CWE-177 · weakness in Injection and Smuggling
Improper Handling of URL Encoding (Hex Encoding)
19 CVEs · 1 exploited
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 1
Every one of the 19 is a mark on the map. Named now: 1 to 19, most at risk first.
- Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability
- The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it…
- serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded.
- Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.
- Hono: Arbitrary file access via serveStatic vulnerability
- A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by providing a null URL to crash the RGW, causing a denial of…
- Fastify Middie Middleware Path Bypass
- Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass
- OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths
- Access rules for PingAccess may be circumvented with URL-encoded characters
- @fastify/static vulnerable to route guard bypass via encoded path separators
- QTS, QuTS hero
- Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path
- Velociraptor Stored XSS in URL column types
- Connection redirection via percent-encoded delimiter injection in connection string hosts
- @fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)
- Improper Handling of URL Encoding (Hex Encoding) in GitLab
- fast-uri vulnerable to host confusion via percent-encoded scheme normalization
- Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.