CVE-2026-37070

CVE-2026-37070 Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint...

Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage

Summary In Nginx UI versions 2.5.0 through 2.5.x, the node-signature authentication path staged an attacker-controlled request body in a temporary file and synchronized it to disk before validating the body digest and cryptographic signature. An unauthenticated remote client that can reach the AP...

Contao: Cross-site request forgery in custom backend actions

RequestTokenListener is the only generic REQUESTTOKEN validator in Contao and it only runs on POST. On the GET side the guard is local and declarative, and it only fires when an act parameter is present. Every back end action dispatched through a different parameter therefore has no CSRF protecti...

yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

The Prometheus metrics middleware in pkg/server/server.go used r.Method directly as a label value on request counter and duration histogram metrics. Since the mux catch-all route matches any HTTP method, an unauthenticated attacker can send requests with arbitrary method strings e.g. curl -X "M1"...

Roxy

Roxy Minimal terminal-based HTTP/HTTPS intercepting proxy. https://github.com/user-attachments/assets/94f9c9ae-5842-4b19-9f5b-84dedb9430e6 Features · Installation · HTTPS support · Usage · How it works Overview Roxy is a lightweight intercepting proxy for HTTP and HTTPS with a terminal user...

EUVD-2026-95979

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUESTTOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the key parameter can therefore execute...

CVE-2026-107848 Contao: Cross-site request forgery in custom backend actions

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUESTTOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the key parameter can therefore execute...

CVE-2026-107848

The Contao Open Source CMS (versions 4.0.0 until 5.3.50 and 5.7.12) is vulnerable to a Cross-Site Request Forgery (CSRF) flaw. The root cause is that RequestTokenListener only validates the REQUEST_TOKEN for POST requests, while the declarative GET guard only activates when an act parameter is pr...

CVE-2022-41040

CVE-2022-41040 Microsoft Exchange vulnerable to server-side request forgery Payload : /autodiscover/autodiscover.json?@URL/&Email=autodiscover/autodiscover.json%3f@URL /autodiscover/autodiscover.json?@%d.v1.COLLABHERE/&Email=autodiscover/autodiscover.json%3f@%d.v1.COLLABHERE...

CVE-2025-50365_CSRF_DELETE_CATEGORY-phpgurukul-CVE

Project Name & Repo URL: Maid Hiring Management System using PHP and MySQL Vulnerability Type: Client Side Request Forgery Affected Versions: v1.0 💣Vulnerability Description: A Cross-Site Request Forgery CSRF vulnerability exists in the admin panel of PHPGurukul Hiring Management System, allowing...

CVE-2026-106216

A cross-site request forgery flaw was found in the ReadingList component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/518076654...

CVE-2026-107835

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.ParseCookies in internal/cookies/cookies.go handles boundary ASCII control characters and control-only or empty cookie names differently from several backend cookie parsers. An...

CVE-2002-0200

CVE-2002-0200 Cyberstop Web Server for Windows 0.1 allows remote attackers to cause a denial of service via an HTTP request for an MS-DOS device name. External reference at https://marc.info/?l=bugtraq&m=101174569103289&w=2 Author Alex Hernandez aka @alt3kx...

MGASA-2026-0479 Updated tomcat package fixes security vulnerabilities

OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. CVE-2026-73581 Cross-context authentication mix-up with Jakarta Authentication configured. CVE-2026-75973 Bypass of security constraints for WebSocket endpoints. CVE-2026-76183 Transfer-Encoding honored for...

CVE-2026-107937

A flaw was found in Apache CXF. A remote, unauthenticated attacker can cause a Denial of Service DoS by sending a crafted multipart request containing excessively large or repeated attachment headers. Because the parser fails to properly enforce size and count limits on multi-line and repeated...

CVE-2026-107282

A flaw was found in AsyncHttpClient. When an application performs request retries or failovers to a different host, the client fails to properly reset the original host's security and proxy context. Consequently, an unintended destination host can receive sensitive information, including...

CVE-2026-61642

A flaw was found in Squid. Due to improper handling of HTTP/1.1 Transfer-Encoding headers, a trusted client can perform an HTTP request smuggling attack, interfering with how web requests are processed. This vulnerability allows an attacker to bypass intermediate security controls. When an HTTP...

CVE-2026-75349

EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bounds read vulnerability in Connection Manager request parsing. This allows a remote attacker to cause a denial of service...

CVE-2026-66753-HTTP-Header-Injection-via-Unvalidated-CR-and-LF-in-Header-Values-tiny_http-

Security Advisory: HTTP Header Injection via Unvalidated CR and LF in Header Values tinyhttp Assigned CVE ID: CVE-2026-66753 Summary tinyhttp does not reject carriage return or line feed inside HTTP header values, in either direction. On the request side, readnextline ends a header line only on...

POC-CVE-2026-54121-Certighost

CertiGhost CVE-2026-54121 - AD CS Chase Fallback Exploit Toolkit Overview CertiGhost is a critical vulnerability CVSS 8.8 in Active Directory Certificate Services AD CS that allows a low-privileged domain user to impersonate a Domain Controller and achieve full domain compromise. CVE:...