Monthly
Labstack Echo's global Static middleware serves files whose paths were percent-encoded to dodge route- or group-level middleware guards: when `middleware.Static` is mounted with `e.Use(...)` and an application protects a path such as `/admin` with a group middleware, a request for `/admin%2Fsecret.txt` skips the guard because the router matches on the raw, still-encoded path, yet the handler opens and returns the same file because it reads the already-decoded `c.Request().URL.Path`. Echo v5 releases from 5.0.0 before 5.4.0 and v4 releases before 4.16.0 are affected; the advisory ships a reproduction PoC against v5.3.1 (literal path returns 401, `%2F` form returns the file) and there is no CISA KEV entry or confirmed active exploitation. Impact is bounded to files already inside the served static root - nothing outside the root is reachable - so this is an authorization-consistency flaw exploitable only by deployments that both publish a directory statically and rely on a route guard, rather than keeping sensitive files out of that root.
Unauthenticated attackers can retrieve cached content from protected routes in OpenNext Cloudflare (@opennextjs/cloudflare) versions 0.3.0 through 1.20.2 when three deployment-specific conditions coincide: enableCacheInterception is set to true (an opt-in, non-default setting), access control is implemented with middleware matchers rather than inside route handlers, and the protected route has a matching entry in the incremental cache. Because middleware matching and cache-key lookup handle percent-encoded pathnames inconsistently, a request such as /%61dmin/%ZZ can evade authorization middleware while still resolving to the cache key of a protected route, disclosing cached content with no authentication or user interaction required. Rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), this is a confidentiality-only authorization bypass; no public exploit code has been identified at time of analysis, and the issue is resolved in @opennextjs/cloudflare 1.20.2.
Authentication bypass in Cisco Catalyst SD-WAN Manager (vManage) allows an unauthenticated remote attacker to reach a restricted HTTP API endpoint with the privileges of the admin user by submitting a crafted request whose URI encoding evades the authentication rule guarding that endpoint. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, no user interaction and no special complexity are required - the single real prerequisite is network reachability to the SD-WAN Manager management/API interface, so exposure is materially lower for deployments that keep that interface on trusted management networks. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the impact of a successful bypass is complete administrative compromise of the controller, which drives the high priority of this issue.
Attackers can inject arbitrary additional servers into a PyMongo (MongoDB Python Driver) client's connection topology by smuggling the percent-encoded form of a host-list delimiter (for example %2C) inside a hostname value that an application places into a connection string, because PyMongo decodes percent-escapes before it splits the host list. The request is unauthenticated (CVSS 4.0 PR:N) but carries an attack-requirement prerequisite (AT:P): the target application must build a URI at runtime from a host the attacker can influence, meaning static or hardcoded connection strings are not exploitable. MongoDB's own CVSS 4.0 rating of 8.3 (High) is driven by a high integrity impact - the client may route its authentication exchange and subsequent database operations to the rogue host, which can observe limited information and return altered query results. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in PyMongo 4.18.2.
Parsing and serialization inconsistency in fast-uri, the Node.js URI parser core to the Fastify ecosystem, allows network-accessible, unauthenticated attackers to supply percent-encoded slashes in the scheme component, causing the library to report host as undefined during parsing while serialization emits a network-path reference with an attacker-controlled authority. Applications that allowlist requests on the parsed host value, or that treat a no-authority parse result as safe to resolve against a base URI, are bypassed - enabling server-side request forgery, off-site redirects, and address-policy evasion. No public exploit has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special configuration, making affected deployments an immediate upgrade priority.
Cross-site scripting in Velociraptor's web GUI arises from unsanitized URL scheme handling in URL-typed table columns, enabling a high-privileged attacker to inject javascript: URIs that execute when a second user clicks the crafted link in the console. The scope change (S:C) in the CVSS vector confirms the XSS crosses the application's security boundary into the victim's browser session, exposing session tokens and permitting authenticated actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis, but the C:H/I:H impact scores reflect meaningful credential theft and session hijacking potential within the Velociraptor investigation console.
