112705 matches found
CVE-2026-33808 @fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)
Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled. This allows complete bypass of path-scoped authentication middleware via duplicate slashes when ignoreDuplicateSlashes is enabled, or...
CVE-2026-33808 @fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)
Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled. This allows complete bypass of path-scoped authentication middleware via duplicate slashes when ignoreDuplicateSlashes is enabled, or...
CVE-2026-33808 @fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)
Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled. This allows complete bypass of path-scoped authentication middleware via duplicate slashes when ignoreDuplicateSlashes is enabled, or...
CVE-2026-41180
creationtimestamp| type| source ---|---|--- 2026-04-15 08:28:18+00:00| published-proof-of-concept| https://github.com/psi-4ward/psitransfer/security/advisories/GHSA-533q-w4g6-5586 2026-04-23 05:18:40+00:00| seen| Telegram/x9tyUe3u3o8RRyRxn4MyOTn6X2M4g6ykuZunUy8vPfx8ng 2026-04-23 05:23:51+00:00|...
CVE-2026-3643
The Accessibly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API in all versions up to, and including, 3.0.3. The plugin registers REST API endpoints at /otm-ac/v1/update-widget-options and /otm-ac/v1/update-app-config with the permissioncallback set to returntrue...
CVE-2026-3643 Accessibly <= 3.0.3 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Widget Source Injection via REST API
The Accessibly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API in all versions up to, and including, 3.0.3. The plugin registers REST API endpoints at /otm-ac/v1/update-widget-options and /otm-ac/v1/update-app-config with the permissioncallback set to returntrue...
vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin
A flaw was found in Vim, an open-source command-line text editor. Specifically, an operating system OS command injection vulnerability exists in the netrw standard plugin. A remote attacker could exploit this by tricking a user into opening a specially crafted URL, such as one using the scp://...
curl: lib/http2.c: SSL connections accept non-HTTP push schemes (incomplete fix for 2e8c922a)
Summary: settransferurl in lib/http2.c validates the :scheme pseudo-header of PUSHPROMISE frames only when !viasslconn — a guard added by commit 2e8c922a to block non-TLS connections from accepting TLS-scheme pushes. The symmetric case was not addressed: over TLS, viasslconn is TRUE, the guard at...
AZL-83048 CVE-2026-5160 affecting package gh for versions less than 2.62.0-15
Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting XSS due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check IsDangerousURL before resolving HTML entities...
AZL-83060 CVE-2026-5160 affecting package telegraf for versions less than 1.31.0-19
Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting XSS due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check IsDangerousURL before resolving HTML entities...
CVE-2026-5160
Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting XSS due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check IsDangerousURL before resolving HTML entities...
CVE-2026-5160
Summary: CVE-2026-5160 affects the Go package github.com/yuin/goldmark/renderer/html prior to 1.7.17, where cross-site scripting (XSS) can occur due to the order of URL validation and entity resolution. The renderer checks destinations with IsDangerousURL before HTML entity decoding, allowing an ...
CVE-2026-5160
Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting XSS due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check IsDangerousURL before resolving HTML entities...
CVE-2026-40096
creationtimestamp| type| source ---|---|--- 2026-04-15 04:49:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjj3sdddpd2a...
CVE-2026-1541
creationtimestamp| type| source ---|---|--- 2026-04-15 04:39:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjj3ag6qgm2m 2026-07-15 10:01:31+00:00| seen| https://bsky.app/profile/bsi.bund.de/post/3mqoho555k222 2026-07-15 10:27:25+00:00| seen|...
CVE-2026-4812
creationtimestamp| type| source ---|---|--- 2026-04-15 04:15:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjizv6wo6l2z...
CVE-2026-40105
creationtimestamp| type| source ---|---|--- 2026-04-15 04:13:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjizrlymz22o 2026-05-04 07:30:55+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-40105.yaml...
CVE-2026-33808
creationtimestamp| type| source ---|---|--- 2026-04-15 01:50:08+00:00| published-proof-of-concept| https://github.com/fastify/fastify-express/security/advisories/GHSA-6hw5-45gm-fj88 2026-04-15 09:37:06+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mjjlupakwk2c 2026-04-15...
CVE-2026-34454
creationtimestamp| type| source ---|---|--- 2026-04-15 00:39:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjintndpoi2r...
ProcessWire CMS 安全漏洞
ProcessWire CMS is a flexible content management system developed by ProcessWire as open source. Versions of ProcessWire CMS 3.0.255 and earlier contained security vulnerabilities. These vulnerabilities were due to a server-side request forgeing issue in the “Add Module From URL” feature of the...