Advisories · Weakness
CWE-174.
Every Advisory and CVE whose sources give the weakness CWE-174, newest first.
- CVSS 2.1 Low
mongorestore may restore encoded collection names into an unintended collection
- MongoDB Database Tools
- CWE-174
- CVSS 5.3 Medium
@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
- CWE-174
>=1.19.10, <2.1.3 · fixed in 2.1.3
GHSA-rmxm-3fg6-px4f · CVE-2026-118663 - CVSS 5.9 Medium
Echo has a Static Middleware Double-Unescape Path Traversal
- CWE-174
<4.15.3 · fixed in 4.15.3
GHSA-xwq5-6cqp-vx96 · CVE-2026-118655 - CVSS 6.9 Medium
Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
- CWE-174
>=4.12.4, <4.13.11 · fixed in 4.13.11
GHSA-5r4p-p66f-jhc7 · CVE-2026-109955 - CVSS 9.4 CriticalCritical · CVSS 9+
litespeedtech LiteSpeed Web Server: LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL…
- litespeedtech LiteSpeed Web Server
- CWE-174
- CVSS 4.3 Medium
Canva Desktop before v1.125.0 performed double decoding in the deeplink handler.
- Canva
- CWE-174
- CVSS 7.5 High
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
- Server-side request forgery (SSRF)
- CWE-174
>=2.4.1, <2.4.5 || >=3.1.2, <3.1.6 || >=4.0.0, <4.1.3 · fixed in 2.4.5, 3.1.6, 4.1.3
GHSA-fph4-wmhf-6fwf · CVE-2026-75899