CVE-2026-75601

The record

Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to retrieve Prometheus metrics that disclose virtual host names, request volumes, error rates, latency distributions, and active connections. This issue is fixed in version 2.44.0.

Affected packages

Related vulnerabilities

• CVE-2026-114636 Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes… CWE-306
• CVE-2026-112104 A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. CWE-306
• CVE-2026-53714 Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or… CWE-306
• CVE-2026-89261 MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search… CWE-306
• CVE-2026-89250 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an… CWE-306
• CVE-2026-89176 WeenyGenius, a computer lab management system developed by Howyar Technologies, has a… CWE-306
• CVE-2026-88285 GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without… CWE-306
• CVE-2026-87924 A security vulnerability has been detected in Rizwan17 inventory-management-system up to… CWE-306