Security constraint bypass in Apache Tomcat (8.5.0-8.5.100, 9.0.0.M1-9.0.119, 10.1.0-M1-10.1.56, 11.0.0-M1-11.0.23) lets remote attackers reach protected resources by abusing improperly handled hex URL encoding in the RewriteValve, defeating URL-pattern security constraints. Because the flaw resides in the rewrite valve, only deployments that use the RewriteValve together with security constraints are exposed, but where present an unauthenticated attacker (per CVSS PR:N) can access or manipulate resources meant to be restricted. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.
Improper URL encoding in Apache Gravitino versions 1.0.0 through 1.2.0 lets remote attackers inject crafted path segments through unencoded, user-supplied metadata identifiers, redirecting or manipulating the internal HTTP requests Gravitino issues on the user's behalf. Because the CVSS vector (AV:N/PR:N) indicates no authentication and yields a 9.1 Critical score with high confidentiality and integrity impact, an attacker can potentially reach unintended endpoints, tamper with metadata operations, or exfiltrate data from back-end catalog services. No public exploit identified at time of analysis, and the flaw is fixed in version 1.2.1.
Hono versions prior to 4.12.4 suffer from an authentication bypass in serveStatic when combined with route-based middleware protections due to inconsistent URL decoding between the router and file serving components. An unauthenticated remote attacker can exploit this mismatch by encoding slashes (%2F) in request paths to access protected static resources that should be restricted by middleware rules. A patch is available in version 4.12.4 and later.
The @fastify/express plugin prior to version 4.0.3 allows authenticated attackers to bypass path-based middleware restrictions by submitting URL-encoded characters in requests, such as using /%61dmin instead of /admin. While the middleware engine fails to match the encoded path, the underlying Fastify router correctly decodes it and routes the request to handlers, enabling unauthorized access to protected endpoints. This affects Node.js applications using vulnerable versions of the plugin.
Labstack Echo's global Static middleware serves files whose paths were percent-encoded to dodge route- or group-level middleware guards: when `middleware.Static` is mounted with `e.Use(...)` and an application protects a path such as `/admin` with a group middleware, a request for `/admin%2Fsecret.txt` skips the guard because the router matches on the raw, still-encoded path, yet the handler opens and returns the same file because it reads the already-decoded `c.Request().URL.Path`. Echo v5 releases from 5.0.0 before 5.4.0 and v4 releases before 4.16.0 are affected; the advisory ships a reproduction PoC against v5.3.1 (literal path returns 401, `%2F` form returns the file) and there is no CISA KEV entry or confirmed active exploitation. Impact is bounded to files already inside the served static root - nothing outside the root is reachable - so this is an authorization-consistency flaw exploitable only by deployments that both publish a directory statically and rely on a route guard, rather than keeping sensitive files out of that root.
Unauthenticated attackers can retrieve cached content from protected routes in OpenNext Cloudflare (@opennextjs/cloudflare) versions 0.3.0 through 1.20.2 when three deployment-specific conditions coincide: enableCacheInterception is set to true (an opt-in, non-default setting), access control is implemented with middleware matchers rather than inside route handlers, and the protected route has a matching entry in the incremental cache. Because middleware matching and cache-key lookup handle percent-encoded pathnames inconsistently, a request such as /%61dmin/%ZZ can evade authorization middleware while still resolving to the cache key of a protected route, disclosing cached content with no authentication or user interaction required. Rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), this is a confidentiality-only authorization bypass; no public exploit code has been identified at time of analysis, and the issue is resolved in @opennextjs/cloudflare 1.20.2.
Authentication bypass in Cisco Catalyst SD-WAN Manager (vManage) allows an unauthenticated remote attacker to reach a restricted HTTP API endpoint with the privileges of the admin user by submitting a crafted request whose URI encoding evades the authentication rule guarding that endpoint. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, no user interaction and no special complexity are required - the single real prerequisite is network reachability to the SD-WAN Manager management/API interface, so exposure is materially lower for deployments that keep that interface on trusted management networks. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the impact of a successful bypass is complete administrative compromise of the controller, which drives the high priority of this issue.
