Use of Non-Canonical URL Paths for Authorization Decisions

Every one of the 18 is a mark on the map. Named now: 1 to 18, most at risk first.

1. Hitachi Pentaho Business Analytics Server - Bypass AuthorizationCVE-2022-43939Hitachi Vantara · CVSS 8.6 · 92% likely

   Hitachi Vantara

2. Symfony HttpFoundation - Access Control Bypass via PATH_INFOCVE-2025-64500symfony · CVSS 7.3 · 1.4% likely

   Symfony

3. File Browser: Colliding username normalization gives two users the same home directoryCVE-2026-62685filebrowser · CVSS 8.1 · 0.6% likely

   Filebrowser

4. Envoy: Path normalization does not handle dot and dotdot segments with parametersCVE-2026-73551envoyproxy · CVSS 5.3 · 0.5% likely

   Envoyproxy

5. Cargo can be coerced to share credentials between registriesCVE-2026-5222Rust · CVSS 2.3 · 0.5% likely
6. In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its check by calling reque…CVE-2026-80515Eclipse Foundation · CVSS 8.9 · 0.5% likely

   Eclipse Foundation

7. In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is mishandled because userinfo can be placed in the authority component.CVE-2025-47241browser-use · CVSS 4 · 0.5% likely
8. A vulnerability has been identified in armeria versions prior to 1.43.0, where inconsistent request path normalization can allow unauthenticated attackers to bypass path-based acc…CVE-2026-121823LY Corporation · CVSS 8.7 · 0.4% likely

   LY Corporation

9. Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765CVE-2025-66202withastro · CVSS 6.5 · 0.3% likely

   Withastro

10. Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization MismatchCVE-2026-59731withastro · CVSS 8.2 · 0.3% likely

    Withastro

11. In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt J…CVE-2026-8384Eclipse Foundation · CVSS 5.3 · 0.3% likely

    Eclipse Foundation

12. Vault vulnerable to ACL deny bypass via trailing slashCVE-2026-93335HashiCorp · CVSS 6.5 · 0.3% likely

    HashiCorp

13. Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatchCVE-2026-94269Apache Software Foundation · CVSS 6.3 · 0.3% likely

    Apache

14. Use of Non-Canonical URL Paths for Authorization Decisions in Splunk SOARCVE-2026-76530Splunk · CVSS 8.8 · 0.3% likely

    Splunk

15. Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization Decisions vulnerability. An unauthenti…CVE-2026-71178Dell · CVSS 3.7 · 0.2% likely

    Dell

16. Sonos api.sonos.com through 2025-04-21, when the /login/v3/oauth endpoint is used, accepts a redirect_uri containing userinfo in the authority component, which is not consistent w…CVE-2025-43916Sonos · CVSS 3.4 · 0.2% likely

    Sonos

17. L7 intention authorization bypass via custom public listenerCVE-2026-15970HashiCorp · CVSS 4.2 · 0.2% likely

    HashiCorp

18. Aap-gateway: improper path validation in gateway allows credential exfiltrationCVE-2025-9909Red Hat · CVSS 6.7 · 0.2% likely

    Red Hat

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.