Monthly
Internal redirection URL validation in LiteSpeed Web Server before 6.3.7 build 1 can be bypassed in a narrow 'corner case', allowing an authenticated remote user with low privileges (PR:L per the vendor vector) to have a crafted URL resolve to a resource other than the one the validation logic approved. Because the flaw stems from the URL normalization path decoding the same value more than once (CWE-174), the malformed request passes the check in its first-decoded form but takes on different meaning after a second decode; the assessed impact is high confidentiality loss with only limited integrity impact and no availability loss, with scope crossing into the underlying system. The vendor's CVSS 4.0 vector rates this 9.4 with low attack complexity and all impacts High, whereas our independent assessment (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N) treats exploitation as high complexity because only an undocumented, highly specific corner case triggers it; no public exploit code exists and the issue is not confirmed as actively exploited (CISA KEV), so exposure is limited in practice to attackers who can reach the redirect path and reproduce the exact crafted input.
Double-decoding of percent-encoded hostnames in fast-uri (Node.js URI parser) creates a server-side request forgery and host-policy bypass primitive in versions 2.4.1-2.4.4, 3.1.2-3.1.5, and 4.0.0-4.1.2. The library decodes percent escapes once during hostname parsing and again during authority recomposition, so a single normalize or resolve call on a doubly-encoded input can silently resolve to a different network destination - including loopback addresses - than the encoded form represents. Any application layer sitting fast-uri in front of outbound routing guards, redirect allow-lists, or host-policy checks is therefore vulnerable to SSRF. This is an incomplete-fix variant of CVE-2026-6322; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Double decoding in the Canva Desktop deeplink handler (versions before 1.125.0) lets an unauthenticated attacker who convinces a user to open a crafted custom-URI deeplink cause the application to load arbitrary same-origin content within that user's session. The flaw (CWE-174) yields limited integrity impact only, with no confidentiality or availability effect, and exploitation requires user interaction (UI:R). No public exploit code or confirmed active exploitation has been identified at time of analysis (no CISA KEV entry; no EPSS score supplied), and the vendor has released a fix in v1.125.0.
Internal redirection URL validation in LiteSpeed Web Server before 6.3.7 build 1 can be bypassed in a narrow 'corner case', allowing an authenticated remote user with low privileges (PR:L per the vendor vector) to have a crafted URL resolve to a resource other than the one the validation logic approved. Because the flaw stems from the URL normalization path decoding the same value more than once (CWE-174), the malformed request passes the check in its first-decoded form but takes on different meaning after a second decode; the assessed impact is high confidentiality loss with only limited integrity impact and no availability loss, with scope crossing into the underlying system. The vendor's CVSS 4.0 vector rates this 9.4 with low attack complexity and all impacts High, whereas our independent assessment (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N) treats exploitation as high complexity because only an undocumented, highly specific corner case triggers it; no public exploit code exists and the issue is not confirmed as actively exploited (CISA KEV), so exposure is limited in practice to attackers who can reach the redirect path and reproduce the exact crafted input.
Double-decoding of percent-encoded hostnames in fast-uri (Node.js URI parser) creates a server-side request forgery and host-policy bypass primitive in versions 2.4.1-2.4.4, 3.1.2-3.1.5, and 4.0.0-4.1.2. The library decodes percent escapes once during hostname parsing and again during authority recomposition, so a single normalize or resolve call on a doubly-encoded input can silently resolve to a different network destination - including loopback addresses - than the encoded form represents. Any application layer sitting fast-uri in front of outbound routing guards, redirect allow-lists, or host-policy checks is therefore vulnerable to SSRF. This is an incomplete-fix variant of CVE-2026-6322; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Double decoding in the Canva Desktop deeplink handler (versions before 1.125.0) lets an unauthenticated attacker who convinces a user to open a crafted custom-URI deeplink cause the application to load arbitrary same-origin content within that user's session. The flaw (CWE-174) yields limited integrity impact only, with no confidentiality or availability effect, and exploitation requires user interaction (UI:R). No public exploit code or confirmed active exploitation has been identified at time of analysis (no CISA KEV entry; no EPSS score supplied), and the vendor has released a fix in v1.125.0.