EUVD-2026-42323

setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision NFC/NFD on macOS APFS/HFS+...

GHSA-H35F-9H28-MQ5C setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

Summary When building a source distribution python -m build --sdist / setup.py sdist, setuptools' FileList applies MANIFEST.in directives exclude, global-exclude, recursive-exclude, prune by matching a compiled glob against on-disk file names byte-for-byte, with no Unicode normalization. On...

setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

Summary When building a source distribution python -m build --sdist / setup.py sdist, setuptools' FileList applies MANIFEST.in directives exclude, global-exclude, recursive-exclude, prune by matching a compiled glob against on-disk file names byte-for-byte, with no Unicode normalization. On...

HPESBNW05083 rev.1 - Private 5G Core, Traefik StripPrefix Route-Level Auth Bypass via Path Normalization (CVE-2026-48020)

Potential Security Impact: Remote: Access Restriction Bypass, Authentication Bypass, Directory Traversal SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Aruba Networking Private 5G Core 1.26.1.1 and earlier CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | |...

EUVD-2026-44708

File Browser: Colliding username normalization gives two users the same home directory...

fast-uri: fast-uri: URI authority bypass due to improper delimiter handling

A flaw was found in fast-uri. A remote attacker could exploit this vulnerability by crafting a malicious Uniform Resource Identifier URI that contains percent-encoded authority delimiters. The fast-uri library incorrectly decodes these delimiters during normalization and then re-emits them as raw...

Important: python3.11

Issue Overview: When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters \r the resulting file could be injected with unexpected keys and values if the attacker controls the written value. CVE-2026-0864 When using the...

Important: python3.12

Issue Overview: When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters \r the resulting file could be injected with unexpected keys and values if the attacker controls the written value. CVE-2026-0864 When using the...

CVE-2026-16221: Interpretation Conflict

Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal backslash character U+005C as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the...

CVE-2026-16077

A vulnerability was found in AstrBotDevs AstrBot up to 4.25.5. Impacted is the function normalizerwpath of the file astrbot/core/tools/computertools/fs.py of the component Filesystem Computer-Use Tool. Performing a manipulation results in link following. The attack is only possible with local...

MGASA-2026-0257 Updated nodejs packages fix security vulnerabilities

lib,test: redact proxy credentials in tunnel errors. CVE-2026-48615 permission: handle process.chdir on writereport. CVE-2026-48617 tls: normalize hostname for server identity checks. CVE-2026-48618 http2: cap originSet size to prevent unbounded memory growth. CVE-2026-48619 tls: fix case-sensiti...

Updated nodejs packages fix security vulnerabilities

lib,test: redact proxy credentials in tunnel errors. CVE-2026-48615 permission: handle process.chdir on writereport. CVE-2026-48617 tls: normalize hostname for server identity checks. CVE-2026-48618 http2: cap originSet size to prevent unbounded memory growth. CVE-2026-48619 tls: fix case-sensiti...

Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure

Impact The toabsolutenormalizedpath function security.lua:28-43 does not collapse redundant path separators // → /. On Linux, //etc/passwd is equivalent to /etc/passwd POSIX path semantics, but iscriticalpath fails to match the double-slash variant because //etc/passwd does not start with /etc/...

Amazon Linux 2023 : python3.13, python3.13-devel, python3.13-freethreading (ALAS2023-2026-1910)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1910 advisory. tarfile.extractall with the 'data' or 'tar'filter could be bypassed by a crafted archive where a hardlinkreferences a symlink stored at a deeper name than the hardlink itself.The extraction...

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2026-1930)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1930 advisory. The tarfile module would still apply normalization of AREGTYPE \x00 blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPELONGNAME or GNUTYPELONGLINK. This could result ...

Use of Non-Canonical URL Paths for Authorization Decisions

Overview Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions in the cleanUsername process. An attacker can gain unauthorized access to another user's files by registering a username that normalizes to the same home directory as an existin...

CVE-2026-62685

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser builds new user scopes from usernames passed through cleanUsername when Signup=true and CreateUserDir=true, but the many-to-one...

CVE-2026-62685 File Browser: Colliding username normalization gives two users the same home directory

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser builds new user scopes from usernames passed through cleanUsername when Signup=true and CreateUserDir=true, but the many-to-one...

CVE-2026-62685 File Browser: Colliding username normalization gives two users the same home directory

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser builds new user scopes from usernames passed through cleanUsername when Signup=true and CreateUserDir=true, but the many-to-one...

CVE-2026-62685

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser builds new user scopes from usernames passed through cleanUsername when Signup=true and CreateUserDir=true, but the many-to-one...