CVE-2026-112006

A flaw was found in opentelemetry-exporter-otlp-proto-http. When certificate configuration environment variables are set to empty strings, Transport Layer Security TLS verification is unintentionally disabled. A man-in-the-middle attacker can exploit this improper certificate validation to...

cve-2022-22963

Spring Cloud Function SpEL - cve-2022-22963 Build $ git clone https://github.com/twseptian/cve-2022-22963.git $ cd cve-2022-22963 $ docker build . -t spring-spel-0day $ docker run -p 8080:8080 --name spring-spel-0day spring-spel-0day Payload...

CVE-2021-41773

CVE-2021-41773 A Zeek package which raises notices for Path Traversal/RCE in Apache HTTP Server 2.4.49 CVE-2021-41773 and 2.4.50 CVE-2021-42013 References https://httpd.apache.org/security/vulnerabilities24.htmlCVE-2021-41773 https://httpd.apache.org/security/vulnerabilities24.htmlCVE-2021-42013...

CVE-2024-29973

CVE-2024-29973 - Remote Command Injection Vulnerability Description CVE-2024-29973 is a critical vulnerability found in certain Zyxel networking devices. This vulnerability allows an unauthenticated attacker to execute arbitrary commands on the target device by exploiting improper input validatio...

CVE-2026-112006

The opentelemetry-exporter-otlp-proto-http library (versions 1.5.0 before 1.45.0) is vulnerable to improper certificate validation . The root cause is that TLS verification is disabled when the OTEL_EXPORTER_OTLP_CERTIFICATE variables are provided as empty strings. This allows man-in-the-middle a...

CVE-2026-112006

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...

CVE-2026-112006 OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...

EUVD-2026-103459

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...

CVE-2026-112006 OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...

CVE-2026-112006

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...

CVE-2026-111999 Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver

Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/ns/eventbus/name/events or legacy...

EUVD-2026-103452

Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/ns/eventbus/name/events or legacy...

CVE-2026-111999 Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver

Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/ns/eventbus/name/events or legacy...

CVE-2026-111999

Versions 0.8.0 through 0.9.0 of Vanus are affected by a missing authentication vulnerability in the gateway CloudEvents HTTP receiver . This flaw allows unauthenticated remote attackers to bypass token authentication and authPublish checks by sending forged CloudEvents to the /namespaces/{ns}/eve...

Exploit for CVE-2026-80343

CVE-2026-80343 — camel-netty-http: security-constraint case-se...

Fastgate

TLDR This is a brief report of a vulnerability CVE-2019-12489 discovered playing around with a Fastgate modem/router of Fastweb and Ghidra. The vulnerability allow the execution of a command injection through an http request and can be used to enable an SSH shell. Firmware collection and extracti...

CVE-2017-5638

CVE-2017-5638 The Apache Struts 2 versions 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 have a flaw in their Jakarta Multipart parser. This flaw causes incorrect handling of exceptions and generation of error messages when attempting to upload files. As a result, attackers can remotely execute...

MadeYouReset_Tester

MadeYouReset Checker A lightweight Python script to detect whether a web server is potentially vulnerable to the MadeYouReset HTTP/2 denial-of-service vulnerability — tracked as CVE-2025-8671 CVSS 7.5 High. Background MadeYouReset is an HTTP/2 DoS vulnerability disclosed in August 2025 by...

FakeAuth

FakeAuth FakeAuth is a tool that prompts for user credentials and exfiltrates it with HTTP protocol. Inspired by following projects 1. hlldz's PICKL3 https://github.com/hlldz/pickl3 Expect dirty code and some bugs ; Installation No special requirements Usage v1.01 Usage: FakeAuth.exe Example:...

CVE-2020-14882

CVE-2020-14882 CVE-2020-14882 Description Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Console. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows...