كل ثغرات CVE في الأشهر الستة الماضية، محدَّثة يوميًا.

عرض 6 من 6

• عاليةCVE-2026-76172درجة CVSS 7.524‏/08‏/2026

  fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an

  CWE-177openjsf fast-uri
• متوسطةCVE-2026-67448درجة CVSS 6.520‏/08‏/2026

  Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/

  CWE-177CWE-200CWE-346
• عاليةCVE-2026-15371درجة CVSS 8.118‏/08‏/2026

  Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScri

  CWE-177
• حرجةCVE-2026-59083درجة CVSS 9.114‏/07‏/2026

  Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9

  CWE-177apache tomcat
• حرجةCVE-2026-41041درجة CVSS 9.113‏/07‏/2026

  URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue.

  CWE-177apache gravitino
• متوسطةCVE-2026-6414درجة CVSS 5.916‏/04‏/2026

  @fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as literal characters. This mismatch allows attackers to bypass route-based middleware or guards that pro

  CWE-177fastify fastify-static