EUVD-2026-43638

Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0...

CVE-2026-59083

Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0...

CVE-2026-59083 Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass

Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0...

CVE-2026-59083 Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass

Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0...

CVE-2026-59083

A vulnerability in the rewrite valve component of Apache Tomcat allows for a security constraint bypass due to improper handling of URL encoding (Hex Encoding) . This issue affects multiple versions, including 11.0.0-M1 through 11.0.23, 10.1.0-M1 through 10.1.56, 9.0.0.M1 through 9.0.119, and 8.5...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the WebTool.Execute function in the web.go file when processing the url argument. An attacker can make unauthorized requests to internal or external systems by supplying crafted URLs. Remediation The...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the WebTool.Execute function in the web.go file when processing the url argument. An attacker can make unauthorized requests to internal or external systems by supplying crafted URLs. Remediation The...

CVE-2026-11567

creationtimestamp| type| source ---|---|--- 2026-07-14 06:39:52+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqllwpvip62s 2026-07-14 09:23:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqlv2n25xx27 2026-07-19 21:10:52+00:00| seen|...

CVE-2026-15669

creationtimestamp| type| source ---|---|--- 2026-07-14 06:38:25+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqllu4jrw32u 2026-07-14 09:50:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqlwkujr2s2w 2026-07-19 20:30:48+00:00| seen|...

Malicious code in vite-plugin-config-paths (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96c7307466b955fa9b453e949ec2fda3153e5c444b906eed5e3bc88d190a33a7 Package name impersonates the widely-used vite-plugin-tsconfig-paths the package.json homepage points to the legitimate plugin's README, and the READ...

MAL-2026-10574 Malicious code in vite-plugin-config-paths (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96c7307466b955fa9b453e949ec2fda3153e5c444b906eed5e3bc88d190a33a7 Package name impersonates the widely-used vite-plugin-tsconfig-paths the package.json homepage points to the legitimate plugin's README, and the READ...

CVE-2026-15628

creationtimestamp| type| source ---|---|--- 2026-07-14 05:52:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqljbsldb52l 2026-07-19 20:32:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqzmrci6j52u 2026-07-19 20:36:31+00:00| seen|...

CVE-2026-15624

creationtimestamp| type| source ---|---|--- 2026-07-14 05:44:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqlitd4niy2w 2026-07-19 20:37:59+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqzn3yzip42y...

CVE-2026-62393

creationtimestamp| type| source ---|---|--- 2026-07-14 04:40:28+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqlfb7cxfr2q 2026-07-21 08:50:49+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr5gjcoqlw2h 2026-07-21 08:55:07+00:00| seen|...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure in the handleNavigate function of the file pkg/browser/tool.go when manipulating the args.targetUrl argument. An attacker can access sensitive information by sending crafted requests remotely. Remediation There is n...

CVE-2026-62392

creationtimestamp| type| source ---|---|--- 2026-07-14 04:20:27+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqle5fo5ev23 2026-07-15 03:07:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqnqj744cc2n 2026-07-21 08:46:15+00:00| seen|...

CVE-2026-15668

The CVE affects louisho5 picobot up to version 0.2.0, specifically the web Tool component. The vulnerability resides in WebTool.Execute (internal/agent/tools/web.go) where manipulation of the url argument enables server-side request forgery (SSRF). It is a network-vector, with low privileges requ...

CVE-2026-15668 louisho5 picobot web Tool web.go WebTool.Execute server-side request forgery

A vulnerability has been found in louisho5 picobot up to 0.2.0. This vulnerability affects the function WebTool.Execute of the file internal/agent/tools/web.go of the component web Tool. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotel...

CVE-2026-15668 louisho5 picobot web Tool web.go WebTool.Execute server-side request forgery

A vulnerability has been found in louisho5 picobot up to 0.2.0. This vulnerability affects the function WebTool.Execute of the file internal/agent/tools/web.go of the component web Tool. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotel...

CVE-2026-53365

creationtimestamp| type| source ---|---|--- 2026-07-14 03:59:17+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqlcxkyn422e 2026-07-16 08:21:40+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqskkz2gh2b 2026-08-14 21:43:30+00:00| seen|...