CVE-2026-66754-Remote-Denial-of-Service-via-Reachable-Assertion-in-URL-Prefix-Handling-rouille-

सुरक्षा सलाह: URL प्रीफ़िक्स हैंडलिंग में रीचेबल एसर्शन के माध्यम से रिमोट डेनियल ऑफ़ सर्विस rouille निर्धारित CVE ID: CVE-2026-66754 सारांश Request::removeprefix प्रतिशत-डिकोड किए गए URL का परीक्षण करता है, लेकिन रॉ URL पर एसर्शन करता है। ऐसा अनुरोध जिसका डिकोड किया गया पाथ प्रीफ़िक्स से शुरू हो...

CVE-2024-38819-POC2

CVE-2024-38819: प्रूफ ऑफ कॉन्सेप्ट PoC यह CVE-2024-38819 भेद्यता के लिए एक प्रूफ ऑफ कॉन्सेप्ट है, जिसे मैंने रिपोर्ट किया था, जो पाथ ट्रैवर्सल एक्सप्लॉइट को प्रदर्शित करता है। निष्पादन चरण 1. Docker इमेज बनाएँ Spring Boot 3.3.4, जो Spring Framework 6.1.13 पर आधारित है root@kitploit: cd vuln docke...

CVE-2021-41773-POC

CVE-2021-41773 भेद्यता पुनरुत्पादन रिपोर्ट भेद्यता अवलोकन CVE ID : CVE-2021-41773 भेद्यता नाम : Apache HTTP सर्वर पथ ट्रैवर्सल भेद्यता जोखिम स्तर : उच्च CVSS 7.5 प्रभावित संस्करण : Apache HTTP सर्वर 2.4.49 भेद्यता विवरण : Apache HTTP सर्वर 2.4.49 संस्करण में पथ सामान्यीकरण फ़ंक्शन apnormalizepath...

CVE-2026-76842

CVE-2026-76842 affects the Mercado Pago Node.js SDK (through 3.4.0 ). The payment, paymentRefund, advancedPayment, and disbursementRefund clients interpolate caller-supplied identifiers into API request paths via template literals without percent-encoding , so URL-structural characters (dot-dot, ...

CVE-2026-75899

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)

Summary The cross-site WebSocket hijacking fix was reimplemented as an origin check gated on a raw-URI prefix test, but Go's ServeMux routes on the percent-decoded path, so requesting /%61pi/events reaches the WebSocket handler while skipping the only origin control, and the upgrader itself accep...

EUVD-2026-63668

Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures...

CVE-2026-19670 Incorrect Authorization in CISA Malcolm

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

CVE-2026-19670

Malcolm's nginx Lua RBAC layer pattern-matches the raw percent-encoded URI while nginx routes using the decoded URI, allowing an authenticated low-privilege user to access admin-only paths via encoded URLs like /%68tadmin.php. CVSS 5.4 (MEDIUM); no in-the-wild exploitation reported. No patch vers...

EUVD-2026-61157

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

CVE-2026-73851 Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package e.g. ../../../../etc/passwd, an absolute path, or a file:// /...

CVE-2026-73851 Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package e.g. ../../../../etc/passwd, an absolute path, or a file:// /...

CVE-2026-73851 Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package e.g. ../../../../etc/passwd, an absolute path, or a file:// /...

CVE-2026-64653

A flaw was found in GitHub CLI. This vulnerability arises from the tool's failure to properly percent-encode variable path components in HTTP request URLs. An attacker could craft malicious repository or resource values containing URL path metacharacters. This could lead to the GitHub CLI...

CVE-2026-12071

The CVE-2026-12071 issue affects the Webbox of TeamDavid by Tobit Laboratories AG. The vulnerability stems from how redirect URLs are constructed using user-supplied input, which is appended to the redirect target in a 302 HTTP response. Technical details in the connected documents show that atta...

CVE-2026-64653

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resourc...

Guzzle: Noncanonical cookie domain keeps subdomain scope

Impact SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless it recognizes the Domain as an IP literal or a numeric host, and it decides that from the domain's own text, so two spellings a transport reads as an address keep subdomain scope. On 7.15, hexadecimal and...

GHSA-CJ54-HPCC-GJ6H Thumbor has path traversal via post-validation URL decoding bypass in file_loader

The fileloader performs unquote on the file path AFTER the abspath + startswith security check. An attacker can use percent-encoded path traversal sequences %2e%2e for .. that pass the security check as literal directory names, but are then decoded to actual .. traversal sequences. Affected code...

CVE-2026-53502

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, fileloader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILELOADERROOTPATH through watermark or frame filter input. This issue is fixed in 7.8.0...

CVE-2026-53502 Thumbor has path traversal via post-validation URL decoding bypass in file_loader

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, fileloader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILELOADERROOTPATH through watermark or frame filter input. This issue is fixed in 7.8.0...