CVE-2025-71399 Better Auth before 1.4.5 Path Normalization Bypass via rou3

Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path, and ///path resolve to the same route. In Better Auth versions prior to 1.4.5 which bundles the fixed rou3, this can allow...

CVE-2025-71399 Better Auth before 1.4.5 Path Normalization Bypass via rou3

Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path, and ///path resolve to the same route. In Better Auth versions prior to 1.4.5 which bundles the fixed rou3, this can allow...

CVE-2025-71399

CVE-2025-71399 affects Better Auth prior to version 1.4.5, which ships a vulnerable rou3 router. In rou3, path normalization removes empty segments, causing /path, //path, and ///path to resolve to the same route. This enables an attacker to bypass disabledPaths configuration and path-based rate ...

CVE-2025-71399 Better Auth before 1.4.4 Path Normalization Bypass via rou3

Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path, and ///path resolve to the same route. In Better Auth versions prior to 1.4.5 which bundles the fixed rou3, this can allow...

EUVD-2025-210590

Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path, and ///path resolve to the same route. In Better Auth versions prior to 1.4.5 which bundles the fixed rou3, this can allow...

vCenter Server - Improper Access Control

Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed. id: CVE-2021-22017 info: name:...

NPM: Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS

NPM: Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS vulnerability discovered by ? in WordPress Npm jodit versions = 4.12.30...

Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS

Summary jodit's sanitizeHTMLElement neutralizes a javascript: href using a bare href.trim.indexOf'javascript' === 0 check. This omits the normalization jodit applies to every other URL attribute: isDangerousUrl strips control bytes with value.replace/\u0000-\u0020+/g, '' and lowercases the value...

CVE-2026-62324

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or...

CVE-2026-62324

Technical details about CVE-2026-62324 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-62324 Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or...

CVE-2026-62246

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization in GetDefaultDatastoreSchema and GetDefaultDatastoreUsername, allowing distinct...

CVE-2026-62246

Kamaji (Hosted Control Plane Manager for Kubernetes) before version 26.7.4-edge uses a lossy namespace/name normalization in GetDefaultDatastoreSchema() and GetDefaultDatastoreUsername() to derive a TenantControlPlane datastore schema, DB user, and etcd key prefix. This can cause namespace/name c...

CVE-2026-62246 Kamaji: TenantControlPlane namespace/name collision binds two tenants to the same SQL datastore schema + DB user, breaking per-tenant isolation

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization in GetDefaultDatastoreSchema and GetDefaultDatastoreUsername, allowing distinct...

EUVD-2026-51311

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization in GetDefaultDatastoreSchema and GetDefaultDatastoreUsername, allowing distinct...

SUSE CVE-2026-62685

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser builds new user scopes from usernames passed through cleanUsername when Signup=true and CreateUserDir=true, but the many-to-one...

CVE-2026-6540

Calico's Application Layer Policy disabled by default, which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes...

CVE-2026-6540 L7 policy bypass via unnormalized HTTP path matching

Calico's Application Layer Policy disabled by default, which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes...

EUVD-2026-51153

Calico's Application Layer Policy disabled by default, which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes...

CVE-2026-6540 L7 policy bypass via unnormalized HTTP path matching

Calico's Application Layer Policy disabled by default, which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes...