CVE-2026-86115 Sim before 0.8.14 Confused Deputy in Tool URL Routing Mints an Internal Token for a User-Supplied /api/ Path

Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting with /api/ in HTTP...

CVE-2026-86115 Sim before 0.8.14 Confused Deputy in Tool URL Routing Mints an Internal Token for a User-Supplied /api/ Path

Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting with /api/ in HTTP...

CVE-2026-86115

Sim (an open-source tool by SimStudio) before 0.8.14 contains a confused deputy flaw in tool URL routing. Requests are classified as internal via URL prefix matching without scheme normalization , causing SSRF validation to be skipped and internal authentication tokens to be minted for user-suppl...

Off-by-one Error

Overview org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Off-by-one Error in chain-rule handling due to the rule-skipping logic in java/org/apache/catalina/valves/rewrite/RewriteValve.java...

Gotenberg 安全漏洞

Gotenberg is an open-source, developer-friendly API developed by Gotenberg. It is used to convert various document formats into PDF files. Versions of Gotenberg prior to 8.32.0 contained security vulnerabilities. These vulnerabilities stemmed from the lack of protection for URL routing using...

EUVD-2018-9096

Malware in sbrugna...

EUVD-2018-8360

Malware in sbrugna...

EUVD-2010-5058

Malware in sbrugna...

CVE-2018-16553

In Jspxcms 9.0.0, a vulnerable URL routing implementation allows remote code execution after logging in as web admin...

[SECURITY] Fedora 40 Update: python-werkzeug-3.0.6-1.fc40

Werkzeug =3D=3D=3D=3D=3D=3D=3D=3D Werkzeug started as simple collection of various utilities for WSGI applications and has become one of the most advanced WSGI utility modules. It includes a powerful debugger, full featured request and response objects, HTTP utilities to handle entity tags, cache...

[SECURITY] Fedora 41 Update: python-werkzeug-3.0.6-1.fc41

Werkzeug =3D=3D=3D=3D=3D=3D=3D=3D Werkzeug started as simple collection of various utilities for WSGI applications and has become one of the most advanced WSGI utility modules. It includes a powerful debugger, full featured request and response objects, HTTP utilities to handle entity tags, cache...

Fedora: Security Advisory for python-werkzeug (FEDORA-2023-729a50a7e1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 38 Update: python-werkzeug-2.2.3-1.fc38

Werkzeug =3D=3D=3D=3D=3D=3D=3D=3D Werkzeug started as simple collection of various utilities for WSGI applications and has become one of the most advanced WSGI utility modules. It includes a powerful debugger, full featured request and response objects, HTTP utilities to handle entity tags, cache...

CVE-2018-16553

In Jspxcms 9.0.0, a vulnerable URL routing implementation allows remote code execution after logging in as web admin...

CVE-2018-16553

In Jspxcms 9.0.0, a vulnerable URL routing implementation allows remote code execution after logging in as web admin...

Remote code execution

In Jspxcms 9.0.0, a vulnerable URL routing implementation allows remote code execution after logging in as web admin...

[SECURITY] Fedora 27 Update: python-werkzeug-0.12.2-1.fc27

Werkzeug =3D=3D=3D=3D=3D=3D=3D=3D Werkzeug started as simple collection of various utilities for WSGI applications and has become one of the most advanced WSGI utility modules. It includes a powerful debugger, full featured request and response objects, HTTP utilities to handle entity tags, cache...

CVE-2010-5094

The deleteinstallfiles function in control/ContentController.php in SilverStripe 2.3.x before 2.3.7 does not require ADMIN permissions, which allows remote attackers to delete index.php and "disrupt modrewrite-less URL routing."...

Design/Logic Flaw

The deleteinstallfiles function in control/ContentController.php in SilverStripe 2.3.x before 2.3.7 does not require ADMIN permissions, which allows remote attackers to delete index.php and "disrupt modrewrite-less URL routing."...

CVE-2010-5094

The deleteinstallfiles function in control/ContentController.php in SilverStripe 2.3.x before 2.3.7 does not require ADMIN permissions, which allows remote attackers to delete index.php and "disrupt modrewrite-less URL routing."...