آخرین آسیب‌پذیری‌ها

Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability

Echo: Static Middleware Double-Unescape Path Traversal

Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization

Echo static file middleware route protection bypass via encoded dot-dot traversal

Kserve: kserve: server-side request forgery via malicious storageuri

Gearboy advisory / Gearsystem body: Unauthenticated network exposure of MCP HTTP tools

Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUI

Endatix: Blind second-order SSRF via anonymous form-submission file URLs (`SubmissionFileExtractor`)

Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration

Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob

Secret masking bypass in the environment tool in Strands Agents Tools

Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default

FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS

Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path

Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution

Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events

Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]

Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products

Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources

Samba: access control bypass via vfs_ceph_rgw case-insensitive open

Echo: X-Real-IP extractor trusts the header value instead of the sending peer

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests