369 matches found
token-reverser
Token Reverser Words list generator to crack security tokens. Installation $ git clone https://github.com/dariusztytko/token-reverser.git Example use case 1. You are testing reset password function 2. Reset password token was sent to your email box e.g. 582431d4c7b57cb4a3570041ffeb7e10 3. You...
CVE-2026-118655
A flaw was found in Echo. A remote attacker can access files under guarded routes, leading to unauthorized information disclosure. This issue occurs when the static file middleware is registered globally and decodes request URL paths a second time. By sending requests containing double-encoded pa...
CVE-2026-35204
CVE-2026-35204 This repository represents a PoC to a CVE-2026-35204 Description "Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, a specially crafted Helm plugin, when installed or updated, will cause Helm to write the contents of the plugin to an arbitrary filesystem...
CLEANSTART-2026-AF49593 fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions
Security vulnerability affects the argo-workflows package. fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize and equal functions...
CVE-2026-118655
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware i...
Linux Distros Unpatched Vulnerability : CVE-2026-118655
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators...
DEBIAN-CVE-2026-118655
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware i...
CVE-2026-118655
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware i...
UBUNTU-CVE-2026-118655
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware i...
EUVD-2026-112461
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware i...
CVE-2026-116073
Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL that allows attackers to write files outside the models directory via percent-encoded separators. Attackers can trick a user into running '/download model' with a crafted URL containing encoded '../'...
CVE-2026-116073 Leon before commit 50df142 Path Traversal via /download model Command
Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL that allows attackers to write files outside the models directory via percent-encoded separators. Attackers can trick a user into running '/download model' with a crafted URL containing encoded '../'...
CVE-2026-116073
The Leon software, specifically versions prior to commit 50df142 , is vulnerable to a path traversal vulnerability (CWE-22) within the getModelFileNameFromURL() function. This flaw allows an attacker to bypass directory restrictions by using percent-encoded separators (e.g., encoded ../ sequences...
CVE-2026-116073 Leon before commit 50df142 Path Traversal via /download model Command
Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL that allows attackers to write files outside the models directory via percent-encoded separators. Attackers can trick a user into running '/download model' with a crafted URL containing encoded '../'...
PT-2026-122976
Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL that allows attackers to write files outside the models directory via percent-encoded separators. Attackers can trick a user into running '/download model' with a crafted URL containing encoded '../'...
CVE-2026-100351
A flaw was found in kin-openapi. An unauthenticated remote attacker can bypass authentication checks on protected routes by sending requests containing encoded path separators. This issue occurs because the request validation handler inspects the decoded URL path, while certain downstream routers...
CLSA-2026-1791915424 cups: Fix of 4 CVEs
CVE-2026-107885: prevent clients from holding multiple open print jobs beyond the configured timeout - CVE-2026-107886: prevent a scheduler crash when modifying a class - CVE-2026-107888: prevent a scheduler crash when a held job destination disappears - CVE-2026-107890: filter group separators...
BIT-DISCOURSE-2026-91132 Discourse: Wildcard iframe origin allowlist bypass via authority separators
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowediframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched...
CentOS Linux 7 [TuxCare] Security Update: python3-pip (CENTOS7:CLSA-2026:1786355121)
The CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1786355121 advisory. - A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to...
fetchmail DoS
The vulnerability of the fetchmail email reception and forwarding client involves incorrect handling of value separators. Exploiting this vulnerability can allow a remote attacker to cause service failures...