CWE-174
8 published CVEs are weaknesses of this kind, as the records or NVD name it.
- 8Published CVEs8 of them scored
- 8Last 12 monthspublished in the last year
- 1Critical1 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-119674
mongorestore may restore encoded collection names into an unintended collection
MongoDB · Database Tools
Low2.1 - CVE-2026-118663
@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
honojs · node-server
Medium5.3 - CVE-2026-118655
Echo: Static Middleware Double-Unescape Path Traversal
labstack · echo
Medium5.9 - CVE-2026-111757
Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
honojs · hono
Medium5.3 - CVE-2026-109955
Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding
honojs · hono
Medium6.9 - CVE-2026-93903
LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case" of %252e%252e double decoding, letting…
litespeedtech · LiteSpeed Web Server
Critical9.4 - CVE-2026-92839
Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load arbitrary same-origin…
Canva · Canva
Medium4.3 - CVE-2026-75899
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
fast-uri · fast-uri
High7.5