CVE-2026-118654

The Echo Go web framework (versions prior to 4.16.0 and 5.4.0 ) contains a vulnerability in its static file handlers . The root cause is an incomplete fix for CVE-2026-55677, where the framework normalizes dot segments after route matching. This allows an unauthenticated attacker to bypass route-...

EUVD-2026-112459

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve a file through a public static route even though the corresponding direct path is protected by route-level middleware. An unauthenticated attacker can read...

CVE-2026-118654 Echo static file middleware route protection bypass via encoded dot-dot traversal

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve a file through a public static route even though the corresponding direct path is protected by route-level middleware. An unauthenticated attacker can read...

CVE-2026-118654: Improper Limitation of a Pathname to a Restricted Directory

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve a file through a public static route even though the corresponding direct path is protected by route-level middleware. An unauthenticated attacker can read...

SUSE CVE-2026-115700

Interpretation Conflict vulnerability in hackneyurl in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D decoding to ::ffff:127.0.0.1 or 127.0.0.1. is not an IP...

CVE-2026-115700 SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney

Interpretation Conflict vulnerability in hackneyurl in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D decoding to ::ffff:127.0.0.1 or 127.0.0.1. is not an IP...

CVE-2026-115700

The benoitc hackney library (versions 4.0.1 to 4.8.x ) is vulnerable to Server-Side Request Forgery (SSRF) due to an Interpretation Conflict in hackney_url. Specifically, the hackney_url:normalize/2 function fails to block percent-encoded bracketed IPv6 literals (e.g., %5B%3A%3Affff%3A127%2E0%2E0...

CVE-2026-115700 SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney

Interpretation Conflict vulnerability in hackneyurl in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D decoding to ::ffff:127.0.0.1 or 127.0.0.1. is not an IP...

EEF-CVE-2026-115700 SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney

Summary Interpretation Conflict vulnerability in hackneyurl in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D decoding to ::ffff:127.0.0.1 or 127.0.0.1. is not ...

CVE-2026-116004

A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/src/app/craft/components/output-panel/PreviewTab.tsx. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed...

EUVD-2026-109330

A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/src/app/craft/components/output-panel/PreviewTab.tsx. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed...

CVE-2026-116004

A security vulnerability exists in onyx-dot-app Onyx up to version 5.0.0 . The flaw resides in an unknown function within the file web/src/app/craft/components/output-panel/PreviewTab.tsx. This vulnerability allows for Remote Cross-Site Scripting (XSS) . The exploit has been disclosed publicly an...

CVE-2026-116004 onyx-dot-app Onyx PreviewTab.tsx cross site scripting

A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/src/app/craft/components/output-panel/PreviewTab.tsx. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed...

CVE-2026-116004 onyx-dot-app Onyx PreviewTab.tsx cross site scripting

A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/src/app/craft/components/output-panel/PreviewTab.tsx. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed...

CVE-2026-116004 onyx-dot-app Onyx PreviewTab.tsx cross site scripting

A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/src/app/craft/components/output-panel/PreviewTab.tsx. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed...

Amazon Linux 2023 : mariadb118, mariadb118-backup, mariadb118-client-utils (ALAS2023-2026-3287)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3287 advisory. MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account...

PT-2026-122935

Name of the Vulnerable Software and Affected Versions onyx-dot-app Onyx versions prior to 5.0.1 Description A remote cross site scripting issue exists within an unknown function of the file web/src/app/craft/components/output-panel/PreviewTab.tsx. Cross site scripting is a technique where malicio...

Amazon Linux 2023 : mariadb1011, mariadb1011-backup, mariadb1011-client-utils (ALAS2023-2026-3289)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3289 advisory. MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account...

Important: mariadb114

Issue Overview: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the...

Important: mariadb123

Issue Overview: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the...