TProxer

TProxer A Burp Suite extension made to automate the process of finding reverse proxy path based SSRF. How • Install • Todo • Join Discord How it works Attempts to gain access to internal APIs or files through a path based SSRF attack. For instance https://www.example.com/api/v1/users we try the...

@hono/node-server: Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy

Summary @hono/node-server passes the raw request-target to the WHATWG URL parser, which treats a backslash in the path as / and then resolves .. segments. A request for /admin\secret or /public..\admin/secret reaches the application as /admin/secret. A reverse proxy that follows RFC 3986 forwards...

GHSA-JPVV-R467-5P4W @hono/node-server: Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy

Summary @hono/node-server passes the raw request-target to the WHATWG URL parser, which treats a backslash in the path as / and then resolves .. segments. A request for /admin\secret or /public..\admin/secret reaches the application as /admin/secret. A reverse proxy that follows RFC 3986 forwards...

CVE-2026-126210

The @hono/node-server library (versions prior to 1.19.18 and 2.0.0 through 2.1.6 ) is vulnerable to a path traversal-style bypass. The server passes a raw request-target containing a backslash () to the WHATWG URL parser, which interprets the backslash as a path separator and resolves dot segment...

CVE-2026-126210 @hono/node-server: Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy

@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.18 and from 2.0.0 until 2.1.6, the server passes a raw request-target containing a backslash in its path to the WHATWG URL parser, which treats the backslash as a path separator and resolves dot segments. A reverse...

santa

Santa Santa is a binary and file access authorization system for macOS. It consists of a system extension that monitors for executions & file access, and makes decisions based on the contents of a local database, a GUI agent that notifies the user in case of a block decision, a background service...

CVE-2026-123806

python-tuf is a Python reference implementation of The Update Framework TUF. Prior to 7.0.0, DelegatedRole.istargetinpathpattern in tuf/api/payload.py uses fnmatch.fnmatch, which applies os.path.normcase before matching and makes delegation path authorization case-insensitive on Windows. When a T...

CVE-2026-123806

python-tuf is a Python reference implementation of The Update Framework TUF. Prior to 7.0.0, DelegatedRole.istargetinpathpattern in tuf/api/payload.py uses fnmatch.fnmatch, which applies os.path.normcase before matching and makes delegation path authorization case-insensitive on Windows. When a T...

CVE-2026-123806 python-tuf: Platform-dependent delegation path matching

python-tuf is a Python reference implementation of The Update Framework TUF. Prior to 7.0.0, DelegatedRole.istargetinpathpattern in tuf/api/payload.py uses fnmatch.fnmatch, which applies os.path.normcase before matching and makes delegation path authorization case-insensitive on Windows. When a T...

CVE-2026-123806 python-tuf: Platform-dependent delegation path matching

python-tuf is a Python reference implementation of The Update Framework TUF. Prior to 7.0.0, DelegatedRole.istargetinpathpattern in tuf/api/payload.py uses fnmatch.fnmatch, which applies os.path.normcase before matching and makes delegation path authorization case-insensitive on Windows. When a T...

CVE-2026-123806

The python-tuf library, a Python implementation of The Update Framework (TUF), contains a vulnerability in the ngclient implementation on Windows systems. The DelegatedRole._is_target_in_pathpattern function in tuf/api/_payload.py uses fnmatch.fnmatch, which applies os.path.normcase. Because Wind...

CVE-2026-123806: theupdateframework python-tuf: python-tuf is a Python reference implementation of The Update Framework (TUF)

python-tuf is a Python reference implementation of The Update Framework TUF. Prior to 7.0.0, DelegatedRole.istargetinpathpattern in tuf/api/payload.py uses fnmatch.fnmatch, which applies os.path.normcase before matching and makes delegation path authorization case-insensitive on Windows. When a T...

LINE Armeria authorization issue vulnerability

Versions of LINE Armeria prior to 1.43.0 contain an authorization issue vulnerability. This vulnerability stems from inconsistent path normalization, which may allow unauthenticated attackers to bypass path-based access controls and gain access to protected resources...

Linux Distros Unpatched Vulnerability : CVE-2026-118516

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Symfony Routing components CompiledUrlMatcher and UrlMatcher interpret the host and path information differently, allowing path-based authorization rules to...

CVE-2026-118516

The Symfony Routing components CompiledUrlMatcher and UrlMatcher interpret the host and path information differently, allowing path-based authorization rules to be bypassed in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. For routes that defi...

CVE-2026-118516 Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control

The Symfony Routing components CompiledUrlMatcher and UrlMatcher interpret the host and path information differently, allowing path-based authorization rules to be bypassed in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. For routes that defi...

CVE-2026-118516 Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control

The Symfony Routing components CompiledUrlMatcher and UrlMatcher interpret the host and path information differently, allowing path-based authorization rules to be bypassed in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. For routes that defi...

CVE-2026-118516

The Symfony Routing components (CompiledUrlMatcher and UrlMatcher) are vulnerable to a path-based authorization bypass in versions prior to 5.4.56 , 6.x prior to 6.4.50 , 7.x prior to 7.4.23 , and 8.x prior to 8.1.11 . The root cause is an interpretation conflict where CompiledUrlMatcher concaten...

BIT-ENVOY-2026-73551 Envoy: Path normalization does not handle dot and dotdot segments with parameters

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefor...

PT-2026-102731

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignore path parameters in path matching is enabled, Envoy's router strips the semicolon suffix before matching but the RBAC url path matcher evaluates the raw...