共收录 9 条相关情报。
← 返回所有主题CVE-2026-118650
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an en
CVE-2026-96748
### Summary PyMongo percent-decoded the entire host section of a connection string before splitting it into individual
CVE-2026-76172
### Impact `fast-uri` decodes percent-encoded characters in the scheme component with the legacy global `unescape()` an
CVE-2026-76172
fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never
CVE-2026-67448
Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin mid
CVE-2026-67448
## Summary The cross-site WebSocket hijacking fix was reimplemented as an origin check gated on a raw-URI prefix test,
CVE-2026-67448
Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin mid
CVE-2026-15371
Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and form
CVE-2026-41041
URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache