CVE-2026-128024

FrankenPHP before 1.13.0 Denial of Service via goArray Nil Type Assertion

FrankenPHP before 1.13.0 contains a denial of service vulnerability in goArray() that allows remote attackers to abort the server process via arrays with null integer-keyed elements. Attackers can send crafted JSON passed to frankenphp_log() or returned from worker callbacks, triggering an unrecovered cgo panic that terminates every vhost and in-flight request.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Php

Products

Frankenphp

CVE-2026-128025

FrankenPHP before 1.13.0 CGI Path-Split Boundary Bypass via splitPos

FrankenPHP before 1.13.0 contains a path-split interpretation conflict in splitPos in cgi.go that allows unauthenticated attackers to execute protected PHP scripts by embedding .php inside a filename component. Attackers can request paths like /uploads/a.php.txt/b.php to execute uploads/a.php despite route-level or WAF deny rules and forge PATH_INFO, SCRIPT_NAME, and PHP_SELF values.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Php

Products

Frankenphp

CVE-2026-128026

FrankenPHP 1.5.0 before 1.13.0 Cross-Request Environment Leakage via putenv

FrankenPHP from 1.5.0 before 1.13.0 contains an incomplete environment sandbox vulnerability in which putenv writes to the process-wide OS environment via os.Setenv, leaking values across concurrent requests. Attackers reaching a request path that spawns child processes with the default environment through proc_open or exec can read secrets such as database passwords set by other requests.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Php

Products

Frankenphp

CVE-2026-128027

FrankenPHP before 1.1.11 Delayed Propagation of Base Image Security Fixes

FrankenPHP Docker images before 1.1.11 were rebuilt only when new base image tags were created, so security fixes that Alpine, PHP, and Go applied under existing tags were not propagated. Remote attackers could exploit known flaws in the stale system libraries, such as CVE-2025-15467 in libcrypto3, to execute code.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Php

Products

Frankenphp

CVE-2026-128028

OpenMage magento-lts before 20.18.2 Stored XSS via Product Custom Option SVG Upload

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in Mage_Catalog_Model_Product_Option_Type_File, which accepts guest SVG, XHTML, or XML uploads through product File custom options with an empty allowed-extension list. Unauthenticated attackers can send the file URL under media/custom_options/ to victims, executing script in the store origin and exposing administrator sessions when the admin panel shares that origin.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128029

OpenMage magento-lts before 20.18.2 Stored XSS via Dataflow Import Row Errors

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in the Dataflow profile run page, which inserts catalog product import row errors into the page without escaping. Unauthenticated attackers can place markup in the store, type, or attribute_set columns of an import file to run script in the session of the administrator who imports it.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128030

OpenMage magento-lts before 20.18.2 Insufficient Session Expiration After API User Deactivation

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an insufficient session expiration vulnerability because Mage_Api_Model_Session::_renewBySessId() never checks api_user.is_active and REST OAuth authorization never checks whether the admin user is active. Attackers holding an existing SOAP/XML-RPC session or OAuth access token retain API access after deactivation or API key rotation, reading and modifying customer, order and catalog data.

CVSS 4.0 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128031

OpenMage magento-lts before 20.18.2 Incorrect Authorization in Admin Controllers ACL

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability because admin controllers' _isAllowed() checks fall back to, or only check, parent ACL resources instead of finer per-action permissions. Authenticated restricted administrators can mass cancel or hold orders, rewrite order shipping addresses, export customer report data, or create REST roles despite their role denying those permissions.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128032

OpenMage magento-lts before 20.18.2 Payment Bypass via Free Payment Method

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free (No Payment Information Required) payment method on orders with a non-zero total because the zero-total check runs only when payment data is imported. An API user with cart permissions can select free via cart_payment.method while the total is zero, raise it with cart_coupon.remove, and submit cart.order to place an unpaid full-price order.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128033

OpenMage magento-lts before 20.18.2 Information Disclosure via Order-Status RSS Feed

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an information disclosure vulnerability in Mage_Rss_Model_Resource_Order::getAllCommentCollection(), which omits the is_visible_on_front filter for invoice, shipment and credit-memo comments. Authenticated customers can open the /rss/order/status feed for their order to read internal staff comments, such as fraud-review and payment notes.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128040

