CVE-2026-18661

In Eclipse Jetty , specifically within the jetty-annotations and jetty-eeN-annotations components, a vulnerability exists where Jakarta Spec authoritative url-pattern rules are not correctly applied. This occurs when there is a mix of @ServletSecurity annotations and web.xml defined security-cons...

CVE-2026-18661

In Eclipse Jetty, across various versions of jetty-annotations, and jetty-eeN-annotations, the Jakarta Spec authoritative url-pattern rules for mixed @ServletSecurity annotation, and web.xml defined security-constraint on the same url-pattern were not being applied if the web.xml had more than 1...

CVE-2026-18661

In Eclipse Jetty, across various versions of jetty-annotations, and jetty-eeN-annotations, the Jakarta Spec authoritative url-pattern rules for mixed @ServletSecurity annotation, and web.xml defined security-constraint on the same url-pattern were not being applied if the web.xml had more than 1...

EUVD-2026-101935

"ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able to cause the application's in-app browser to access an arbitrary website, potentially leading to phishing attacks or disclosure of a service's session ID...

CVE-2026-96614

"ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able to cause the application's in-app browser to access an arbitrary website, potentially leading to phishing attacks or disclosure of a service's session ID...

CVE-2026-96614

The "ゲオアプリ" application, provided by GEO CORPORATION , is vulnerable to improper authorization within its handler for a custom URL scheme . This flaw allows an attacker to force the application's in-app browser to navigate to an arbitrary website. Such actions could potentially lead to phishing a...

CVE-2026-96614

"ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able to cause the application's in-app browser to access an arbitrary website, potentially leading to phishing attacks or disclosure of a service's session ID...

EUVD-2026-101850

The Easy HTTPS Redirection SSL WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private and draft posts and from site options, and to trigger a...

CVE-2026-104643 Easy HTTPS Redirection (SSL) < 2.0.2 - Subscriber+ Scan Result Disclosure and Site-Wide URL Rewrite

The Easy HTTPS Redirection SSL WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private and draft posts and from site options, and to trigger a...

WordPress Easy HTTPS Redirection (SSL) plugin < 2.0.2 - Subscriber+ Scan Result Disclosure and Site-Wide URL Rewrite vulnerability

Subscriber+ Scan Result Disclosure and Site-Wide URL Rewrite vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Easy HTTPS Redirection SSL versions 2.0.2...

CVE-2026-104643 Easy HTTPS Redirection (SSL) < 2.0.2 - Subscriber+ Scan Result Disclosure and Site-Wide URL Rewrite

The Easy HTTPS Redirection SSL WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private and draft posts and from site options, and to trigger a...

CVE-2026-104643

The Easy HTTPS Redirection (SSL) WordPress plugin, in versions before 2.0.2 , contains a vulnerability where it fails to perform capability checks on certain AJAX actions . This flaw allows any authenticated user , such as a Subscriber, to access URLs collected by the plugin's content scanner fro...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CLEANSTART-2026-WM37561 Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL

Security vulnerability affects the nfs-subdir-external-provisioner package. The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL...

CLEANSTART-2026-TK74807 net/url package does not set a limit on the number of query parameters in a query

Security vulnerability affects the nfs-subdir-external-provisioner package. The net/url package does not set a limit on the number of query parameters in a query...

CLEANSTART-2026-VD32941 url

CVE-2026-25679 affects multiple packages. url. See references for individual vulnerability details...

EUVD-2026-101740

GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.lsremote forwards URLs without checkunsafeprotocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while...

EUVD-2026-101732

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the...

CVE-2026-96614: Improper Authorization in Handler for Custom URL Scheme

"ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able to cause the application's in-app browser to access an arbitrary website, potentially leading to phishing attacks or disclosure of a service's session ID...

CVE-2026-100409: Improper Handling of URL Encoding (Hex Encoding)

OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cach...