CVE-2026-50288

CVE-2026-50288 affects @asymmetric-effort/specifyjs , a declarative TypeScript UI framework, prior to version 0.2.136 . The vulnerability resides in the assertSecureUrl function (core/src/shared/secure-fetch.ts:42-45). When new URL() throws a parse error, the catch block silently returned instead...

fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization

A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode Internationalized Domain Name - IDN hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when...

CVE-2026-75628

Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because sameoriginpath accepts a backslash or tab in the return parameter. oauth2login reads the return parameter from the initiation request, runs sameoriginpath over it, and stores the survivor in...

PT-2026-79057

WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response. make location absolute in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin strips leading C0 control characters and spaces. An attacker-controlled...

CVE-2026-16221

A flaw was found in fast-uri. This vulnerability arises because fast-uri does not correctly interpret backslash characters as authority delimiters in Uniform Resource Locators URLs, unlike Node.js's native WHATWG URL parser. This discrepancy can cause applications that use fast-uri for security...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

CVE-2026-49857

auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in assertSafeUrl src/security.ts to block requests to private and loopback addresses. However, the isPrivateV6 function fails to detect IPv4-mapped IPv6...

EUVD-2026-58054

auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in assertSafeUrl src/security.ts to block requests to private and loopback addresses. However, the isPrivateV6 function fails to detect IPv4-mapped IPv6...

CVE-2026-67201

A flaw was found in V, specifically within its net.urllib and net.http components. This vulnerability allows a remote attacker to bypass host-based allowlists by exploiting a difference in how URLs are parsed. By crafting a malicious URL with a backslash, an attacker can trick the system into...

fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency

A flaw was found in fast-uri. This vulnerability arises because fast-uri does not correctly interpret backslash characters as authority delimiters in Uniform Resource Locators URLs, unlike Node.js's native WHATWG URL parser. This discrepancy can cause applications that use fast-uri for security...

fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency

A flaw was found in fast-uri. This vulnerability arises because fast-uri does not correctly interpret backslash characters as authority delimiters in Uniform Resource Locators URLs, unlike Node.js's native WHATWG URL parser. This discrepancy can cause applications that use fast-uri for security...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

Important: Red Hat Security Advisory: osbuild-composer security update

An update for osbuild-composer is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...

CVE-2026-18353

A flaw was found in PIA. An unauthenticated attacker can exploit a Server-Side Request Forgery SSRF vulnerability by crafting a malicious OpenID Connect OIDC issuer URL. This bypasses an internal allowlist due to inconsistent URL parsing between Python's urlparse and the requests/urllib3 librarie...

golang: net/url: Memory exhaustion in query parameter parsing in net/url

A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...

fast-uri vulnerable to host confusion via backslash authority introducer

Impact fast-uri v4.1.1 and earlier require a literal // to recognize a URI authority, so a reference that uses \, /, or / as the authority introducer in place of //, after an optional scheme is parsed with no authority: the sequence and everything after it fold into the path. Node's native...

Improper Input Validation

free5GC is vulnerable to Improper Input Validation. The vulnerability is due to the AUSF failing to validate the supiOrSuci field in UE authentication requests before forwarding it in an unescaped URL path, which allows an unauthenticated attacker to send crafted input containing null bytes or...

Interpretation Conflict

Overview org.webjars.npm:fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Interpretation Conflict due to malformed authority introducer handling in parseWithStatus and resolve in index.js. An attacker can bypass host-based URL checks and steer...

Linux Distros Unpatched Vulnerability : CVE-2026-18446

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based...