OpenMage magento-lts before 20.18.2 Stored XSS via Admin Dataflow, Tax, OAuth, PayPal Fields

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because admin pages render Dataflow profile link variables, tax rate titles, OAuth consumer names, and PayPal certificate filenames without escaping. An administrator restricted to one affected area can store script that runs when another administrator, including a full administrator, opens the page, reading the form key and performing actions with that administrator's privileges.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128041

OpenMage magento-lts before 20.18.2 Stored XSS via RSS Review Feed

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 serves RSS feeds with a text/html content type and does not escape feed entry data, leading to stored cross-site scripting. An unauthenticated guest can submit a product review with script in the nickname, title or text that executes when an administrator opens the pending-reviews feed, enabling admin account takeover.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128042

OpenMage magento-lts before 20.19.0 Race Condition in Coupon Usage Limits

OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a race condition in shopping cart price rule usage limits, because Mage_SalesRule_Model_Validator checks coupon limits without locking and the usage counters are later incremented non-atomically. Unauthenticated attackers, including guest shoppers, can submit concurrent checkouts to redeem a limited coupon more times than its cap allows.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128043

OpenMage magento-lts before 20.19.0 CSRF via PayPal Cancel Return Handlers

OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in PayPal cancel and decline return handlers that trust only the checkout session without verifying the request came from PayPal. Attackers can lure a shopper into a cross-site GET to paypal/standard/cancel to cancel their recent uninvoiced order, void pending authorizations, and restore items to the cart.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128044

OpenMage magento-lts before 20.18.2 OAuth Callback URL Allowlist Bypass

OpenMage magento-lts before 20.18.2 and 21.x before 21.0.0-beta3 validates OAuth 1.0a oauth_callback URLs with a string-prefix check and falls back to accepting any well-formed URL. Attackers holding a leaked consumer key and secret can supply host-suffix, userinfo, or arbitrary callback URLs to capture an approving administrator's or customer's request token and verifier, then obtain an access token with the victim's API privileges.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128045

OpenMage Magento-LTS before 20.18.2 Authorization Bypass via Forgeable RSS Order Key

OpenMage Magento-LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an authorization bypass in the /rss/order/status feed because its URL key is unsigned Base64-encoded JSON of the order, increment, and customer ids. Unauthenticated attackers can forge keys from enumerated sequential ids to read other customers' names, items, prices, totals, and status comments when order-status RSS is enabled.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128046

OpenMage magento-lts 20.17.0 before 20.18.2 Unrestricted File Upload RCE via Custom Options

OpenMage magento-lts 20.17.0 before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an unrestricted file upload vulnerability because the general/file/protected_extensions blocklist omits phar, php8, and phps. Unauthenticated attackers can upload a .phar file through a product File custom option to a predictable media/custom_options path and request it directly to execute code on servers that map .phar to PHP and serve that directory.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128047

OpenMage magento-lts before 20.18.2 Account Takeover via Predictable Confirmation Key

OpenMage magento-lts before 20.18.2 and 21.0.0-beta pre-releases before 21.0.0-beta3 generate customer email-confirmation keys with md5(uniqid()) and customer and administrator password-reset tokens with the non-cryptographic uniqHash(). Unauthenticated attackers can brute-force the roughly 20-bit confirmation key via the unrate-limited confirmAction endpoint to log in as pending customers, or predict administrator reset tokens after recovering generator state.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128048

OpenMage magento-lts before 20.18.2 Information Disclosure via Email Template getConfig

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 lets restricted administrators read decrypted configuration secrets because the store.getConfig email template directive's encrypted-path check missed config.xml-declared paths, case variants of the getConfig method name, and parent paths. Administrators with Transactional Emails access can preview a crafted template to expose PayPal, payment gateway, and carrier credentials.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128049

OpenMage Magento LTS before 20.18.2 CSRF via OAuth Authorization Confirm

OpenMage Magento LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in the admin and storefront OAuth confirm and confirmSimple actions, which accept GET requests without form-key validation. Attackers holding OAuth consumer credentials can lure a logged-in administrator or customer to a crafted confirm URL that authorizes the attacker's request token, then exchange it at /oauth/token for a persistent REST API access token bound to the victim.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—