Attackers can inject arbitrary additional servers into a PyMongo (MongoDB Python Driver) client's connection topology by smuggling the percent-encoded form of a host-list delimiter (for example %2C) inside a hostname value that an application places into a connection string, because PyMongo decodes percent-escapes before it splits the host list. The request is unauthenticated (CVSS 4.0 PR:N) but carries an attack-requirement prerequisite (AT:P): the target application must build a URI at runtime from a host the attacker can influence, meaning static or hardcoded connection strings are not exploitable. MongoDB's own CVSS 4.0 rating of 8.3 (High) is driven by a high integrity impact - the client may route its authentication exchange and subsequent database operations to the rogue host, which can observe limited information and return altered query results. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in PyMongo 4.18.2.
Parsing and serialization inconsistency in fast-uri, the Node.js URI parser core to the Fastify ecosystem, allows network-accessible, unauthenticated attackers to supply percent-encoded slashes in the scheme component, causing the library to report host as undefined during parsing while serialization emits a network-path reference with an attacker-controlled authority. Applications that allowlist requests on the parsed host value, or that treat a no-authority parse result as safe to resolve against a base URI, are bypassed - enabling server-side request forgery, off-site redirects, and address-policy evasion. No public exploit has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special configuration, making affected deployments an immediate upgrade priority.
Cross-site scripting in Velociraptor's web GUI arises from unsanitized URL scheme handling in URL-typed table columns, enabling a high-privileged attacker to inject javascript: URIs that execute when a second user clicks the crafted link in the console. The scope change (S:C) in the CVSS vector confirms the XSS crosses the application's security boundary into the victim's browser session, exposing session tokens and permitting authenticated actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis, but the C:H/I:H impact scores reflect meaningful credential theft and session hijacking potential within the Velociraptor investigation console.
Security constraint bypass in Apache Tomcat (8.5.0-8.5.100, 9.0.0.M1-9.0.119, 10.1.0-M1-10.1.56, 11.0.0-M1-11.0.23) lets remote attackers reach protected resources by abusing improperly handled hex URL encoding in the RewriteValve, defeating URL-pattern security constraints. Because the flaw resides in the rewrite valve, only deployments that use the RewriteValve together with security constraints are exposed, but where present an unauthenticated attacker (per CVSS PR:N) can access or manipulate resources meant to be restricted. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.
Improper URL encoding in Apache Gravitino versions 1.0.0 through 1.2.0 lets remote attackers inject crafted path segments through unencoded, user-supplied metadata identifiers, redirecting or manipulating the internal HTTP requests Gravitino issues on the user's behalf. Because the CVSS vector (AV:N/PR:N) indicates no authentication and yields a 9.1 Critical score with high confidentiality and integrity impact, an attacker can potentially reach unintended endpoints, tamper with metadata operations, or exfiltrate data from back-end catalog services. No public exploit identified at time of analysis, and the flaw is fixed in version 1.2.1.
Hono versions prior to 4.12.4 suffer from an authentication bypass in serveStatic when combined with route-based middleware protections due to inconsistent URL decoding between the router and file serving components. An unauthenticated remote attacker can exploit this mismatch by encoding slashes (%2F) in request paths to access protected static resources that should be restricted by middleware rules. A patch is available in version 4.12.4 and later.
The @fastify/express plugin prior to version 4.0.3 allows authenticated attackers to bypass path-based middleware restrictions by submitting URL-encoded characters in requests, such as using /%61dmin instead of /admin. While the middleware engine fails to match the encoded path, the underlying Fastify router correctly decodes it and routes the request to handlers, enabling unauthorized access to protected endpoints. This affects Node.js applications using vulnerable versions of the plugin.