CVE-2021-40346

CVE-2021-40346 请求头内部表示中的整数溢出允许 HTTP 请求走私。本仓库提供了一个使用 docker-compose 构建的 PoC，包含两个 docker 镜像：一个运行存在漏洞版本的 HaProxy（本例中为 2.2.16），另一个运行使用 Gunicorn 作为 WSGI 的 Flask Web 服务器。通过利用该漏洞，我们能够访问 /admin 页面，而该页面的请求本会被 HaProxy 通过用户自定义规则阻止。 POC 环境要求 Docker 🐳 Docker compose 🐳 环境配置 HaProxy docker 容器，端口 8000 映射到宿主机。...

SUSE SLES15: tomcat / tomcat-admin-webapps / tomcat-el-3_0-api / etc (SUSE-SU-2026:4203-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4203-1 advisory. - CVE-2026-65182: Apache Tomcat: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: Apache Tomcat: TOCTOU when...

CVE-2026-25890-FileBrowser-Access-Control-Bypass

CVE-2026-25890 - Bypass de Control de Acceso en FileBrowser Los usuarios no autenticados no pueden explotar esto: se requieren credenciales válidas de bajo privilegio que estén restringidas de la ruta objetivo. Bypass de autorización basado en ruta en FileBrowser ≤ v2.57.0 usando múltiples barras...

CVE-2026-20121

A vulnerability in the access control list ACL Object Group Search OGS implementation of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass configured access controls. This...

CVE-2026-20120

A vulnerability in the access control list ACL Object Group Search OGS implementation of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass configured access controls. This...

EUVD-2026-81050

Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverified token with a hardcoded claim value. Attackers can obtain trusted internal identity and gain unchecked read and write...

EUVD-2026-81040

Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access...

CVE-2026-20121 CIsco FTD Bypass Access List

A vulnerability in the access control list ACL Object Group Search OGS implementation of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass configured access controls. This...

EUVD-2026-81017

A vulnerability in the access control list ACL Object Group Search OGS implementation of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass configured access controls. This...

EUVD-2026-81153

A vulnerability in the access control list ACL Object Group Search OGS implementation of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass configured access controls. This...

CVE-2026-21962

CVE-2026-21962 — Oracle HTTP Server / WebLogic Server 代理插件 通过 URI 规范化不一致绕过访问控制 针对 CVE-2026-21962（访问控制不当，CVSS 10.0）在 Oracle HTTP Server / 用于 Apache HTTP Server 的 Oracle WebLogic Server 代理插件中的独立复现利用与分析。 状态：已验证 ，针对前端为 WebLogic Server 12.2.1.4 的在线 OHS 12.2.1.4.0 和 14.1.2.0.0 环境。 1. 摘要 前端（OHS +...

ksmbrace

ksmbrace Vulnerability research in ksmbd , the Linux kernel's in-kernel SMB3 server fs/smb/server/. Authenticated-attacker flaws on the durable-handle and path-resolution paths of ksmbd. The name nods to the race-condition theme of this line of work see the withheld byte-range-lock UAF,...

CVE-2026-92395

@fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and it backs Fastify request.ip and request.ips. In versions 3.0.0 through 5.1.0, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as...

CVE-2026-25924

CVE-2026-25924 PoC - Kanboard 管理员 RCE 通过安全控制绕过实现管理员 RCE 的 Proof-of-Concept 披露： 最初由我通过 GHSA-grch-p7vf-vc4f 报告 ⚠️ 仅限授权渗透测试/研究使用。 漏洞信息 字段| 值 ---|--- CVE ID| CVE-2026-25924 严重性| 🔴 高 CVSS 评分| 8.4 CVSS 向量| CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CWE| CWE-863：不正确的授权 受影响产品| Kanboard ≤ 1.2.49 已修补版本|...

libevent: Libevent: HTTP header handling bugs create risk of access control bypass.

A flaw was found in libevent. The evhttpdecodeuriinternal function in http.c decodes percent-encoded %00 bytes into literal NUL characters without rejecting them, allowing an attacker to craft a URI such as /admin/secret%00.jpg where extension-based access checks see .jpg but the server processes...

libevent: Libevent: HTTP header handling bugs create risk of access control bypass.

A flaw was found in libevent. The evhttpdecodeuriinternal function in http.c decodes percent-encoded %00 bytes into literal NUL characters without rejecting them, allowing an attacker to craft a URI such as /admin/secret%00.jpg where extension-based access checks see .jpg but the server processes...

libevent: Libevent: HTTP header handling bugs create risk of access control bypass.

A flaw was found in libevent. The evhttpdecodeuriinternal function in http.c decodes percent-encoded %00 bytes into literal NUL characters without rejecting them, allowing an attacker to craft a URI such as /admin/secret%00.jpg where extension-based access checks see .jpg but the server processes...

Security update for tomcat

This update for tomcat fixes the following issues: CVE-2026-65182: Apache Tomcat: Bypass longest prefix security constraint bsc1276893. CVE-2026-65183: Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets bsc1276894. CVE-2026-65637: Apache Tomcat: HTTP/2 no-authority...

SUSE-SU-2026:4203-1 Security update for tomcat

This update for tomcat fixes the following issues: - CVE-2026-65182: Apache Tomcat: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets bsc1276894. - CVE-2026-65637: Apache Tomcat: HTTP/2...

CVE-2026-22014-GraphQL-Persisted-Queries-Injection-via-ID-Manipulation

CVE-2026-22014 – GraphQL Persisted Queries Injection via ID Manipulation Program Code Node.js root@kitploit: // graphqlpersisted.js - Accepts persisted query IDs const express = require'express'; const graphqlHTTP = require'express-graphql'; const queries = "abc": "query user name " ;...