CVE-2026-6636 p2r3 convert API buildCache.js Bun.serve path traversal

A vulnerability was detected in p2r3 convert up to 6998584ace3e11db66dff0b423612a5cf91de75b. Affected is the function Bun.serve of the file buildCache.js of the component API. Performing a manipulation of the argument pathname results in path traversal. It is possible to initiate the attack...

CVE-2026-6636 p2r3 convert API buildCache.js Bun.serve path traversal

A vulnerability was detected in p2r3 convert up to 6998584ace3e11db66dff0b423612a5cf91de75b. Affected is the function Bun.serve of the file buildCache.js of the component API. Performing a manipulation of the argument pathname results in path traversal. It is possible to initiate the attack...

dbgate (>=3.9.6 <=4.7.4-alpha.12), dbgate-serve (>=4.1.1 <=7.1.13) +1 more potentially affected by CVE-2026-6216 via dbgate-web (>=3.9.6 <=7.1.4)

dbgate-web NPM version =3.9.6, =3.9.6, =4.1.1, =5.2.2, =7.1.13 Source cves: CVE-2026-6216 Source advisory: OSV:GHSA-J8J5-7R4H-VJ2G...

dbgate-serve (>=7.1.3-alpha.3 <=7.1.13), dbmodel (>=7.1.3-alpha.3 <=7.1.13) potentially affected by CVE-2026-6216 via dbgate-web (>=7.1.10 <=7.1.4)

dbgate-web NPM version =7.1.10, =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.13 Source cves: CVE-2026-6216 Source advisory: SNYK:JS-DBGATEWEB-16083995...

CVE-2026-39407

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes // in the request path. When route-based middleware e.g., /admin/ is used for...

CVE-2026-39406

@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes // in the request path. When route-based middleware e.g., /admin/ is used for authorization, the...

Directory Traversal

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Directory Traversal via the serveStatic function. An attacker can access sensitive static files intended to be protected by route-based middleware by crafting request paths with repeated...

EUVD-2026-20493

Hono: Middleware bypass via repeated slashes in serveStatic...

Hono: Middleware bypass via repeated slashes in serveStatic

Summary A path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes // in the request path. When route-based middleware e.g., /admin/ is used for authorization, the router may not match paths containing repeated slashes, while serveStatic...

Directory Traversal

Overview @hono/node-server is a Node.js Adapter for Hono Affected versions of this package are vulnerable to Directory Traversal due to inconsistent handling of repeated slashes in the serveStatic process. An attacker can access sensitive static files that are intended to be protected by bypassin...

EUVD-2026-20491

@hono/node-server: Middleware bypass via repeated slashes in serveStatic...

@hono/node-server: Middleware bypass via repeated slashes in serveStatic

Summary A path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes // in the request path. When route-based middleware e.g., /admin/ is used for authorization, the router may not match paths containing repeated slashes, while serveStatic...

PT-2026-31281

Summary A path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes // in the request path. When route-based middleware e.g., /admin/ is used for authorization, the router may not match paths containing repeated slashes, while serveStatic...

org.webjars.npm:listhen (=1.0.1), org.webjars.npm:radix-vue (=1.9.17) +5 more potentially affected by CVE-2026-35209 via org.webjars.npm:defu (=6.1.4)

org.webjars.npm:defu MAVEN version =6.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:defu and may be impacted: - org.webjars.npm:listhen =1.0.1 - org.webjars.npm:radix-vue =1.9.17 - org.webjars.npm:rc9 =2.0.0, =0.52.1, =0.52.3 Sour...

dbgate-serve (>=7.1.3-alpha.3 <=7.1.13), dbmodel (>=7.1.3-alpha.3 <=7.1.13) potentially affected by CVE-2026-34725 via dbgate-web (>=7.1.10 <=7.1.4)

dbgate-web NPM version =7.1.10, =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.13 Source cves: CVE-2026-34725 Source advisory: SNYK:JS-DBGATEWEB-15915631...

dbgate-serve (>=7.1.3-alpha.3 <=7.1.13), dbmodel (>=7.1.3-alpha.3 <=7.1.13) potentially affected by CVE-2026-34725 via dbgate-web (>=7.1.10 <=7.1.4)

dbgate-web NPM version =7.1.10, =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.13 Source cves: CVE-2026-34725 Source advisory: OSV:GHSA-35XM-QVJG-8M42...

CVE-2026-34376 PdfDing: Password-protected share bypass via direct serve endpoint

PdfDing is a selfhosted PDF manager, viewer and editor offering a seamless user experience on multiple devices. Prior to version 1.7.0, an access-control vulnerability allows unauthenticated users to retrieve password-protected shared PDFs by directly calling the file-serving endpoint without...

CVE-2026-34586

PdfDing (self-hosted PDF manager/editor) is affected by a vulnerability in which check_shared_access_allowed() only validates session existence and does not enforce SharedPdf.inactive (expiration/max views) or SharedPdf.deleted. The Serve and Download endpoints rely on this function, allowing pre...

CVE-2026-34586 PdfDing: Shared PDF Expiration, Max Views, and Deletion Bypass via Serve/Download Endpoints

PdfDing is a selfhosted PDF manager, viewer and editor offering a seamless user experience on multiple devices. Prior to version 1.7.1, checksharedaccessallowed validates only session existence — it does not check SharedPdf.inactive expiration / max views or SharedPdf.deleted. The Serve and...

CVE-2026-34586 PdfDing: Shared PDF Expiration, Max Views, and Deletion Bypass via Serve/Download Endpoints

PdfDing is a selfhosted PDF manager, viewer and editor offering a seamless user experience on multiple devices. Prior to version 1.7.1, checksharedaccessallowed validates only session existence — it does not check SharedPdf.inactive expiration / max views or SharedPdf.deleted. The Serve and...