CVE Vulnerability Catalog

In the Echo Go web framework prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path separator pair. When AddTrailingSlash or RemoveTrailingSlash is configured with a redirect status, a slash, TAB, separator path form can evade the guard, be emitted in the Location header, and be normalized by a browser into an attacker-controlled host.

The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to arbitrary command execution on the server. An attacker can execute commands with the privileges of the product's runtime account.

In WSO2 Identity Server deployments with a case-insensitive user store and a case-sensitive database, mismatches in username case handling can occur. OAuth token revocation operations fail to correctly identify mixed-case usernames, preventing tokens from being invalidated.

Prior to version 0.1.4, FearlessCMS contains five debug/test PHP scripts under admin/ that perform privileged operations without authentication, CSRF protection, or adequate path validation. On PHP's built-in server (including the default Docker deployment), the /./admin/ path bypasses the login gate, enabling arbitrary .md writes, directory enumeration, stored/reflected XSS, and disk exhaustion.

Gearsystem's optional --mcp-http mode accepts unauthenticated MCP requests from any reachable network peer despite localhost-only documentation. The socket binds INADDR_ANY (usually port 7777), and POST /mcp requests reach dispatch without Authorization, Host, or Origin checks.

In Endatix before 0.7.0, the anonymous POST /forms/{formId}/submissions endpoint stores attacker-controlled JsonData that may contain a file object with an HTTP/HTTPS URL. When a staff member with submissions.view permission triggers file retrieval, the server performs a GET request without validating the destination URL, enabling second-order SSRF to internal services, cloud metadata, and loopback addresses.

In Ember before 1.4.2, interactive TUI row formatters pass Caddy access-log fields, especially the request URI, through fitCellLeft without neutralizing terminal escape or control sequences. An unauthenticated client can place ANSI, OSC, or CSI bytes in an HTTP request that, after decoding, reach os.Stdout and are interpreted by the operator's terminal.

When the allowed_scopes configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. As a result, an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows.

In KServe, a namespace-scoped user with create/update permissions on InferenceService resources can supply a malicious storageUri. This SSRF vulnerability lets the storage-initializer init container issue arbitrary outbound HTTP/HTTPS requests from inside the cluster.

The authentication endpoint generates an error message that reflects request data without sufficient sanitization or encoding, allowing an attacker to inject malicious scripts executed in the victim's browser (reflected XSS).

In Echo before 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can be reconstructed before filesystem resolution, reaching a file under a guarded route when static middleware is registered globally.

In Echo before 4.16.0 and 5.4.0, static file handlers can normalize dot segments after route matching and serve a file through a public static route even though the direct path is protected by route-level middleware. This is an incomplete fix for CVE-2026-55677.

In Echo from 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP when Echo.IPExtractor is unset, and the default RateLimiter uses that result as the client identifier. An attacker can rotate forwarded-address values to obtain new rate-limit buckets and bypass IP-based throttling.

In Echo before 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response. A route passing attacker-controlled input as the callback can return executable script syntax, enabling reflected cross-site scripting.

In Echo from 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can thus make upstream services receive a spoofed client address.

In the Echo Go web framework before 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from the router. The router matches the still-encoded path while the static handler uses the decoded URL.Path, potentially exposing files.

In the Echo Go web framework prior to 4.16.0 and 5.4.0, the MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain, route selection retains the original state-changing POST handler but the override changes the method before CSRF evaluates it, causing both token validation and Sec-Fetch-Site checks to be skipped. A cross-site exploit requires an authenticated victim and an override value controllable by a browser-submitted request, such as the form getter used by the advisory reproducer; the default X-HTTP-Method-Override header getter is not settable by a cross-site form.

In ai-gateway-payload-processing, an authenticated remote attacker can specify another tenant's model identifier in the request body or header. The service does not verify authorization before retrieving credentials from the shared store, so it injects the target tenant's API keys into the request.

Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 might allow remote actors to obtain the agent host's environment variables in cleartext, including cloud credentials and API keys, via a crafted prompt that disables the tool's secret masking. To remediate this issue, users should upgrade to version 0.8.6 or later and rotate any credentials that were present in the environment of agents that loaded the environment tool.