cve-2023-20198-poc-cisco

CVE-2023-20198-poc CVE-2023-20198 is a critical vulnerability in the Cisco IOS XE software Web UI feature that allows unauthenticated remote attackers to create accounts with privilege level 15 on affected systems, thereby gaining full control of the device. The vulnerability primarily stems from...

CVE-2022-22978

CVE-2022-22978 Spring Security Pass Spring Security 成功 http://localhost:9090/login%0a Pass Spring Security with SayMyName 失敗 http://localhost:9090/name%0d Bypass Spring Security with Custom RBAC 失敗 http://localhost:9090/admin/admin%0d Bypass Spring Security with Annotation RBAC 失敗...

Alternate Path Bypass

Apache Tika is vulnerable to an alternate path bypass. The vulnerability is due to improper protection of an alternate path, where the library does not properly validate alternate file paths and attackers can supply crafted paths to access unauthorized resources...

PT-2026-102721

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving...

CVE-2026-100692

Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ or a vendored module could contain a symlink at a mount root for example themes/mytheme/assets -...

CVE-2026-95811

Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it. The handler matches each vhost's locationRules regular expressions against REQUESTURI, the...

CVE-2026-95811

Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it. The handler matches each vhost's locationRules regular expressions against REQUESTURI, the...

CVE-2026-93709

Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot...

CVE-2026-93709

Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot...

PT-2026-96323

Name of the Vulnerable Software and Affected Versions Dancer2 versions prior to 2.2.0 Description The AutoPage handler serves a layout as a page when an equivalent spelling of its path bypasses the guard. This occurs because the handler compares the request path against the layout directory name ...

CVE-2026-90982

A flaw was found in @fastify/static, a Fastify plugin for serving static files. On case-insensitive filesystems, such as Windows or default macOS volumes, a route guard or allowedPath restriction can be bypassed. This occurs because the route matcher is case-sensitive while the filesystem is not,...

The vulnerability of the R7WebsSecurityHandler() function in the Tenda i6 Wi-Fi router software allows a hacker to bypass the catalog.

The vulnerability of function R7WebsSecurityHandler in the Tenda i6 Wi-Fi router software is related to an incorrect restriction on the path name to the directory. Exploiting this vulnerability could allow a remote attacker to bypass the directory structure...

CVE-2026-85124

A flaw was found in @fastify/http-proxy. This component, designed to proxy HTTP requests, does not correctly validate incoming request paths, specifically failing to account for backslash-based dot-segments. An unauthenticated network attacker can exploit this vulnerability to bypass the proxy's...

CVE-2026-59944

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because Composer validates literal parent-directory segments only during dependency resolutio...

CVE-2026-59944

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because Composer validates literal parent-directory segments only during dependency resolutio...

CVE-2026-57442 MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested

MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.5, PathFilter in src/pathfilter.ts uses root-anchored deny-list patterns, so nested .git, .obsidian, and nodemodules path segments do not match the restriction and pass both...

CVE-2026-48785 Apptainer: Incorrect path matching for 'limit container paths' directive

Apptainer is an open source container platform. Prior to version 1.5.1, Image.AuthorizedPath applies plain string-prefix matching to the limit container paths directive in apptainer.conf, so an allowed path such as /data/safe also authorizes a sibling path such as /data/safe-but-unsafe. A local...

EUVD-2026-78889

Apptainer is an open source container platform. Prior to version 1.5.1, Image.AuthorizedPath applies plain string-prefix matching to the limit container paths directive in apptainer.conf, so an allowed path such as /data/safe also authorizes a sibling path such as /data/safe-but-unsafe. A local...

CVE-2026-47215

SingularityCE and SingularityPRO are open-source container platforms affected by an incorrect path-string matching flaw in the limit container paths directive of singularity.conf. Under setuid mode , a container in a sibling directory (e.g., /data/safe-but-unsafe) can be executed when only /data/...

CVE-2023-29377

An issue was discovered in Softing OPC UA C++ SDK through 6.20 and Softing Secure Integration Server through 1.22. By using FileType renames, it is possible to bypass limitations on assignment of a directory path to FileDirectory OPC UA objects and a file path to File OPC UA objects...