CWE-41

CWE-41 · 10 records · 4 with a public proof-of-concept

Records the NVD classes under CWE-41, highest CVSS first.

  1. HIGH 8.8CVE-2026-881362026-10-13

    Improper resolution of path equivalence in WebDAV allows an authorized attacker to execute code over a network.

    AI risk analysis on Exploit-DB.ai →

  2. HIGH 8.8CVE-2026-1084632026-10-13

    Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.

    AI risk analysis on Exploit-DB.ai →

  3. HIGH 8.8CVE-2026-1022172026-10-13

    Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network.

    AI risk analysis on Exploit-DB.ai →

  4. HIGH 8.1CVE-2026-1123432026-10-26

    Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can address a pr…

    AI risk analysis on Exploit-DB.ai →

  5. HIGH 7.8CVE-2026-701842026-10-13

    Improper resolution of path equivalence in Windows Backup Engine allows an authorized attacker to elevate privileges locally.

    AI risk analysis on Exploit-DB.ai →

  6. HIGH 7.7CVE-2026-1022312026-10-13

    Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

    AI risk analysis on Exploit-DB.ai →

  7. MEDIUM 6.5CVE-2026-119200public PoC2026-10-29

    Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-encoded dot segments before rendering a page while Nitro routing, server/middleware checks, and server route rules evaluate the unresolved pat…

    AI risk analysis on Exploit-DB.ai →

  8. MEDIUM 5.3CVE-2026-93709public PoC2026-09-22

    Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows ca…

    AI risk analysis on Exploit-DB.ai →

  9. LOW 3.7CVE-2026-110725public PoC2026-10-20

    fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are called with the non-default option reference set to …

    AI risk analysis on Exploit-DB.ai →

  10. LOW 3.7CVE-2026-110095public PoC2026-10-20

    fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize() and serialize() functions apply RFC 3986 dot-segment removal to the path of a relati…

    AI risk analysis on Exploit-DB.ai →