Use of Non-Canonical URL Paths for Authorization Decisions

Overview Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions via the Static middleware in middleware/static.go. When Static is attached to a catch-all route alongside a guarded route, an attacker can request an in-root file using an encod...

Use of Non-Canonical URL Paths for Authorization Decisions

Overview github.com/labstack/echo/v4/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions via the Static middleware in middleware/static.go. When Static is attached to a catch-all route alongsid...

Use of Non-Canonical URL Paths for Authorization Decisions

Overview Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions via the Static middleware in middleware/static.go. When Static is attached to a catch-all route alongside a guarded route, an attacker can request an in-root file using an encod...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the CMSAuthenticatedDataParser process. An attacker can cause unauthorized attribute injection by crafting a message where the digestAlgorithm field is absent but authAttrs is present,...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the CMSAuthenticatedDataParser process. An attacker can cause unauthorized attribute injection by crafting a message where the digestAlgorithm field is absent but authAttrs is present,...

CVE-2026-71178

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization Decisions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-71178: Use of Non-Canonical URL Paths for Authorization Decisions

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization Decisions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

Use of Non-Canonical URL Paths for Authorization Decisions

Overview github.com/filebrowser/filebrowser/v2/http is a web file browser. Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions in the cleanUsername process. An attacker can gain unauthorized access to another user's files by registering a...

Use of Non-Canonical URL Paths for Authorization Decisions

Overview Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions in the cleanUsername process. An attacker can gain unauthorized access to another user's files by registering a username that normalizes to the same home directory as an existin...

Use of Non-Canonical URL Paths for Authorization Decisions

Overview Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions in the cleanUsername process. An attacker can gain unauthorized access to another user's files by registering a username that normalizes to the same home directory as an existin...

Use of Non-Canonical URL Paths for Authorization Decisions

Overview Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions in the cleanUsername process. An attacker can gain unauthorized access to another user's files by registering a username that normalizes to the same home directory as an existin...

Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway for Multiplatforms

Summary Multiple vulnerabilities have been found in CICS Transaction Gateway for Multiplatforms due to the use of Apache Tomcat Embed, Spring Web MVC, Spring Boot, Spring Core, Spring Context, Spring Beans and Logback Core. The Apache Tomcat Embed, Spring Web MVC, Spring Boot, Spring Core, Spring...

CVE-2026-55170 OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions

OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being used as the datastore and authorization decisions rely on case-sensitive user strings, the tuple, changelog, and authorizationmodel identifier columns can compare case-distinct values such as...

PT-2026-56259

Name of the Vulnerable Software and Affected Versions FastGPT versions 4.14.17 through 4.15.0-beta3 Description An authenticated tenant user can call the 'POST /api/core/dataset/collection/create/reTrainingCollection' endpoint to persist a datasetId value belonging to another tenant. This results...

Cedar-Expression Injection

com.cedarpolicy, cedar-java is vulnerable to Cedar-expression injection. The vulnerability is due to the toCedarExpr method failing to escape special characters in user-controlled input, which allows an attacker to inject arbitrary Cedar expressions and manipulate authorization decisions...

CVE-2026-41856 Spring GraphQL Annotation Detection Vulnerability

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored...

EUVD-2026-36214

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored...

cve-2026-41856 - HIGH - Spring GraphQL Annotation Detection Vulnerability

cve-2026-41856 - HIGH - Spring GraphQL Annotation Detection Vulnerability...

CVE-2026-4363

GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that under certain conditions could have allowed an authenticated user to gain unauthorized access to resources due to improper caching of authorization decisio...

CVE-2026-4363

CVE-2026-4363 affects GitLab EE: versions 18.1–before 18.8.7, 18.9–before 18.9.3, and 18.10–before 18.10.1 are impacted due to improper caching of authorization decisions. This could allow an authenticated user to gain unauthorized access to resources. GitLab has released patches; upgrading to 18...