CVE-2026-126349

Addressable display_uri can show misleading hosts containing bidi and invisible characters

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, Addressable::IDNA.to_unicode can decode Punycode labels that contain bidirectional controls, zero-width characters, control characters, or other default-ignorable format characters. Addressable::URI#display_uri can consequently show a reordered or visually indistinguishable hostname even though host, normalized_host, and network connections use the original encoded hostname. The pure-Ruby backend accepts the full prohibited set, while the native libidn backend is affected from 2.5.2 for characters added after Unicode 3.2. This issue is fixed in version 2.9.1.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-93990

Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Libexpat Libexpat Project

Products

Expat Libexpat

CVE-2026-62374

SD JWT JS: Tampered disclosures silently dropped instead of rejected

SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification. In version 0.19.0 and earlier, `@sd-jwt/decode`, also used by `@sd-jwt/core`, silently drops a tampered Disclosure whose digest no longer matches the Issuer-signed `_sd` array and returns a reduced claim set, reporting success while the Issuer signature remains valid. Both a tampered Disclosure that remains valid JSON and a Disclosure containing invalid UTF-8 bytes reach this silent-drop behavior. In the latter case, the `TextDecoder / Buffer` decoding path substitutes U+FFFD replacement characters, recovering syntactically valid disclosure data instead of rejecting the malformed input. This violates RFC 9901 section 7.1 step 5, which requires rejection of unreferenced Disclosures, and section 7.1 step 3 / section 4.2.1, which require rejection of invalid Disclosures. A malicious holder can exploit this omission primitive, including through `SDJwtInstance.verify()` when key binding is required. An on-path attacker can also tamper with a Disclosure when the relying party does not enforce key binding; enforced key binding rejects on-path tampering because it invalidates the KB-JWT `sd_hash` binding. If the relying party defaults to allowing access when a constraining age, role, or restriction claim is absent, the silent claim reduction can change an authorization decision without an error. This issue is fixed in `@sd-jwt/core` version 0.20.0; no patched version of the standalone `@sd-jwt/decode` package is identified.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Openwallet-foundation

Products

Sd-jwt/core Sd-jwt/decode

CVE-2026-116542

Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding

Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello server_name to confuse SNI-based certificate selection, access decisions, and logging.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Netty

Products

Netty-tcnative Netty-tcnative-boringssl-static

CVE-2026-110674

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv. With allow_barekey, which relaxed enables, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes, so a repeated key escapes the duplicate-key check and replaces the earlier value. From 4.41, under dupkeys_as_arrayref, a bare repeat replaces the array that collects a key's values with a plain value, and the next quoted repeat pushes onto that value as if it were an array. A JSON integer there is dereferenced as a pointer. Untrusted JSON decoded with relaxed and dupkeys_as_arrayref can crash the process or dereference an address chosen by a JSON number.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Rurban

Products

Cpanel::json::xs

CVE-2026-110687

Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp

Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp. canonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encoder writes out as Latin-1 characters. A byte-string key whose bytes are valid UTF-8 is sorted out of order, and two keys that encode differently can compare equal and are left in hash order. The same data can encode to different canonical documents across processes.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Rurban

Products

Cpanel::json::xs

CVE-2026-114114

Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters

Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with non-ASCII identifiers that NFKC-normalize to ASCII, or an invisible byte-order mark, can silently substitute addresses, integers or other constants in compiled code.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Vyperlang

Products

Vyper

CVE-2026-89074

MOVEit Transfer Email MFA Bypass

Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Moveit Transfer

CVE-2025-71316

SQLite sqldiff remote code execution via argument injection

SQLite 'sqldiff.exe' does not securely handle the way the Microsoft Windows C runtime converts Unicode characters to ANSI codepages. An attacker could use the '-L' option to load an arbitrary DLL with a crafted command line argument string that results in command line file arguments being misinterpreted as command line options. Fixed on or around 2025-12-26.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Sqlite

Products

Sqlite

CVE-2026-105241

Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch

Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net. Content that the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, made the write throw. Every buffered event in the batch was discarded, not only the one carrying the content, and a truncated mail could be left in the pickup directory. A party whose data reaches a log message could suppress the records of other events. Only applications that use SmtpPickupDirAppender are affected. This issue affects Apache log4net: from 1.2.9 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Log4net

CVE-2026-19954

Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names

Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names. pwhois encodes each non-ASCII label directly using Net::IDN::Punycode and prepends xn--. Apart from lowercasing ASCII and Cyrillic letters, it skips the IDNA mapping and normalization steps, so a label with other uppercase letters, or not in NFC, encodes to a different A-label than its IDNA form. For example, a label of U+00C9 followed by "cole" encodes to "xn--cole-pka" rather than "xn--cole-9oa". The Net::Whois::Raw library modules are not affected.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Perl

Products

Net::whois::raw

CVE-2026-86105

Fireware OS Improper Authorization in Access Portal Reverse Proxy

An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted request for a different resource which they are authorized to access.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Fireware Fireware Os

CVE-2026-93751

uri-js through 4.4.1 Improper UTF-8 Decoding via pctDecChars

uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars() that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequences that downstream consumers process without filtering.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Garycourt

Products

Uri-js

CVE-2026-81869

OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Opentelemetry

Products

Opentelemetry-go

CVE-2026-14978

Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Hashicorp

Products

Go-slug Go Slug

CVE-2026-59890

setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Python

Products

Setuptools

CVE-2026-48618

nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

CVSS 3.1 · 6.5 Medium EPSS 3.1% KEV · Not listed

Vendors

Nodejs Redhat

Products

Node.js Nodejs Hummingbird

CVE-2026-49401

Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system enforces filesystem and execution restrictions by comparing the requested path against the path supplied to --deny-read, --deny-write, --deny-run, or --deny-ffi. On macOS, that comparison was done at the raw-byte level while the APFS filesystem treats different Unicode spellings of the same name as the same file. That means a program could reach a denied path by spelling it differently than the deny rule. This vulnerability is fixed in 2.7.14.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Apple Deno

Products

Macos Deno

CVE-2026-45135

Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files

Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transport's splitPos() in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treating a non-.php (or other configured split_path extension) file as a script. In any deployment where the attacker can place content into a file served via FastCGI (uploads, file storage, etc.), this can be escalated to remote code execution by crafting a URL whose path triggers either flaw. This vulnerability is fixed in 2.11.3.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Caddyserver

Products

Caddy

CVE-2023-24540

Improper handling of JavaScript whitespace in html/template

Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.

CVSS 3.1 · 9.8 Critical EPSS 1.6% KEV · Not listed

Vendors

Golang Redhat

Products

Go Acm Advanced Cluster Security and 17 more