최근 6개월의 모든 CVE를 매일 업데이트합니다.

6개 중 6개 표시

• 높음CVE-2026-76172CVSS 점수 7.52026. 8. 24.

  fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an

  CWE-177openjsf fast-uri
• 중간CVE-2026-67448CVSS 점수 6.52026. 8. 20.

  Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/

  CWE-177CWE-200CWE-346
• 높음CVE-2026-15371CVSS 점수 8.12026. 8. 18.

  Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScri

  CWE-177
• 치명CVE-2026-59083CVSS 점수 9.12026. 7. 14.

  Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9

  CWE-177apache tomcat
• 치명CVE-2026-41041CVSS 점수 9.12026. 7. 13.

  URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue.

  CWE-177apache gravitino
• 중간CVE-2026-6414CVSS 점수 5.92026. 4. 16.

  @fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as literal characters. This mismatch allows attackers to bypass route-based middleware or guards that pro

  CWE-177fastify fastify-static