共收录 16 条相关情报。
← 返回所有主题CVE-2026-119200
Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-en
CVE-2026-112343
Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to e
CVE-2026-110095
### Impact `fast-uri`'s `normalize()` and `serialize()` apply RFC 3986 dot-segment removal (`remove_dot_segments`) to t
CVE-2026-110725
### Impact `fast-uri`'s `serialize()`, `normalize()`, and `resolve()`, when called with the non-default option `referen
CVE-2026-110725
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 throu
CVE-2026-110095
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 throu
CVE-2026-102231
Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security featu
CVE-2026-102217
Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network.
CVE-2026-93709
Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard
CVE-2026-93709
Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard
CVE-2026-57441
MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.4,
CVE-2026-72835
filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated u
CVE-2026-50559
Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parame
CVE-2026-66064
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler
CVE-2026-66064
## Summary `sendFile` derives the served filename from the raw request path while opening the file from the cleaned pat
CVE-2026-50568
`SanitizeFilePath` in `pkg/utils/utils.go` validated that a path stayed under a safe directory by calling `strings.HasPr