agentprime: CWE-177

Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path

Wed, 28 Oct 2026 19:54:20 GMT

github.com/labstack/echo/v4 <4.16.0, fixed in 4.16.0. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths

Thu, 15 Oct 2026 20:15:17 GMT

@opennextjs/cloudflare >=0.3.0, <1.20.2, fixed in 1.20.2. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters

Mon, 05 Oct 2026 23:47:07 GMT

pymongo >=3.5.0, <4.18.2, fixed in 4.18.2. CVSS 8.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-76504: Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability

Wed, 30 Sep 2026 13:04:32 GMT

CVSS 9.8 (Critical). Critical: In CISA’s KEV catalogue since 30 Sept 2026: it is known to be exploited. CVSS score 9.8: 9.0 or more. CVSS score 9.8 (7.0 or more) and EPSS 0.39 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.

fast-uri vulnerable to host confusion via percent-encoded scheme normalization

Wed, 02 Sep 2026 15:41:53 GMT

fast-uri >=2.3.1, <2.4.5 || >=3.0.0, <3.1.6 || >=4.0.0, <4.1.3, fixed in 2.4.5, 3.1.6, 4.1.3. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)

Thu, 20 Aug 2026 21:34:58 GMT

github.com/axllent/mailpit >=1.29.0, <1.30.6, fixed in 1.30.6. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-15371: Velociraptor Stored XSS in URL column types

Tue, 18 Aug 2026 06:52:28 GMT

CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-59083: Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass

Tue, 14 Jul 2026 08:13:04 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino.

Mon, 13 Jul 2026 10:16:28 GMT

apache-gravitino >=1.0.0, <1.2.1, fixed in 1.2.1. CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by OSV. Not analysed by agentprime yet.

@fastify/static vulnerable to route guard bypass via encoded path separators

Thu, 16 Apr 2026 22:34:03 GMT

@fastify/static >=8.0.0, <9.1.1, fixed in 9.1.1. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Hono vulnerable to arbitrary file access via serveStatic vulnerability

Wed, 04 Mar 2026 19:48:00 GMT

hono <4.12.4, fixed in 4.12.4. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)

Tue, 20 Jan 2026 16:35:21 GMT

@fastify/express <4.0.3, fixed in 4.0.3. CVSS 8.4 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Fastify Middie Middleware Path Bypass

Tue, 20 Jan 2026 16:34:50 GMT

@fastify/middie <9.1.0, fixed in 9.1.0. CVSS 8.4 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Apache Linkis: Arbitrary File Read via Double URL Encoding Bypass

Mon, 19 Jan 2026 09:30:27 GMT

org.apache.linkis:linkis >=1.3.0, <1.8.0, fixed in 1.8.0. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-11990: Improper Handling of URL Encoding (Hex Encoding) in GitLab

Sat, 15 Nov 2025 08:03:49 GMT

CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-48866: QTS, QuTS hero

Fri, 06 Dec 2024 16:36:13 GMT

CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-23983: Access rules for PingAccess may be circumvented with URL-encoded characters

Mon, 11 Nov 2024 22:56:58 GMT

CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass

Tue, 05 Dec 2023 18:11:48 GMT

github.com/traefik/traefik/v2 <2.10.6, fixed in 2.10.6. CVSS 4.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2022-3854: A flaw was found in Ceph, relating to the URL processing on RGW backends.

Mon, 06 Mar 2023 00:00:00 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Keycloak vulnerable to path traversal via double URL encoding

Tue, 13 Dec 2022 19:44:56 GMT

org.keycloak:keycloak-parent <20.0.2, fixed in 20.0.2. CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2022-27780: The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a different URL usingthe wrong host name when it is later retrieved.F…

Wed, 01 Jun 2022 00:00:00 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

vercel/serve allows access to restricted files if filename is URL encoded.

Mon, 09 Aug 2021 22:24:26 GMT

serve <6.5.2, fixed in 6.5.2. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Path Traversal in superstatic

Fri, 27 Jul 2018 17:06:03 GMT

superstatic <5.0.2, fixed in 5.0.2. Published by the GitHub Advisory Database. Not analysed by agentprime yet.