CVE-2026-16125 zevorn rt-claw http_request net.c claw_net_post server-side request forgery

A vulnerability was found in zevorn rt-claw up to 0.2.0. The affected element is the function clawnetget/clawnetpost of the file claw/services/tools/net.c of the component httprequest. The manipulation of the argument url results in server-side request forgery. The attack can be executed remotely...

EUVD-2026-45379

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string...

CVE-2026-16117 @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string...

CVE-2026-16117 @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string...

CVE-2026-16117 @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string...

CVE-2026-16117

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string...

CVE-2026-16158

CVE-2026-16158 affects @fastify/reply-from. The vulnerability stems from how the internal URL cache key is built by concatenating the destination and source paths without a delimiter in versions 8.3.1 up to (but not including) 12.6.4. This can cause key collisions where different upstreams resolv...

CVE-2026-16158

Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URL...

Malicious code in activemodel-url-validator (RubyGems)

--- Credit: OpenSSF source...

CVE-2026-44203

creationtimestamp| type| source ---|---|--- 2026-07-18 00:31:11+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3mquz72wk7c2s 2026-09-15 10:10:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvkf2nx7u22j...

CVE-2026-56741

creationtimestamp| type| source ---|---|--- 2026-07-18 00:19:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mquyl3hgcb2a 2026-07-18 05:00:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqvibaehij2c 2026-07-20 22:37:21+00:00| published-proof-of-concept|...

PT-2026-60992

A vulnerability was determined in zhayujie CowAgent up to 2.1.1. This affects the function WebFetch.execute of the file agent/tools/web fetch/web fetch.py. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit ha...

SUSE SLED15: libpython3_11-1_0 / python311 / python311-base / python311-curses / etc (SUSE-SU-2026:3104-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3104-1 advisory. This update for python311 fixes the following issues - CVE-2026-1502: CR/LF bytes not rejected by HTTP client...

CVE-2026-16158: Unintended Proxy or Intermediary

Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URL...

PT-2026-60961

Name of the Vulnerable Software and Affected Versions @fastify/http-proxy versions prior to 11.6.0 Description An improper input normalization issue exists where the software fails to rewrite the request prefix when the prefix segment is URL-encoded. While the router URL-decodes paths for route...

PT-2026-60960

Name of the Vulnerable Software and Affected Versions @fastify/http-proxy versions 9.4.0 through 11.5.0 Description WebSocket destination paths are not properly validated against the configured rewrite prefix. The WebSocketProxy.findUpstream function resolves destinations using the WHATWG URL...

CVE-2026-16117: Improper Input Validation

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string...

CVE-2026-54490

creationtimestamp| type| source ---|---|--- 2026-07-17 23:53:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqux4fm3a62g...

CVE-2026-54242

creationtimestamp| type| source ---|---|--- 2026-07-17 23:50:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mquwvuatdz2b...

CVE-2026-44739

creationtimestamp| type| source ---|---|--- 2026-07-17 22:16:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mquroboa4d2j 2026-07-18 17:01:08+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqwqjbv3ri2g 2026-07-18 23:04:11+00:00| seen|...