via Cyclic Array Conversion

FrankenPHP before 1.13.2 contains an uncontrolled recursion vulnerability in its PHP-to-Go array converter that fails to detect circular references in PHP arrays. Passing a self-referential array to frankenphp_log() or returning one from a worker callback triggers a fatal Go stack overflow, terminating the entire server process.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Php

Products

Frankenphp

CVE-2026-128021

FrankenPHP before 1.13.2 Information Disclosure via libxml Error State in Worker Mode

FrankenPHP before 1.13.2 contains an information disclosure vulnerability that allows later clients to read earlier clients' libxml errors because worker mode never resets LIBXML(error_list) between requests. Attackers sending requests to the same worker thread can call libxml_get_errors() or libxml_get_last_error() to obtain other clients' parsed-document fragments and server filesystem paths.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Php

Products

Frankenphp

CVE-2026-128022

FrankenPHP before 1.13.2 Denial of Service via Queued Disconnected Requests

FrankenPHP before 1.13.2 contains a resource exhaustion vulnerability that allows unauthenticated clients to tie up PHP threads because queued requests are not cancelled when clients disconnect. Attackers can send many requests and close connections immediately, forcing handleRequestWithRegularPHPThreads and worker handlers to execute them and delay all clients sharing the thread pool.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Php

Products

Frankenphp

CVE-2026-128023

FrankenPHP before 1.13.0 Authentication Bypass via Dot-Form Header Name Aliasing

FrankenPHP before 1.13.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to spoof trusted headers by sending dot-form header names that PHP rewrites to underscores. Attackers can send headers like X.Authenticated.User or X.Forwarded.For that map to $_SERVER keys, spoofing user identity, client IP, or scheme.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Php

Products

Frankenphp

CVE-2026-128024

FrankenPHP before 1.13.0 Denial of Service via goArray Nil Type Assertion

FrankenPHP before 1.13.0 contains a denial of service vulnerability in goArray() that allows remote attackers to abort the server process via arrays with null integer-keyed elements. Attackers can send crafted JSON passed to frankenphp_log() or returned from worker callbacks, triggering an unrecovered cgo panic that terminates every vhost and in-flight request.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Php

Products

Frankenphp

CVE-2026-128025

FrankenPHP before 1.13.0 CGI Path-Split Boundary Bypass via splitPos

FrankenPHP before 1.13.0 contains a path-split interpretation conflict in splitPos in cgi.go that allows unauthenticated attackers to execute protected PHP scripts by embedding .php inside a filename component. Attackers can request paths like /uploads/a.php.txt/b.php to execute uploads/a.php despite route-level or WAF deny rules and forge PATH_INFO, SCRIPT_NAME, and PHP_SELF values.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Php

Products

Frankenphp

CVE-2026-128026

FrankenPHP 1.5.0 before 1.13.0 Cross-Request Environment Leakage via putenv

FrankenPHP from 1.5.0 before 1.13.0 contains an incomplete environment sandbox vulnerability in which putenv writes to the process-wide OS environment via os.Setenv, leaking values across concurrent requests. Attackers reaching a request path that spawns child processes with the default environment through proc_open or exec can read secrets such as database passwords set by other requests.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Php

Products

Frankenphp

CVE-2026-128027

FrankenPHP before 1.1.11 Delayed Propagation of Base Image Security Fixes

FrankenPHP Docker images before 1.1.11 were rebuilt only when new base image tags were created, so security fixes that Alpine, PHP, and Go applied under existing tags were not propagated. Remote attackers could exploit known flaws in the stale system libraries, such as CVE-2025-15467 in libcrypto3, to execute code.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Php

Products

Frankenphp

CVE-2026-128028

OpenMage magento-lts before 20.18.2 Stored XSS via Product Custom Option SVG Upload

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in Mage_Catalog_Model_Product_Option_Type_File, which accepts guest SVG, XHTML, or XML uploads through product File custom options with an empty allowed-extension list. Unauthenticated attackers can send the file URL under media/custom_options/ to victims, executing script in the store origin and exposing administrator sessions when the admin panel shares that origin.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128029

OpenMage magento-lts before 20.18.2 Stored XSS via Dataflow Import Row Errors

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in the Dataflow profile run page, which inserts catalog product import row errors into the page without escaping. Unauthenticated attackers can place markup in the store, type, or attribute_set columns of an import file to run script in the session of the administrator who imports it.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128030

OpenMage magento-lts before 20.18.2 Insufficient Session Expiration After API User Deactivation

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an insufficient session expiration vulnerability because Mage_Api_Model_Session::_renewBySessId() never checks api_user.is_active and REST OAuth authorization never checks whether the admin user is active. Attackers holding an existing SOAP/XML-RPC session or OAuth access token retain API access after deactivation or API key rotation, reading and modifying customer, order and catalog data.

CVSS 4.0 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128031

OpenMage magento-lts before 20.18.2 Incorrect Authorization in Admin Controllers ACL

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability because admin controllers' _isAllowed() checks fall back to, or only check, parent ACL resources instead of finer per-action permissions. Authenticated restricted administrators can mass cancel or hold orders, rewrite order shipping addresses, export customer report data, or create REST roles despite their role denying those permissions.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128032

OpenMage magento-lts before 20.18.2 Payment Bypass via Free Payment Method

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free (No Payment Information Required) payment method on orders with a non-zero total because the zero-total check runs only when payment data is imported. An API user with cart permissions can select free via cart_payment.method while the total is zero, raise it with cart_coupon.remove, and submit cart.order to place an unpaid full-price order.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—