Spring Framework - Path Traversal

Spring Framework MVC applications deployed as WAR or with embedded Servlet containers that do not reject suspicious URI sequences and serve static resources with Spring resource handling contain a path traversal vulnerability, letting attackers access unauthorized files, exploit requires...

WebMvc.fn/WebFlux.fn - Path Traversal

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application...

Plenti < v0.7.2 - OS Command Injection

Plenti, a static site generator, has an arbitrary file write vulnerability in versions prior to 0.7.2. The /postLocal endpoint is vulnerable to an arbitrary file write vulnerability when a plenti user serves their website. This issue may lead to Remote Code Execution. Version 0.7.2 fixes the...

aiohttp - Directory Traversal

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'followsymlinks' can be used to determine whether to follow symboli...

Labstack Echo 4.8.0 - Open Redirect

Labstack Echo 4.8.0 contains an open redirect vulnerability via the Static Handler component. An attacker can leverage this vulnerability to cause server-side request forgery, making it possible to obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2022-400...

N-able N-central <2026.3.1.14 - Pre-Authentication Remote Code Execution

N-able N-central versions before 2026.3.1.14 are vulnerable to pre-authentication remote code execution via static code injection CWE-96. An unauthenticated attacker with network access to the N-central management interface can execute arbitrary code on the server, potentially compromising every...

Yamcs <=5.11.12 - Arbitrary File Read

Yamcs through 5.11.12 serves static web resources through a handler that resolves the requested path against the configured web root without rejecting absolute paths. A request path that begins with a double slash is resolved as an absolute filesystem path, discarding the web root, and the handle...

Solara <1.35.1 - Local File Inclusion

A Local File Inclusion LFI vulnerability was identified in widgetti/solara, in version 1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. ...

Apache Unomi - Remote Code Execution

Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process, enabling attackers to execute arbitrary code. id: CVE-2020-11975 info: name: Apache Unomi -...

EUVD-2026-123050

Use of a per-part static key in the ASP Bootloader could allow an attacker to downgrade the Secure Encrypted Virtualization SEV firmware and exploit known vulnerabilities to decrypt memory potentially resulting in loss of confidentiality...

Microsoft Security Advisory CVE-2026-118748 - ASP.NET Core Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. Blazor static-SSR client validation retains attacker-controlled rendered field names in a...

GHSA-5H82-77P6-2WP3 Microsoft Security Advisory CVE-2026-118748 - ASP.NET Core Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. Blazor static-SSR client validation retains attacker-controlled rendered field names in a...

CVE-2026-0003

Multiple vulnerabilities are associated with CVE-2026-0003 , involving different products and root causes. In AMD Secure Encrypted Virtualization (SEV) firmware, the use of a per-part static key in the ASP Bootloader allows an attacker to downgrade the firmware and exploit known vulnerabilities t...

CVE-2026-82391

The Zephyr HTTP server contains an out-of-bounds write vulnerability in its HTTP/2 front-end when handling static-filesystem resources. The root cause is located in subsys/net/lib/http/http_server_http2.c, where the handle_http2_static_fs_resource() function incorrectly uses &client-&gt;data_len ...

EUVD-2026-122904

Arista C-260 and C-250 access points ship with fleet-wide static cryptographic keys used for firmware image verification and SSLP authentication. An attacker who is able to access these keys would be able to create modified firmware that will pass verification checks. This vulnerability is specif...

CVE-2026-102166

Arista C-260 and C-250 access points are vulnerable because they ship with fleet-wide static cryptographic keys . These keys are utilized for firmware image verification and SSLP authentication . If an attacker obtains these keys, they can create modified firmware that successfully passes verific...

Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch

Summary Rack::Static normalizes the request path with Utils.cleanpathinfo when deciding which file to serve, but matches headerrules against a path that is only URL-decoded. A request containing dot segments, raw or percent-encoded, is served the normalized target file while the header rules for...

EUVD-2026-120484

Rack: Rack::Static headerrules bypass via dot-segment normalization mismatch...

GHSA-WVG4-6P58-3GH3 Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch

Summary Rack::Static normalizes the request path with Utils.cleanpathinfo when deciding which file to serve, but matches headerrules against a path that is only URL-decoded. A request containing dot segments, raw or percent-encoded, is served the normalized target file while the header rules for...

Sighthound

Sighthound Tree-sitter based static vulnerability scanner with pattern matching and taint-flow analysis. What It Does Scans source code for security issues using AST-aware rules. Supports pattern mode and taint mode source to sink tracking. Handles multi-file projects and parallel execution...