Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token

Summary Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server's GitHub token to GitHub requests. The GitHub API...

EUVD-2026-87369

Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token...

GHSA-M62C-5Q34-F3CF Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token

Summary Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server's GitHub token to GitHub requests. The GitHub API...

CVE-2024-37081

CVE-2024-37081: Multiple Local Privilege Escalation in VMware vCenter Server The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileg...

File-Tunnel

File Tunnel Tunnel TCP connections through a file server. A full list of supported file systems can be found here. Download Portable executables for Windows, Linux and Mac can be found over in the releases section. Example 1 - Bypassing a firewall You'd like to connect from Host A to Host B, but ...

CVE-2026-107183 llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser

llama.cpp before b11393 contains a use-after-free and double free vulnerability in commonchatpegmapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling currenttool pointer. Attackers can submit a chatparser in a POST /completion request emitting a tool-id...

EUVD-2026-94330

llama.cpp before b11393 contains a use-after-free and double free vulnerability in commonchatpegmapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling currenttool pointer. Attackers can submit a chatparser in a POST /completion request emitting a tool-id...

CVE-2026-107183

llama.cpp before b11393 contains a use-after-free and double free vulnerability in commonchatpegmapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling currenttool pointer. Attackers can submit a chatparser in a POST /completion request emitting a tool-id...

CVE-2021-41773

Apache HTTP Server 2.4.49 - Path Traversal & RCE CVE-2021-41773 A sophisticated Python-based proof-of-concept PoC exploit for CVE-2021-41773. This tool automates the process of testing Apache 2.4.49 servers for path traversal and remote code execution RCE vulnerabilities. ⚠️ Legal Disclaimer This...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.2 release and security update

Red Hat JBoss Web Server 7.0.2 zip release is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Windows Server. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...

CVE-2022-22965

spring4shell ⭐ a python implementation of CVE-2022-22965 that provides a prompt to the user in the style of an ssh session. the script is designed to be easy to understand and execute, with both readability and accessbility - depending on the user's choice. Designed for exploiting the vulnerabili...

CVE-2026-23744

CVE-2026-23744 — MCPJam Inspector Unauthenticated RCE Unauthenticated remote code execution PoC for CVE-2026-23744. MCPJam Inspector 1.4.2 and earlier expose functionality through /api/mcp/connect that can launch an attacker-controlled MCP server command without authentication. For authorized...

nextjs-rce-incident-response

Next.js RCE Incident Response — CVE-2025-55182 Type: Live Production Incident Response Vulnerability: CVE-2025-55182 — React Server Components Insecure Deserialization RCE Affected System: Next.js frontend + remote production server Role: Cyber Security Intern — SenseLive Technologies Date:...

React-site-CVE-2025-55182

React Site - CVE-2025-55182 README: Vulnerable Next.js project React RSC landing page This repository contains an example of a multi-page corporate landing page built with Next.js 15.0.0 + React 19.0.0. The site mimics a structure similar to t1.ru: home, products, cases, media, about, contacts. W...

BIT-APACHE-2026-63718 Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' response smuggling vulnerability in Apache HTTP Server via modproxyuwsgi and a crafted uwsgi response with Transfer-Encoding. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.68...

CVE-2025-55182

CVE-2025-55182 Vulnerable Application Build and run: docker compose build docker compose run --rm --entrypoint 'npm install' node docker compose run --rm --entrypoint 'npm run build' node docker compose up POC from https://github.com/msanft/CVE-2025-55182: node poc.js Experimentation with...

Apache-Authentication-Flaw-Research-CVE-2024-38476-

🛡️ Apache Authentication Flaw Research CVE-2024-38476 Prepared By: Abanoub Ehab 🛡️ Huawei Telecommunications Student Club - AOU A comprehensive technical research paper on the semantic ambiguity vulnerability in Apache HTTP Server and its impact on backend response handling. 📝 Abstract...

ExchangeWeaknessTest

ExchangeWeaknessTest This script test the CVE-2021-26855 vulnerability on Exchange Server. Example python3 ExchangeWeaknessTest.py mydomain.com Licence Licensed under the GPL, version 3...

amthoneypot

Honeypot for Intel's AMT Firmware Vulnerability CVE-2017-5689. Webserver that listens on TCP - Daemonizeport 16922. Replicates the behaviour of Intel's AMT management service. Daemonize Building - go build server.go Running - ./server logfile.txt TODO Add templating to make content dynamic / rand...

react2shell-burp

React2Shell RCE Scanner and Validator CVE-2025-55182 Creator: j0lt Collaborator: https://github.com/shashank18 A Burp Suite extension that detects and validates the React2Shell vulnerability CVE-2025-55182 — a pre-authentication remote code execution flaw in React Server Components. The extension...