CVE-2022-22978-demo

CVE-2022-22978-demo CVE-2022-22978 脆弱性のサンプルコード 利用条件 高危（High）に分類されているものの、利用条件はかなり厳しく、この脆弱性はあまり有用ではないと個人的に感じています。 1. まず、spring-security が脆弱性の影響範囲内にあること 2. 次に、spring-security の正規表現マッチャー regexMatchers または RegexRequestMatcher を直接使用し、かつパスに . を使ってマッチさせていること。例えば以下のような場合： regexMatcher"/api/." // /api...

shiro-cve-2020-17523

Apache Shiro 两种姿势绕过认证分析（CVE-2020-17523） 0x01 漏洞描述 Apache Shiro是一个强大且易用的Java安全框架，执行身份验证、授权、密码和会话管理。使用Shiro的易于理解的API，您可以快速、轻松地获得任何应用程序，从最小的移动应用程序到最大的网络和企业应用程序。 当它和 Spring 结合使用时，在一定权限匹配规则下，攻击者可通过构造特殊的 HTTP 请求包完成身份认证绕过。 影响范围：Apache Shiro 1.7.1 0x02 漏洞环境搭建 shiro 1.7.0...

CVE-2026-14978

A flaw was found in go-slug. A local attacker could bypass .terraformignore exclusions, leading to sensitive files being included in Terraform slug uploads. This is caused by improper handling of Unicode normalization during path matching. Mitigation Upgrade to go-slug 0.18.3 or later. Where an...

CVE-2024-38475

CVE-2024-38475 利用CVE-2024-38475（modrewrite漏洞与文件系统路径匹配） 此仓库包含一个用于测试Web服务器漏洞的Python脚本，专门针对Apache服务器。该脚本使用目录和文件的词表检查潜在问题（modrewrite漏洞与文件系统路径匹配），并通过各种载荷暴露源码。 使用方法： 使用以下命令运行脚本： root@kitploit: python3 script.py --webroots webroots.txt --url 127.0.0.1 --schema http --directorywordlist...

CVE-2026-49869

Kestra CVE-2026-49869 / CVE-2026-53576 スキャナー Kestraインスタンスをスキャンし、endsWith"/configs" による認証フィルターのバイパスをチェックします。Kestraの AuthenticationFilter.java は、正確なパス /api/v1/configs と比較する代わりに request.getPath.endsWith"/configs" でチェックを行うため、呼び出し側が選択可能なパスセグメント（名前空間、フローID）を介してアドレス指定されるリソースに対し、/configs...

GHSA-4MVJ-M6J5-PMF7 vulnerabilities

Vulnerabilities for packages: nemo, open-webui...

Astra Linux – Vulnerability in Apache2

Apache HTTP Server versions 2.4.39 to 2.4.46: unexpected matching behavior with "MergeSlashes OFF"...

EUVD-2026-63911

The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route, allowing an...

CVE-2026-14978

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...

CVE-2026-14978

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...

EUVD-2026-63099

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...

CVE-2026-14978

go-slug v0.4.0-v0.18.2 mishandles Unicode normalization during .terraformignore matching (CWE-176), allowing files differing only by normalization form to bypass exclusions and be uploaded to Terraform Cloud/Enterprise, exposing sensitive local files. Fixed in v0.18.3; no workaround provided. Exp...

PT-2026-78711

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching...

CVE-2026-49473

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

CVE-2026-49473 @cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

CVE-2026-15573

Keycloak has a vulnerability in its Authorization Services where the PathMatcher does not normalize URIs before policy comparison. The issue allows an authenticated user to bypass intended restrictions by adding characters such as a trailing slash or matrix parameters to a URL, causing the system...

CVE-2026-59223

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, WEBFETCHFILTERLIST matching compared configured host entries against URL strings and non-label-boundary suffixes, allowing path-based blocklist bypasses such as !internal.example.com in a URL pa...

GO-2026-5805 Apptainer has incorrect path matching for 'limit container paths' directive in github.com/apptainer/apptainer

Apptainer has incorrect path matching for 'limit container paths' directive in github.com/apptainer/apptainer...

PYSEC-2026-1383 Flask-CORS vulnerable to Improper Handling of Case Sensitivity

corydolphin/flask-cors version 5.0.1 contains a vulnerability where the request path matching is case-insensitive due to the use of the trymatch function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching...

PYSEC-2026-1384 Flask-CORS improper regex path matching vulnerability

corydolphin/flask-cors version 5.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex...