EUVD-2026-47644

Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware...

CVE-2026-71430: Reachable Assertion

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's...

CVE-2026-6147

The LightSync Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the restreplacemedia function in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Author-level access and above, to upload...

CVE-2026-6147 LightSync Pro <= 2.1.6 - Authenticated (Author+) Arbitrary File Upload

The LightSync Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the restreplacemedia function in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Author-level access and above, to upload...

EUVD-2026-53180

The LightSync Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the restreplacemedia function in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Author-level access and above, to upload...

PYSEC-2026-3620 Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature

HMAC validation bypass via multiple .replace calls when removing URL signature Summary Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace when removing the signature from the URL before validation. Since .replace removes all occurrences of the substring, an attacker can...

Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature

HMAC validation bypass via multiple .replace calls when removing URL signature SummaryThumbor’s HMAC validation can be bypassed due to the use of Python’s .replace when removing the signature from the URL before validation. Since .replace removes all occurrences of the substring, an attacker can...

EUVD-2026-51608

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace when removing the signature from the URL before validation. Since .replace removes all occurrences of the substring, an attacker can insert...

CVE-2026-53501: Improper Verification of Cryptographic Signature

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace when removing the signature from the URL before validation. Since .replace removes all occurrences of the substring, an attacker can insert...

Incorrect Behavior Order

Overview Affected versions of this package are vulnerable to Incorrect Behavior Order through the applypatch process. An attacker can cause unintended deletion of addressable members in the target document by supplying a specially crafted patch document that triggers a replace operation missing i...

PT-2026-65815

Name of the Vulnerable Software and Affected Versions cJSON versions prior to 1.7.20 Description The apply patch function in cJSON Utils.c performs RFC 6902 JSON Patch operations non-atomically. When a replace operation lacks a value member or a move operation has an unresolvable destination path...

CVE-2026-65600

A flaw was found in Traefik. An unauthenticated remote attacker can bypass authentication due to a path traversal vulnerability in the ReplacePathRegex middleware. When this middleware is misconfigured, it forwards un-normalized paths, allowing a backend to resolve them to protected routes and...

OESA-2026-3110 glib2 security update

GLib is a bundle of three formerly five low-level system libraries written in C and developed mainly by GNOME. GLib's code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since. Security Fixes: A flaw was found in GLib. An off-by-one...

PYSEC-2026-3512 PraisonAI Code agent tools fail open without a workspace boundary

PraisonAI Code agent tools fail open without a workspace boundary Summary PraisonAI Code's agent-compatible CODETOOLS wrappers keep a global workspace root initialized to None. If an application uses CODETOOLS, codereadfile, codesearchreplace, or codeapplydiff before calling setworkspace, the...

PT-2026-64117

PraisonAI Code agent tools fail open without a workspace boundary Summary PraisonAI Code's agent-compatible CODE TOOLS wrappers keep a global workspace root initialized to None. If an application uses CODE TOOLS, code read file, code search replace, or code apply diff before calling set workspace...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the ServeHTTP function in pkg/middlewares/replacepathregex/replacepathregex.go, which forwards the post-substitution path to the backend without checking whether it normalizes to a different route. An attacker can...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the ServeHTTP function in pkg/middlewares/replacepathregex/replacepathregex.go, which forwards the post-substitution path to the backend without checking whether it normalizes to a different route. An attacker can...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the ServeHTTP function in pkg/middlewares/replacepathregex/replacepathregex.go, which forwards the post-substitution path to the backend without checking whether it normalizes to a different route. An attacker can...

Duplicate Advisory: Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cxjq-mrr5-89rv. This link is maintained to preserve external references. Original Description Traefik versions = v3.6.0 = v3.7.0 = v3.7.6 contain an authentication bypass via path traversal in the ReplacePathReg...

CVE-2026-65600

Traefik versions = v3.6.0 = v3.7.0 = v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator e.g. regex "^/api.", replacement "/$1...