過去6か月のすべてのCVEを、毎日更新します。

6件中6件を表示

• 高CVE-2026-76172CVSSスコア 7.52026/08/24

  fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an

  CWE-177openjsf fast-uri
• 中CVE-2026-67448CVSSスコア 6.52026/08/20

  Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/

  CWE-177CWE-200CWE-346
• 高CVE-2026-15371CVSSスコア 8.12026/08/18

  Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScri

  CWE-177
• 緊急CVE-2026-59083CVSSスコア 9.12026/07/14

  Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9

  CWE-177apache tomcat
• 緊急CVE-2026-41041CVSSスコア 9.12026/07/13

  URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue.

  CWE-177apache gravitino
• 中CVE-2026-6414CVSSスコア 5.92026/04/16

  @fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as literal characters. This mismatch allows attackers to bypass route-based middleware or guards that pro

  CWE-177fastify fastify-static