CVE-2026-118650

The Echo Go web framework is vulnerable to a path bypass issue in versions prior to 4.16.0 and 5.4.0 . A globally mounted middleware.Static instance may interpret an encoded request path differently than the framework's router; specifically, the router matches the encoded path while the static ha...

CVE-2026-115923

Backstage is an open framework for building developer portals. Prior to 3.9.2 and from 4.0.0 until 4.0.2, DefaultCatalogRulesEnforcer in @backstage/plugin-catalog-backend compares the raw location.target URL against catalog.rules, while URL readers canonicalize the same URL before fetching it. An...

CVE-2026-111757 Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes...

PT-2026-117539

Name of the Vulnerable Software and Affected Versions Hono versions 4.12.4 through 4.13.10 Description The serveStatic component in the Hono web application framework incorrectly decodes a routed request path a second time before performing a filesystem lookup. This behavior allows a malformed...

CVE-2026-111757: Double Decoding of the Same Data

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes...

kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion

Summary openapi3filter.ValidationHandler.Middleware validates requests with kin-openapi's legacy router, which selects an OpenAPI operation from the decoded URL.Path. The method is documented as implementing gorilla/mux.MiddlewareFunc, but a downstream gorilla/mux router configured with...

GHSA-23VG-4CJM-66Q5 kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion

Summary openapi3filter.ValidationHandler.Middleware validates requests with kin-openapi's legacy router, which selects an OpenAPI operation from the decoded URL.Path. The method is documented as implementing gorilla/mux.MiddlewareFunc, but a downstream gorilla/mux router configured with...

CVE-2026-100351

kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from...

CVE-2026-100351

The kin-openapi Go project (versions 0.144.0 through 0.147.0 ) contains a security requirement bypass in the openapi3filter.ValidationHandler . The vulnerability stems from an interpretation conflict: the handler validates operations based on the decoded URL.Path , while a downstream gorilla/mux ...

CVE-2026-100351 kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion

kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from...

CVE-2026-100351 kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion

kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from...

CVE-2026-100351 kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion

kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from...

PT-2026-114982

Name of the Vulnerable Software and Affected Versions kin-openapi versions 0.144.0 through 0.146.0 Description An issue exists in the openapi3filter.ValidationHandler.Middleware where the security validation layer and the downstream request dispatcher may select different OpenAPI operations. The...

PT-2026-105109

kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded...

CVE-2026-78214

An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming request path against protected Actuator paths. By sending a specially crafted request containing a percent-encoded path, a...

EUVD-2026-88815

An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming request path against protected Actuator paths. By sending a specially crafted request containing a percent-encoded path, a...

CVE-2026-78214

An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming request path against protected Actuator paths. By sending a specially crafted request containing a percent-encoded path, a...

CVE-2026-78214: Incorrect Authorization

An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming request path against protected Actuator paths. By sending a specially crafted request containing a percent-encoded path, a...

PT-2026-102615

An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming request path against protected Actuator paths. By sending a specially crafted request containing a percent-encoded path, a...

CVE-2026-100706

kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded...