CWE-174

CWE-174 · 5 records · 4 with a public proof-of-concept

Records the NVD classes under CWE-174, highest CVSS first.

  1. MEDIUM 5.9CVE-2026-118655public PoC2026-10-28

    Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guard…

    AI risk analysis on Exploit-DB.ai →

  2. MEDIUM 5.3CVE-2026-118663public PoC2026-10-28

    @hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evalua…

    AI risk analysis on Exploit-DB.ai →

  3. MEDIUM 5.3CVE-2026-111757public PoC2026-10-19

    Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. …

    AI risk analysis on Exploit-DB.ai →

  4. MEDIUM 5.3CVE-2026-109955public PoC2026-10-13

    Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding. Attackers can send malformed percent-encoded paths that the router mat…

    AI risk analysis on Exploit-DB.ai →

  5. UNSCOREDCVE-2026-939032026-09-30

    LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."

    AI risk analysis on Exploit-DB.ai →