CWE-174 · 3 records
Double Decoding of the Same Data
CVEs in this class
3 records
| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
37Monitor | CVE-2026-93903No exploit | LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."litespeedtech · litespeed web server · CWE-174 | Critical9.4 | — | 0.3% | Sep 30, 2026 |
30Monitor | CVE-2026-75899No exploit | fast-uri vulnerable to server-side request forgery via repeated hostname percent-decodingopenjsf · fast-uri · CWE-174 | High7.5 | — | 0.2% | Aug 24, 2026 |
17Monitor | CVE-2026-92839No exploit | Canva Desktop before v1.125.0 performed double decoding in the deeplink handler.canva · canva · CWE-174 | Medium4.3 | — | 0.3% | Sep 17, 2026 |
- CVE-2026-9390337Monitor
LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."
CriticalCVSS 9.4No exploitEPSS 0%litespeedtech · litespeed web serverSep 30, 2026
- CVE-2026-7589930Monitor
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
HighCVSS 7.5No exploitEPSS 0%openjsf · fast-uriAug 24, 2026
- CVE-2026-9283917Monitor
Canva Desktop before v1.125.0 performed double decoding in the deeplink handler.
MediumCVSS 4.3No exploitEPSS 0%canva · canvaSep 17, 2026