CVE-2026-49846

libks , a foundational C library used by SignalWire products, contains a path traversal vulnerability in clean_uri(), its HTTP request parser. Prior to version 2.0.11 , URIs whose path exceeds the internal canonicalization buffer's segment capacity are silently passed through with embedded .. seq...

CVE-2026-49846 libks has path traversal in kws HTTP parser via URI segment overflow

libks provides foundational support for signalwire C products. Prior to version 2.0.11, cleanuri in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with...

tomcat examples jsp XSS

Multiple cross-site scripting XSS vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via...