Search Vulnerabilities

fast-uri vulnerable to host confusion via literal backslash authority delimiter

Parameter smuggling in @hapi/content header parser allows upload-filter bypass via duplicate parameters

Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch

Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification

Capgo - Cross-Tenant Preview Namespace Collision via Non-Bijective Underscore Decoding

Elysia: Inefficient Algorithmic Complexity and Interpretation Conflict

guzzlehttp/psr7: Host Confusion via Weak URI Host Validation

@fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values

fast-uri vulnerable to host confusion via failed IDN canonicalization

Python-Multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters

Python-Multipart: Semicolon treated as querystring field separator enables parameter smuggling

node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)

Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing

Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring

TYPO3 HTML Sanitizer allows Cross-Site Scripting

LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body

SSRF allowlist bypass via percent-encoded host in hackney

authentik: SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncation

Flight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/core

Next.js: Cache poisoning in React Server Component responses