CVE-2026-62857

creationtimestamp| type| source ---|---|--- 2026-07-18 17:38:21+00:00| seen| https://bsky.app/profile/hollo.hollo.social.ap.brid.gy/post/3mqwslocjbbu2 2026-07-19 04:53:12+00:00| seen| https://bsky.app/profile/pmloik.bsky.social/post/3mqxycl25wi2d...

CVE-2026-16125

A vulnerability was found in zevorn rt-claw up to 0.2.0. The affected element is the function clawnetget/clawnetpost of the file claw/services/tools/net.c of the component httprequest. The manipulation of the argument url results in server-side request forgery. The attack can be executed remotely...

CVE-2025-71393

creationtimestamp| type| source ---|---|--- 2026-07-18 16:00:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqwn4fqmqk2a...

CVE-2026-16127

The CVE-2026-16127 entry describes a vulnerability in zevorn rt-claw (up to version 0.2.0) affecting the http_request component, specifically claw_net_get and claw_net_post in claw/tools/tool_net.c. The issue arises from manipulation of the url argument, enabling server-side request forgery (SSRF...

EUVD-2026-45388

A vulnerability was identified in zevorn rt-claw up to 0.2.0. This affects the function clawnetget/clawnetpost of the file claw/tools/toolnet.c of the component httprequest. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote. The...

CVE-2026-16127 zevorn rt-claw http_request tool_net.c claw_net_post server-side request forgery

A vulnerability was identified in zevorn rt-claw up to 0.2.0. This affects the function clawnetget/clawnetpost of the file claw/tools/toolnet.c of the component httprequest. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote. The...

CVE-2026-16127 zevorn rt-claw http_request tool_net.c claw_net_post server-side request forgery

A vulnerability was identified in zevorn rt-claw up to 0.2.0. This affects the function clawnetget/clawnetpost of the file claw/tools/toolnet.c of the component httprequest. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote. The...

CVE-2025-71396

creationtimestamp| type| source ---|---|--- 2026-07-18 15:57:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqwmyb5u6r2a...

CVE-2026-16125 zevorn rt-claw http_request net.c claw_net_post server-side request forgery

A vulnerability was found in zevorn rt-claw up to 0.2.0. The affected element is the function clawnetget/clawnetpost of the file claw/services/tools/net.c of the component httprequest. The manipulation of the argument url results in server-side request forgery. The attack can be executed remotely...

CVE-2026-16117 @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string...

CVE-2026-16117 @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string...

EUVD-2026-45379

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string...

CVE-2026-16117 @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string...

CVE-2026-16158

CVE-2026-16158 affects @fastify/reply-from. The vulnerability stems from how the internal URL cache key is built by concatenating the destination and source paths without a delimiter in versions 8.3.1 up to (but not including) 12.6.4. This can cause key collisions where different upstreams resolv...

CVE-2026-44203

creationtimestamp| type| source ---|---|--- 2026-07-18 00:31:11+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3mquz72wk7c2s 2026-09-15 10:10:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvkf2nx7u22j...

CVE-2026-56741

creationtimestamp| type| source ---|---|--- 2026-07-18 00:19:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mquyl3hgcb2a 2026-07-18 05:00:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqvibaehij2c 2026-07-20 22:37:21+00:00| published-proof-of-concept|...

PT-2026-60960

Name of the Vulnerable Software and Affected Versions @fastify/http-proxy versions 9.4.0 through 11.5.0 Description WebSocket destination paths are not properly validated against the configured rewrite prefix. The WebSocketProxy.findUpstream function resolves destinations using the WHATWG URL...

CVE-2026-16158: Unintended Proxy or Intermediary

Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URL...

PT-2026-60961

Name of the Vulnerable Software and Affected Versions @fastify/http-proxy versions prior to 11.6.0 Description An improper input normalization issue exists where the software fails to rewrite the request prefix when the prefix segment is URL-encoded. While the router URL-decodes paths for route...

PT-2026-60992

A vulnerability was determined in zhayujie CowAgent up to 2.1.1. This affects the function WebFetch.execute of the file agent/tools/web fetch/web fetch.py. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit ha...