Lucene search
+L

167 matches found

Kitploit
Kitploit
added 2026/08/25 4:31 a.m.2 views

CVE-2026-66754-Remote-Denial-of-Service-via-Reachable-Assertion-in-URL-Prefix-Handling-rouille-

보안 권고: URL 접두사 처리의 도달 가능한 단언을 통한 원격 서비스 거부 rouille 지정된 CVE ID: CVE-2026-66754 요약 Request::removeprefix는 퍼센트 디코딩된 URL을 검사하지만 원시raw URL에 대해 단언assert합니다. 디코딩된 경로가 접두사로 시작하지만 원시 경로는 그렇지 않은 요청은 검사를 통과한 뒤 단언에 실패합니다. 접두사의 한 문자만 퍼센트 인코딩하면 충분합니다. 기본 빌드에서는 패닉이 포착되어 500으로 처리됩니다. panic = "abort"로 빌드한 경우에는 이를...

8.2CVSS5.2AI score0.00401EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/24 1:11 p.m.13 views

CVE-2026-76842

CVE-2026-76842 affects the Mercado Pago Node.js SDK (through 3.4.0 ). The payment, paymentRefund, advancedPayment, and disbursementRefund clients interpolate caller-supplied identifiers into API request paths via template literals without percent-encoding , so URL-structural characters (dot-dot, ...

8.8CVSS5.4AI score0.0038EPSS
SaveExploits0References4
NVD
NVD
added 2026/08/24 10:16 a.m.10 views

CVE-2026-75899

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

7.5CVSS0.00234EPSS
SaveExploits0References2
Github Security Blog
Github Security Blog
added 2026/08/20 9:34 p.m.7 views

Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)

Summary The cross-site WebSocket hijacking fix was reimplemented as an origin check gated on a raw-URI prefix test, but Go's ServeMux routes on the percent-decoded path, so requesting /%61pi/events reaches the WebSocket handler while skipping the only origin control, and the upgrader itself accep...

6.5CVSS5.6AI score0.00216EPSS
SaveExploits2References4Affected Software1
EUVD
EUVD
added 2026/08/20 9:29 p.m.9 views

EUVD-2026-63668

Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures...

6.5CVSS5.4AI score0.00146EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/18 7:06 p.m.19 views

CVE-2026-19670 Incorrect Authorization in CISA Malcolm

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

5.4CVSS0.00185EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/18 7:06 p.m.51 views

CVE-2026-19670

Malcolm's nginx Lua RBAC layer pattern-matches the raw percent-encoded URI while nginx routes using the decoded URI, allowing an authenticated low-privilege user to access admin-only paths via encoded URLs like /%68tadmin.php. CVSS 5.4 (MEDIUM); no in-the-wild exploitation reported. No patch vers...

5.4CVSS5.3AI score0.00185EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/18 7:06 p.m.10 views

EUVD-2026-61157

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

5.4CVSS5.4AI score0.00185EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/17 3:11 p.m.6 views

CVE-2026-73851 Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package e.g. ../../../../etc/passwd, an absolute path, or a file:// /...

6.1CVSS5.5AI score
SaveExploits0References10
Cvelist
Cvelist
added 2026/08/17 3:11 p.m.38 views

CVE-2026-73851 Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package e.g. ../../../../etc/passwd, an absolute path, or a file:// /...

6.1CVSS0.01479EPSS
SaveExploits0References8
Vulnrichment
Vulnrichment
added 2026/08/17 3:11 p.m.9 views

CVE-2026-73851 Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package e.g. ../../../../etc/passwd, an absolute path, or a file:// /...

6.1CVSS5.4AI score0.01479EPSS
SaveExploits0References8
RedhatCVE
RedhatCVE
added 2026/08/10 9:21 a.m.12 views

CVE-2026-64653

A flaw was found in GitHub CLI. This vulnerability arises from the tool's failure to properly percent-encode variable path components in HTTP request URLs. An attacker could craft malicious repository or resource values containing URL path metacharacters. This could lead to the GitHub CLI...

5.4CVSS5.2AI score0.00497EPSS
SaveExploits0References6
CVE
CVE
added 2026/08/07 9:40 a.m.48 views

CVE-2026-12071

The CVE-2026-12071 issue affects the Webbox of TeamDavid by Tobit Laboratories AG. The vulnerability stems from how redirect URLs are constructed using user-supplied input, which is appended to the redirect target in a 302 HTTP response. Technical details in the connected documents show that atta...

5.3CVSS5.5AI score0.00335EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/06 10:18 p.m.16 views

CVE-2026-64653

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resourc...

5.1CVSS0.00497EPSS
SaveExploits0References3
Github Security Blog
Github Security Blog
added 2026/08/03 9:05 p.m.12 views

Guzzle: Noncanonical cookie domain keeps subdomain scope

Impact SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless it recognizes the Domain as an IP literal or a numeric host, and it decides that from the domain's own text, so two spellings a transport reads as an address keep subdomain scope. On 7.15, hexadecimal and...

6.5CVSS5.5AI score0.00167EPSS
SaveExploits0References8Affected Software1
OSV
OSV
added 2026/07/31 7:03 p.m.11 views

GHSA-CJ54-HPCC-GJ6H Thumbor has path traversal via post-validation URL decoding bypass in file_loader

The fileloader performs unquote on the file path AFTER the abspath + startswith security check. An attacker can use percent-encoded path traversal sequences %2e%2e for .. that pass the security check as literal directory names, but are then decoded to actual .. traversal sequences. Affected code...

8.7CVSS5.5AI score0.00357EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/07/31 7:03 p.m.11 views

CVE-2026-53502

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, fileloader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILELOADERROOTPATH through watermark or frame filter input. This issue is fixed in 7.8.0...

8.7CVSS5.5AI score0.00357EPSS
SaveExploits0References4Affected Software1
Cvelist
Cvelist
added 2026/07/31 7:03 p.m.35 views

CVE-2026-53502 Thumbor has path traversal via post-validation URL decoding bypass in file_loader

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, fileloader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILELOADERROOTPATH through watermark or frame filter input. This issue is fixed in 7.8.0...

8.7CVSS0.00357EPSS
SaveExploits0References3
NVD
NVD
added 2026/07/28 11:17 p.m.18 views

CVE-2026-54650

openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/publicproxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath, allowing percent encoded dot segments %2e and separators %2f to reach...

8.6CVSS0.00361EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/28 10:20 p.m.10 views

GHSA-FH2F-XFXC-Q9CC openhole-server vulnerable to path traversal via URL-decoded request path

Summary openhole-server forwarded the URL-decoded request path r.URL.Path to tunnel clients instead of the original request-target. Percent-encoded dot-segments %2e and separators %2f were decoded to ../ and / before reaching the local service. Go's ServeMux rejects literal ../ paths, but...

8.6CVSS5.9AI score0.00361EPSS
SaveExploits0References4
Rows per page
Query Builder