CVE-2026-22256 Salvo is vulnerable to reflected XSS in the list_html function

Salvo is a Rust web backend framework. Prior to version 0.88.1, the function listhtml generate an file view of a folder which include a render of the current path, in which its inserted in the HTML without proper sanitation, this leads to reflected XSS using the fact that request path is decoded...

SlimServe HTTPd ver. 1.1a Directory Traversal

it is possible to view dir. and download files outside of the wwwroot directory. Exploit: http://127.0.0.1/.../ http://127.0.0.1/.../.../directory/file.xxx Solution: disable folder listings it is enabled by default, which will secure you from viewing dir. outside of the wwwroot dir.But it is stil...