CVE-2025-55752

CVE-2025-55752: Apache Tomcat Path Traversal Vulnerability Docker-based reproduction environment for CVE-2025-55752, a path traversal vulnerability in Apache Tomcat 10.1.44. Overview CVE-2025-55752 is a path traversal vulnerability in Apache Tomcat's RewriteValve caused by incorrect processing...

CVE-2026-126354

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.2.5 until 2.9.1, Addressable::URI.normalizepath can resolve a path containing leading parent segments and later parent segments to a different path than an RFC 3986 resolver...

PT-2026-139442

The Modula plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'items' parameter in versions up to, and including, 3.0.17 This is due to insufficient input sanitization of the per-image 'link' field in the save merged items REST handler and ImagesAdapter::normalize item row,...

CLEANSTART-2026-CG38853 fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions

Security vulnerability affects the frappe-helpdesk package. fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize and equal functions...

CLEANSTART-2026-AF49593 fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions

Security vulnerability affects the argo-workflows package. fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize and equal functions...

CLEANSTART-2026-GO40948 fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization

Security vulnerability affects the argo-workflows package. fast-uri normalize decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization...

CLEANSTART-2026-TN34828 fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions

Security vulnerability affects the argo-workflows package. fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize and equal functions...

PT-2026-126333

Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalize compact form that allows unauthenticated attackers to cause quadratic CPU consumption. Attackers can submit long search terms with many distinct in:... or has:... expressions to...

Fast-uri Vulnerable To Improper Path Equivalence In Relative Reference Normalization

Impact "fast-uri"'s "normalize" and "serialize" apply RFC 3986 dot-segment removal "removedotsegments" to the path of a relative-path reference. RFC 3986 section 5.2.4 defines that algorithm only for the merged target path during resolution, not for the reference itself, so applied to the referen...

Fast-uri Vulnerable To Scheme Injection Via An Unescaped First-segment Colon In Suffix References

Impact "fast-uri"'s "serialize", "normalize", and "resolve", when called with the non-default option "reference: 'suffix'" on a reference that has no authority, emit a relative reference whose first path segment contains a bare colon without escaping it. RFC 3986 section 3.3 requires the first...

GHSA-W74X-V6F9-J3XG fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding

Impact fast-uri percent-decodes the scheme component with the legacy global unescape before validating it, so an input whose decoded scheme is a valid but dangerous token is emitted as a live scheme. RFC 3986 section 3.1 does not allow percent-encoding in a scheme, so no RFC or WHATWG parser trea...

fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding

Impact fast-uri percent-decodes the scheme component with the legacy global unescape before validating it, so an input whose decoded scheme is a valid but dangerous token is emitted as a live scheme. RFC 3986 section 3.1 does not allow percent-encoding in a scheme, so no RFC or WHATWG parser trea...

EUVD-2026-104812

fast-uri vulnerable to improper path equivalence in relative reference normalization...

fast-uri vulnerable to improper path equivalence in relative reference normalization

Impact fast-uri's normalize and serialize apply RFC 3986 dot-segment removal removedotsegments to the path of a relative-path reference. RFC 3986 section 5.2.4 defines that algorithm only for the merged target path during resolution, not for the reference itself, so applied to the reference it...

GHSA-333X-W4R6-6CRP fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references

Impact fast-uri's serialize, normalize, and resolve, when called with the non-default option reference: 'suffix' on a reference that has no authority, emit a relative reference whose first path segment contains a bare colon without escaping it. RFC 3986 section 3.3 requires the first segment of a...

fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references

Impact fast-uri's serialize, normalize, and resolve, when called with the non-default option reference: 'suffix' on a reference that has no authority, emit a relative reference whose first path segment contains a bare colon without escaping it. RFC 3986 section 3.3 requires the first segment of a...

CVE-2026-114114

Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte coloffset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with...

EUVD-2026-106917

Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte coloffset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with...

CVE-2026-114114

The Vyper smart contract programming language (versions 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1) is vulnerable to literal value substitution due to improper handling of Unicode encoding in vyper/ast/parse.py. The root cause is the mixing of character-based line offsets with P...

CVE-2026-114114 Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters

Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte coloffset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with...