https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 17:43:53 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0641 certfr-2026-avi-0641 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0641 https://cve.radiocsirt.org/vuln/cleanstart-2026-be61221 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: opensearch-dashboards-fips</p> <p>Multiple security vulnerabilities affect the opensearch-dashboards-fips package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: opensearch-dashboards-fips</p> <p>Multiple security vulnerabilities affect the opensearch-dashboards-fips package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-be61221 https://cve.radiocsirt.org/vuln/euvd-2026-274627 EUVD-2026-274627 https://cve.radiocsirt.org/vuln/euvd-2026-274627 https://cve.radiocsirt.org/vuln/fkie_cve-2026-29045 <p>Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use(&#39;/admin/*&#39;, ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving to the intended filesystem path. This issue has been patched in version 4.12.4.</p> <p>Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use(&#39;/admin/*&#39;, ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving to the intended filesystem path. This issue has been patched in version 4.12.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-29045 https://cve.radiocsirt.org/vuln/ghsa-q5qw-h33p-qvwr <p><strong>Affected:</strong> npm: hono</p> <p>## Summary</p> <p>When using `serveStatic` together with route-based middleware protections (e.g. `app.use(&#39;/admin/*&#39;, ...)`), inconsistent URL decoding allowed protected static resources to be accessed without authorization.</p> <p>The router used `decodeURI`, while `serveStatic` used `decodeURIComponent`. This mismatch allowed paths containing encoded slashes (`%2F`) to bypass middleware protections while still resolving to the intended filesystem path.</p> <p>## Details</p> <p>The routing layer preserved `%2F` as a literal string, while `serveStatic` decoded it into `/` before resolving the file path.</p> <p>Example:</p> <p>Request: `/admin%2Fsecret.html`</p> <p>- Router sees: `/admin%2Fsecret.html` → does not match `/admin/*` - Static handler resolves: `/admin/secret.html`</p> <p>As a result, static files under the configured static root could be served without triggering route-based protections.</p> <p>This only affects applications that both:</p> <p>- Protect subpaths using route-based middleware, and - Serve files from the same static root using `serveStatic`.</p> <p>This does **not** allow access outside the static root and is **not** a path traversal vulnerability.</p> <p>## Impact</p> <p>An unauthenticated attacker could bypass route-based authorization for protected static resources by supplying paths containing encoded slashes.</p> <p>Applications relying solely on route-based middleware to protect static subpaths may have exposed those resources.</p> <p><strong>Affected:</strong> npm: hono</p> <p>## Summary</p> <p>When using `serveStatic` together with route-based middleware protections (e.g. `app.use(&#39;/admin/*&#39;, ...)`), inconsistent URL decoding allowed protected static resources to be accessed without authorization.</p> <p>The router used `decodeURI`, while `serveStatic` used `decodeURIComponent`. This mismatch allowed paths containing encoded slashes (`%2F`) to bypass middleware protections while still resolving to the intended filesystem path.</p> <p>## Details</p> <p>The routing layer preserved `%2F` as a literal string, while `serveStatic` decoded it into `/` before resolving the file path.</p> <p>Example:</p> <p>Request: `/admin%2Fsecret.html`</p> <p>- Router sees: `/admin%2Fsecret.html` → does not match `/admin/*` - Static handler resolves: `/admin/secret.html`</p> <p>As a result, static files under the configured static root could be served without triggering route-based protections.</p> <p>This only affects applications that both:</p> <p>- Protect subpaths using route-based middleware, and - Serve files from the same static root using `serveStatic`.</p> <p>This does **not** allow access outside the static root and is **not** a path traversal vulnerability.</p> <p>## Impact</p> <p>An unauthenticated attacker could bypass route-based authorization for protected static resources by supplying paths containing encoded slashes.</p> <p>Applications relying solely on route-based middleware to protect static subpaths may have exposed those resources.</p> https://cve.radiocsirt.org/vuln/ghsa-q5qw-h33p-qvwr https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0933 <p>Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen oder andere nicht näher bezeichnete Angriffe durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen oder andere nicht näher bezeichnete Angriffe durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0933