CVE-2026-109360

The MONAI library (versions 0.4.0 before 1.6.1) is vulnerable to Remote Code Execution (RCE) when constructing SEResNet50 or other SENet models with pretrained=True. The root cause is the insecure unpickling of pretrained weights fetched over plaintext HTTP via the load_state_dict_from_url functi...

CVE-2026-109357 LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header

LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTEUSER is not forwarded, unauthenticated attackers can send a wildcar...

CVE-2026-109357 LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header

LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTEUSER is not forwarded, unauthenticated attackers can send a wildcar...

CVE-2026-109325 Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy

Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTEADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, an...

EUVD-2026-97627

Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTEADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, an...

CVE-2026-109309 SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path

SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to...

EUVD-2026-97611

SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to...

CVE-2026-109309

SiYuan versions v3.7.0 before v3.8.6 are vulnerable to an absolute path traversal vulnerability within the kernel's private plugin HTTP server. The flaw occurs because a kernel plugin handler's ResponseFile.Path is passed to gin's Context.File without proper validation. An attacker capable of sup...

CVE-2026-109309 SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path

SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to...

CVE-2026-23918-Double-free-Apache-httpd-mod_http2

CVE-2026-23918 - Apache httpd modhttp2 PoC This repository contains a proof-of-concept implementation written in Go for a pre-authentication memory corruption scenario affecting Apache httpd with modhttp2. The code in this repository demonstrates a spray-and-trigger approach against a vulnerable...

CVE-2021-3831

PHP Exploit CVE-2021-3831 Script Overview This PHP script is designed to interact with a target website by generating specific MD5 hashes and making HTTP requests to exploit potential vulnerabilities. It is intended for educational purposes and should only be used in environments where you have...

CVE-2025-32375

Setup for the vulnerable version. Start the vulnerable container: docker compose up Create a listener e.g. ncat: ncat -klnv 1337 Run the exploit: python3 exploit.py You should receive an HTTP request in the ncat window with the contents of the OS command id by default if everything worked as...

CVE-2019-3929

CVE-2019-3929 Crestron/Barco/Extron/InFocus/TeqAV Remote Command Injection CVE-2019-3929 Metasploit Module Per Tenable's description: "A remote, unauthenticated attacker can execute operating system commands as root via crafted requests to the HTTP endpoint filetransfer.cgi. This vulnerability...

CVE-2024-38472

Creating a Remote Code Execution RCE Metasploit module for the SSRF vulnerability CVE-2024-38472 in Apache HTTP Server on Windows is challenging because SSRF itself doesn't directly result in RCE. However, SSRF can often be a step toward achieving RCE, especially if you can use it to interact wit...

CVE-2024-38475

CVE-2024-38475 POC Credit : All credit to this guy: https://blog.orange.tw/ and https://x.com/orange8361 all i did was make a POC script from his research. Introduction : Improper escaping of output in modrewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesyste...

cve-2021-38647

cve-2021-38647 A PoC exploit for CVE-2021-38647 RCE in OMI. Execute a single command using ExecuteShellCommand on the default HTTPS port: python cve-2021-38647.py -s 10.10.10.10 shell id Execute a single command using ExecuteShellCommand on the default HTTP port: python cve-2021-38647.py...

CVE-2024-38473

Proof of Concept PoC for Encoding Problem in modproxy in Apache HTTP Server This repository contains Proof of Concept PoC scripts for demonstrating an encoding problem in the modproxy module of Apache HTTP Server versions 2.4.59 and earlier. This vulnerability allows request URLs with incorrect...

http-vuln-CVE-2022-41082

UPDATED VERSION ALLOWS FOR HTTPS CHECK AS WELL exchange-vuln-check.nse FOR HTTP: nmap -p80 --script exchange-vuln-check.nse FOR HTTPS: nmap -p443 --script exchange-vuln-check.nse SAVE RESULTS IN A FILE nmap -p80 --script exchange-vuln-check.nse -oN results.txt http-vuln-CVE-2022-41082 Microsoft...

Security update for libsoup

This update for libsoup fixes the following issues: CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak bsc1271448. CVE-2026-102555: Heap buffer overflow via uninitialized length in data-URI base64 decoding bsc1283299. CVE-2026-102556: Heap...

SUSE-SU-2026:4631-1 Security update for libsoup

This update for libsoup fixes the following issues: - CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak bsc1271448. - CVE-2026-102555: Heap buffer overflow via uninitialized length in data-URI base64 decoding bsc1283299. - CVE-2026-102556:...