CVE-2026-49099

CVE-2026-49099 — camel-salesforce sObjectQuery Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel Quarkus|...

CVE-2026-48206

CVE-2026-48206 — Inyección de cabecera IssueKey en camel-jira Reproductores de prueba de concepto ejecutables para la misma vulnerabilidad de Apache Camel, uno por entorno de ejecución: Entorno de ejecución| Directorio| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 +...

CVE-2024-38828

CVE-2024-38828 漏洞 描述 该测试检查在存在与不存在 CVE-2024-38828 漏洞时 Spring Framework 的行为/反应。 在 ByteArrayHttpMessageConverter 中，会根据请求头 Content-Length 在 ByteArrayOutputStream 中分配内存，这可能与实际为 0 字节的请求体不符。当此类请求急剧增加时（DoS），内存使用效率低下，GC 清理频繁出现，应用开始卡顿。我将展示如何实现/修复以及相关指标。 漏洞描述 CVE-2024-38828 是 Spring Framework...

CVE-2024-40324

CVE-2024-40324 描述 E-Staff v5.1 中存在一个 CRLF 注入漏洞，攻击者可以在输入字段中插入回车CR和换行LF字符，导致 HTTP 响应拆分和头部操纵。 漏洞类型 CRLF 产品供应商 E-Staff 受影响产品代码库 E-Staff 5.1 受影响组件 HTTP 头部 攻击类型 远程 影响：代码执行 可能导致任意头部注入、缓存中毒、会话劫持、跨站脚本XSS及其他利用。 发现者 Aleksey Vistorobskiy 攻击向量 攻击者可以在输入字段中插入 CRLF 字符，操纵 HTTP 头部。例如，向 HTTP 头部注入 CRLF 可能导致 HTTP 响应拆...

CVE-2026-100862

heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values returned in cleartext by GET /api/workflows/id and persisted unsanitized into execution history, MCP API keys stored a...

CVE-2026-100837

Contrast Edgeless Systems through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration in the imagepuller. Config.registryFor strips a single trailing dot and then uses strings.HasSuffixhostname, fqdn without requiring a DNS label boundary, so a registry entry such...

CVE-2026-100724

http4k Maven package org.http4k:http4k-core before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring Contains matching on the Host header by default in reverseProxy and reverseProxyRouting when dispatching to configured virtual hosts. If these functions are deployed as a public-facing inbound HTTP...

CVE-2020-25613

POC POST / HTTP/1.1 Host: 127.0.0.1:1080 Content-Type: text/html Content-Length: 129 Connection: keep-alive Transfer-Encoding: 0xb chunked 1 A 0 POST /flag HTTP/1.1 Host: 127.0.0.1:1080 Content-Length: 180 Connection: keep-alive Content-Type: text/html URI:...

Jenkins build-metrics 1.3 - Cross-Site Scripting

Jenkins build-metrics 1.3 is vulnerable to a reflected cross-site scripting vulnerability that allows attackers to inject arbitrary HTML and JavaScript into the web pages the plugin provides. id: CVE-2019-10475 info: name: Jenkins build-metrics 1.3 - Cross-Site Scripting author: madrobot severity...

Eclipse Jetty <9.2.9.v20150224 - Sensitive Information Leakage

Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header. id: CVE-2015-2080 info: name: Eclipse Jetty 9.2.9.v20150224 - Sensitive Information Leakage author: pikpikcu severity: high description: Eclip...

CVE-2026-100837 Edgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix Matching

Contrast Edgeless Systems through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration in the imagepuller. Config.registryFor strips a single trailing dot and then uses strings.HasSuffixhostname, fqdn without requiring a DNS label boundary, so a registry entry such...

CVE-2026-100837 Edgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix Matching

Contrast Edgeless Systems through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration in the imagepuller. Config.registryFor strips a single trailing dot and then uses strings.HasSuffixhostname, fqdn without requiring a DNS label boundary, so a registry entry such...

EUVD-2026-87832

Contrast Edgeless Systems through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration in the imagepuller. Config.registryFor strips a single trailing dot and then uses strings.HasSuffixhostname, fqdn without requiring a DNS label boundary, so a registry entry such...

CVE-2026-100837

Contrast versions through 1.20.0 by Edgeless Systems are vulnerable to a credential leak due to unanchored suffix matching in the imagepuller component. The Config.registryFor function strips a trailing dot and uses strings.HasSuffix(hostname, fqdn) without requiring a DNS label boundary. This al...

CVE-2026-100837 Edgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix Matching

Contrast Edgeless Systems through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration in the imagepuller. Config.registryFor strips a single trailing dot and then uses strings.HasSuffixhostname, fqdn without requiring a DNS label boundary, so a registry entry such...

CVE-2026-100862 heym before 0.0.91 Multiple Secrets Plaintext Storage

heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values returned in cleartext by GET /api/workflows/id and persisted unsanitized into execution history, MCP API keys stored a...

EUVD-2026-87827

heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values returned in cleartext by GET /api/workflows/id and persisted unsanitized into execution history, MCP API keys stored a...

CVE-2026-100862

The workflow automation platform heym versions prior to 0.0.91 contains multiple plaintext storage vulnerabilities. The application fails to encrypt several sensitive secrets, including webhook header-auth values , MCP API keys , portal session tokens , workflow execution JWTs , and Discord inter...

CVE-2026-100862 heym before 0.0.91 Multiple Secrets Plaintext Storage

heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values returned in cleartext by GET /api/workflows/id and persisted unsanitized into execution history, MCP API keys stored a...

CVE-2026-100724 http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxy

http4k Maven package org.http4k:http4k-core before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring Contains matching on the Host header by default in reverseProxy and reverseProxyRouting when dispatching to configured virtual hosts. If these functions are deployed as a public-facing inbound HTTP...