CVE-2026-100700

A flaw was found in nodemailer. An inefficient regular expression within the address parser component is susceptible to excessive backtracking when evaluating untrusted input. A remote attacker can exploit this vulnerability by submitting crafted email header values containing long text sequences...

CVE-2019-11287

CVE-2019-11287: RabbitMQ 웹 관리 플러그인의 힙 오버플로우를 통한 DoS Pivotal RabbitMQ 3.7.21 이전의 3.7.x 버전과 3.8.1 이전의 3.8.x 버전, 그리고 Pivotal Platform용 RabbitMQ 1.16.7 이전의 1.16.x 버전과 1.17.4 이전의 1.17.x 버전에는 서비스 거부DoS 공격에 취약한 웹 관리 플러그인이 포함되어 있습니다. "X-Reason" HTTP 헤더를 활용하여 악의적인 Erlang 형식 문자열을 삽입할 수 있으며, 이로 인해 힙heap이 확장...

EUVD-2026-87673

nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of...

EUVD-2026-87758

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3HeadersHttpMessage, boolean —...

CVE-2026-100664 Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3HeadersHttpMessage, boolean —...

CVE-2026-100664 Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3HeadersHttpMessage, boolean —...

CVE-2026-100664 Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3HeadersHttpMessage, boolean —...

CVE-2026-100659

Netty's HTTP/3 codec (io.netty:netty-codec-http3 ) in versions 4.2.0.Final through 4.2.17.Final fails to enforce the RFC 9114 requirement that the :authority pseudo-header and a literal host header must carry the same value. A remote unauthenticated peer can submit a HEADERS frame with conflictin...

EUVD-2026-87753

Netty's HTTP/3 codec io.netty:netty-codec-http3 in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both present, carry the same value. A remote unauthenticated peer can send a single...

CVE-2026-100646 SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header

SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go fail open when the HTTP Origin header is absent, on the incorrect assumptio...

CVE-2026-100646 SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header

SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go fail open when the HTTP Origin header is absent, on the incorrect assumptio...

CVE-2026-100646

The SiYuan personal knowledge management system (versions up to and including 3.8.3 ) is vulnerable to an authentication bypass because the kernel's authentication guards—specifically CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go—fail open when the HTTP Ori...

CVE-2026-100646 SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header

SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go fail open when the HTTP Origin header is absent, on the incorrect assumptio...

CVE-2026-14282

CVE-2026-14282 — GoDAM WordPress プラグイン RCE 著者: nullwhisper 用途: 認可されたセキュリティ調査 / 脆弱性検証のみ。 これは何ですか？ GoDAM WordPress プラグインバージョン = 1.12.2 は、godamrecord という WPForms フィールドを登録します。アップロードハンドラ savevideofile は公開の wpformsprocessbeforefilter アクションにフックされるため、認証チェックの前に実行されます。このハンドラは攻撃者が制御する Content-Type...

KillApachePy

보안 트렌드를 팔로우하고 있다면 특수하게 제작된 Range 헤더CVE-2011-3192를 사용하여 다수의 Apache 버전을 대상으로 한 DoS 공격에 대해 들어본 적이 있을 것입니다. 원본 PoCkillapache.pl를 기반으로 Python 버전을 만들었으며, 더 사용자 친화적이고 몇 가지 프로그램 작업 흐름 개선 사항시스템 허용 최대 스레드 수 자동 사용, 사용자 정의 HTTP 메서드GET/HEAD/... 설정, 사용자 정의 대상 페이지 검색, 프록시 지원 등이 포함되어 있습니다. p.s. 이 도구를 실행하려면 Pytho...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: net/sched: Fixed a issue where partial COW operations by pedit led to corruption of the page cache. tcfpeditact calculates the COW range for skbensurewritable once before the key loop, using tcfpoffmaxhint. However, this hint...

cve-2023-3519-citrix-scanner

cve-2023-3519-citrix-scanner 이 스크립트는 CVE-2023-3519를 위한 기본적인 Citrix 스캐너입니다. 우리는 HTTP 헤더를 확인하여 취약한 Citrix Gateway/ADC를 식별하려고 합니다. 작동 방식 이 취약점을 분석하는 동안 우리와 CERT-Verbund의 동료들은 패치된 시스템에 동일한 HTTP 헤더 Last-Modified 타임스탬프가 있다는 것을 발견했습니다. 리버스 프록시와 많이 사용자 정의된 프론트 페이지는 결과를 변경할 수 있다는 점에 유의하세요. 이 경우 우리는 타임스탬프가...

CVE-2020-7693

CVE-2020-7693 Poc 참고: CVE-2020-7693용 페이로드가 버그 바운티 프로그램에서 실행 가능함을 확인합니다 설명: websocket 값을 갖는 Upgrade 헤더의 잘못된 처리는 sockjs 앱을 호스팅하는 컨테이너를 충돌시킵니다. 이는 0.3.20 이전의 sockjs 패키지에 영향을 미칩니다. 오래된 sockjs-node를 통한 단일 요청 서버 충돌: 요청 GET /sockjs-node/000/ HTTP/1.1 Host: localhost:3000 User-Agent: Mozilla/5.0 X11; Lin...

CVE-2018-19629

CVE-2018-19629 テスト環境 CVE-2018-19629 - Hyland Perceptive Content Server サービス拒否 DoS のためのDockerテスト環境です。 脆弱性の詳細 フィールド| 値 ---|--- CVE ID| CVE-2018-19629 深刻度| 高 DoS 影響を受けるバージョン| Hyland Perceptive Content Server 7.1.5 パッチ適用バージョン| 7.1.5 説明 Hyland Perceptive Content Server 7.1.5 未満には、TCP接続を介して ImageNow...

next-attack

이는 Next.js 프로젝트로, create-next-app을 사용하여 생성되었습니다. 취약점 테스트 먼저, 미들웨어가 작동하여 사용자를 리디렉션하는지 확인할 수 있습니다: curl http://localhost:3000/api/admin 그런 다음, 다음 명령어로 미들웨어가 우회되는 방법을 보여줄 수 있습니다: curl -H "x-middleware-subrequest: src/middleware:src/middleware:src/middleware:src/middleware:src/middleware"...