CWE-177 · 17 records

Improper Handling of URL Encoding (Hex Encoding)

CVEs in this class

17 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
70This week	CVE-2026-76504Weaponized	Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerabilitycisco · catalyst sd-wan manager · CWE-177 Pre-auth Auth bypass	Critical9.8	KEV	1.8%	Sep 30, 2026
39Monitor	CVE-2026-29045No exploit	Hono: Arbitrary file access via serveStatic vulnerabilityhono · hono · CWE-177 Pre-auth	Critical9.8	—	0.6%	Mar 4, 2026
36Monitor	CVE-2026-41041No exploit	Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintendedapache · gravitino · CWE-177 Pre-auth Path traversal	Critical9.1	—	0.6%	Jul 13, 2026
36Monitor	CVE-2026-59083No exploit	Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypassapache · tomcat · CWE-177 Pre-auth	Critical9.1	—	0.4%	Jul 14, 2026
35Monitor	CVE-2026-22031No exploit	Fastify Middie Middleware Path Bypassfastify · fastify\/middie · CWE-177	High8.8	—	0.5%	Jan 19, 2026
33Monitor	CVE-2026-22037No exploit	@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)fastify · fastify-express · CWE-177	High8.4	—	0.4%	Jan 19, 2026
33Monitor	CVE-2026-96748No exploit	Connection redirection via percent-encoded delimiter injection in connection string hostsmongodb · python driver · CWE-177 Pre-auth	High8.3	—	0.3%	Sep 24, 2026
32Monitor	CVE-2026-15371No exploit	Velociraptor Stored XSS in URL column typesrapid7 · velociraptor · CWE-177 XSS	High8.1	—	0.4%	Aug 18, 2026
32Monitor	GHSA-wm77-q74p-5763No exploit	Path Traversal in superstaticnpm · superstatic · CWE-177 Path traversal	High8.0	—	—	Jul 27, 2018
31Monitor	CVE-2022-27780No exploit	The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *differenthaxx · curl · CWE-177 Pre-auth	High7.5	—	2.5%	Jun 2, 2022
30Monitor	CVE-2026-76172No exploit	fast-uri vulnerable to host confusion via percent-encoded scheme normalizationopenjsf · fast-uri · CWE-177 Pre-auth SSRF	High7.5	—	0.2%	Aug 24, 2026
26Monitor	CVE-2022-3854No exploit	A flaw was found in Ceph, relating to the URL processing on RGW backends.redhat · ceph storage · CWE-177 Pre-auth Denial of service	Medium6.5	—	0.6%	Mar 6, 2023
26Monitor	CVE-2026-67448No exploit	Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)axllent · mailpit · CWE-177 Pre-auth	Medium6.5	—	0.2%	Aug 20, 2026
23Monitor	CVE-2026-6414No exploit	@fastify/static vulnerable to route guard bypass via encoded path separatorsfastify · fastify-static · CWE-177 Pre-auth	Medium5.9	—	0.4%	Apr 16, 2026
21Monitor	CVE-2018-3718No exploit	serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded.zeit · serve · CWE-177 Pre-auth	Medium5.3	—	1.3%	Jun 6, 2018
14Monitor	CVE-2025-11990No exploit	Improper Handling of URL Encoding (Hex Encoding) in GitLabgitlab · gitlab · CWE-177 CSRF	Low3.5	—	0.3%	Nov 15, 2025
9Monitor	CVE-2024-48866No exploit	An improper handling of URL encoding (Hex Encoding) vulnerability has been reported to affect several QNAP operating system versions.qnap · qts · CWE-177 Pre-auth	Low2.3	—	0.4%	Dec 6, 2024

CVE-2026-76504
70This week
Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability
CriticalCVSS 9.8KEVWeaponizedEPSS 2%
- Pre-auth
- Auth bypass
cisco · catalyst sd-wan managerSep 30, 2026
CVE-2026-29045
39Monitor
Hono: Arbitrary file access via serveStatic vulnerability
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
hono · honoMar 4, 2026
CVE-2026-41041
36Monitor
Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended
CriticalCVSS 9.1No exploitEPSS 1%
- Pre-auth
- Path traversal
apache · gravitinoJul 13, 2026
CVE-2026-59083
36Monitor
Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
apache · tomcatJul 14, 2026
CVE-2026-22031
35Monitor
Fastify Middie Middleware Path Bypass
HighCVSS 8.8No exploitEPSS 1%
fastify · fastify\/middieJan 19, 2026
CVE-2026-22037
33Monitor
@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)
HighCVSS 8.4No exploitEPSS 0%
fastify · fastify-expressJan 19, 2026
CVE-2026-96748
33Monitor
Connection redirection via percent-encoded delimiter injection in connection string hosts
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
mongodb · python driverSep 24, 2026
CVE-2026-15371
32Monitor
Velociraptor Stored XSS in URL column types
HighCVSS 8.1No exploitEPSS 0%
- XSS
rapid7 · velociraptorAug 18, 2026
GHSA-wm77-q74p-5763
32Monitor
Path Traversal in superstatic
HighCVSS 8.0No exploit
- Path traversal
npm · superstaticJul 27, 2018
CVE-2022-27780
31Monitor
The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different
HighCVSS 7.5No exploitEPSS 2%
- Pre-auth
haxx · curlJun 2, 2022
CVE-2026-76172
30Monitor
fast-uri vulnerable to host confusion via percent-encoded scheme normalization
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SSRF
openjsf · fast-uriAug 24, 2026
CVE-2022-3854
26Monitor
A flaw was found in Ceph, relating to the URL processing on RGW backends.
MediumCVSS 6.5No exploitEPSS 1%
- Pre-auth
- Denial of service
redhat · ceph storageMar 6, 2023
CVE-2026-67448
26Monitor
Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
axllent · mailpitAug 20, 2026
CVE-2026-6414
23Monitor
@fastify/static vulnerable to route guard bypass via encoded path separators
MediumCVSS 5.9No exploitEPSS 0%
- Pre-auth
fastify · fastify-staticApr 16, 2026
CVE-2018-3718
21Monitor
serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded.
MediumCVSS 5.3No exploitEPSS 1%
- Pre-auth
zeit · serveJun 6, 2018
CVE-2025-11990
14Monitor
Improper Handling of URL Encoding (Hex Encoding) in GitLab
LowCVSS 3.5No exploitEPSS 0%
- CSRF
gitlab · gitlabNov 15, 2025
CVE-2024-48866
9Monitor
An improper handling of URL encoding (Hex Encoding) vulnerability has been reported to affect several QNAP operating system versions.
LowCVSS 2.3No exploitEPSS 0%
- Pre-auth
qnap · qtsDec 6, 2024

All vulnerability classes