EUVD-2026-44819

Anubis: Policy bypass via client controlled X-Original-URI header...

shiro-cve-2020-17523

Apache Shiro Two Postures Authentication Bypass Analysis CVE-2020-17523 0x01 Vulnerability Description Apache Shiro is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. With Shiro's easy-to-understand API, you can...

CVE-2026-49869

Kestra CVE-2026-49869 / CVE-2026-53576 Scanner Scans Kestra instances for the endsWith"/configs" authentication filter bypass. Kestra's AuthenticationFilter.java checks request.getPath.endsWith"/configs" instead of matching the exact path /api/v1/configs. Since Kestra addresses resources via...

BIT-ENVOY-2026-73553 Envoy: RBAC Authorization Bypass via Path Parameters

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignorepathparametersinpathmatching is enabled, Envoy's router strips the semicolon suffix before matching but the RBAC urlpath matcher evaluates the raw path. ...

BIT-ENVOY-2026-73511 Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving...

PT-2026-102721

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving...

CVE-2022-22978-demo

CVE-2022-22978-demo CVE-2022-22978 vulnerability demo code Exploitation Conditions Although rated as high severity, the exploitation conditions are quite stringent. Personally, I find this vulnerability rather underwhelming. 1. First, spring-security must be within the affected scope. 2. Second, ...

CVE-2024-38475

CVE-2024-38475 exploit CVE-2024-38475modrewrite weakness with filesystem path matching This repository contains a Python script for testing web server vulnerabilities, specifically targeting Apache servers. The script checks for potential issues modrewrite weakness with filesystem path matching t...

Incorrect Authorization

Overview github.com/hashicorp/vault/vault is a tool for securely accessing secrets. Affected versions of this package are vulnerable to Incorrect Authorization through the AllowOperation path-matching logic in vault/policy/acl.go. An attacker can perform an unauthorized LIST request on a more...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the AllowOperation path-matching logic in vault/policy/acl.go. An attacker can perform an unauthorized LIST request on a more specific trailing-wildcard path by sending a request that matches a broader...

EUVD-2026-84121

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving...

CVE-2026-73511 Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving...

CVE-2026-48785 Apptainer: Incorrect path matching for 'limit container paths' directive

Apptainer is an open source container platform. Prior to version 1.5.1, Image.AuthorizedPath applies plain string-prefix matching to the limit container paths directive in apptainer.conf, so an allowed path such as /data/safe also authorizes a sibling path such as /data/safe-but-unsafe. A local...

CVE-2026-47215

SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string matching in the singularity.conf limit container paths directive allows a container in a sibling directory such as /data/safe-but-unsafe to...

EUVD-2026-78779

SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string matching in the singularity.conf limit container paths directive allows a container in a sibling directory such as /data/safe-but-unsafe to...

CVE-2026-47215

SingularityCE and SingularityPRO are open-source container platforms affected by an incorrect path-string matching flaw in the limit container paths directive of singularity.conf. Under setuid mode , a container in a sibling directory (e.g., /data/safe-but-unsafe) can be executed when only /data/...

CVE-2026-47215 Singularity: Incorrect path matching for 'limit container paths' directive

SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string matching in the singularity.conf limit container paths directive allows a container in a sibling directory such as /data/safe-but-unsafe to...

CVE-2026-47215 Singularity: Incorrect path matching for 'limit container paths' directive

SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string matching in the singularity.conf limit container paths directive allows a container in a sibling directory such as /data/safe-but-unsafe to...

Astra Linux – Vulnerability in Apache2

Apache HTTP Server versions 2.4.39 to 2.4.46: unexpected matching behavior with "MergeSlashes OFF"...

Important: ecs-service-connect-agent

Issue Overview: An Envoy proxy handling HTTP/3 connections can dereference a null transport socket option during the selection of a connection pool. This null pointer dereference is a CWE-476 flaw that may cause the process to crash or terminate unexpectedly, leading to a denial of service for th...