CVE-2023-49606

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ CVE-2023-49606:...

CVE-2025-29927

🔍 CVE-2025-29927 - Next.js Middleware Bypass Detector This Python-based smart scanner helps detect the CVE-2025-29927 vulnerability in Next.js applications — a critical middleware bypass that allows attackers to skip authentication using a crafted HTTP header. 🧠 The tool identifies not only HTTP...

CVE-2026-66746-HTTP-Response-Splitting-via-Unvalidated-Response-Header-Values-rouille-

Security Advisory: HTTP Response Splitting via Unvalidated Response Header Values rouille Assigned CVE ID: CVE-2026-66746 Summary rouille writes response header values to the client without checking them for carriage return or line feed. An application that places attacker-influenced text into a...

ASP.NET Core Security Feature Bypass Vulnerability

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network...

tomcat-line-check

tomcat-line-check CVE-2026-24880 · GHSA-563x-q5rq-57qp —— Apache 那句 upgrade to version 11.0.20, 10.1.52 or 9.0.116 对你成不成立? 对多数人不成立,而且有四种不同的不成立方式。这个工具扫你的构件,告诉你是哪一种。 java -jar tomcat-line-check.jar /path/to/tomcat 解压部署的 Tomcat java -jar tomcat-line-check.jar app.war war java -jar...

CVE-2026-24733

CVE-2026-24733 What is CVE-2026-24733? Apache Tomcat incorrectly handled an HTTP/0.9-style HEAD request under certain security-constraint configurations. CVE-2026-24733 Defensive Verifier A lightweight, dependency-free Python security verifier for CVE-2026-24733 , an Apache Tomcat HTTP/0.9 HEAD...

CVE-2026-25089

🚨 CVE-2026-25089 - Critical OS Command Injection in FortiSandbox 📖 Overview CVE-2026-25089 is a critical OS Command Injection CWE-78 vulnerability affecting multiple Fortinet FortiSandbox deployments. An unauthenticated remote attacker can exploit this flaw by sending specially crafted HTTP...

DEBIAN-CVE-2026-109760

Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109760

Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109760

A mitigation bypass exists in the Networking: HTTP component of the Firefox web browser. This vulnerability was addressed in Firefox 158 and Firefox ESR 153.5 . Specific details regarding the underlying root cause or practical consequences are not provided in the available documents. No informati...

CVE-2026-109760

Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109760 Mitigation bypass in the Networking: HTTP component

Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

Retrofit-1

Retrofit Type-safe HTTP client for Android and Java by Square, Inc. For more information please see the website. Download Download the latest JAR or grab via Maven: com.squareup.retrofit2 retrofit 2.4.0 or Gradle: implementation 'com.squareup.retrofit2:retrofit:2.4.0' Snapshots of the development...

CVE-2023-44487-dos

CVE-2023-44487 HTTP/2 Rapid Reset There are some examples in this repo which are not tested completely to analyse the impact, but I just wanted to perform the concept of this attack starting many streams and immediately sending RSTSTREAM frame to avoid reaching MAXCONCURRENTSTREAMS. I use H2Space...

CVE-2026-8023

CVE-2026-8023 — Zephyr HTTP static-fs path traversal PoC Pre-auth path traversal in Zephyr's HTTP server static-fs handler subsys/net/lib/http when wildcard resource matching CONFIGHTTPSERVERRESOURCEWILDCARD=y is used with HTTPRESOURCETYPESTATICFS. Affects both HTTP/1.1 and HTTP/2. GHSA:...

CVE-2026-109245

A flaw was found in FreeRDP. This vulnerability leads to information disclosure because the internal HTTP client fails to verify Transport Layer Security TLS server certificates or hostnames. An on-path network attacker positioned between the client and identity provider can exploit this flaw by...

SECURITY-3314-3315

= SECURITY-3314/SECURITY-3315 Mitigation This repository documents mitigations preventing exploitation of SECURITY-3314 and SECURITY-3315 on affected instances. == Overview Access to the CLI needs to be disabled. Both of the following steps must be taken: Remove the CLI HTTP endpoint Disable the...

CVE-2021-42013

CVE-2021-42013 — PoC: Path Traversal + RCE via modcgi patch bypass For use only in controlled and own environments. Do not use against systems without authorization. Description PoC developed to demonstrate CVE-2021-42013 , present in Apache HTTP Server 2.4.50. This CVE is the bypass of the patch...

CVE-2025-8671

CVE-2025-8671 - PoC DoS lighttpd HTTP/2 Author : @abiyeenzo ⚠️ Warning This project is provided for educational purposes only. Running the PoC against third-party servers may constitute an illegal cyberattack and lead to criminal prosecution. Only use this script on your test environments or local...

CTF_WRITEUPS-TryHackMe-CVE-2021-41773-

CTFWRITEUPS-TryHackMe-CVE-2021-41773- CTFWRITEUPS/TryHackMe /CVE-2021-41773/ CVE-2021-41773/42013 A small explanation of an Apache path traversal bug and an incomplete fix Task 1: A Bit of Background... A Brief History On the 5th of October 2021, a CVE detailing a path traversal attack on Apache...