CVE-2018-20718

CVE-2018-20718 This is a POC for CVE-2018-20718. It is a PHP Object injection vulnerability. The vulnerability affect all version of Pydio before 8.2.1 and leads to Unauthenticated Remote Code Execution. It was originaly found by RIPS. I found a gadget in Pydio\Core\Controller\ShutdownScheduler...

CVE-2019-6340

CVE-2019-6340 Solo con fines educativos Ejecutar root@kitploit: $ docker run --rm -p 8080:80 knqyf263/cve-2019-6340 Explotación GET root@kitploit: $ curl -XGET -H "Content-Type: application/hal+json" "http://localhost:8080/node/1?format=haljson" -d ' "link": "value": "link", "options":...

CLSA-2026-1788333194 TuxCare security update for guzzlehttp/psr7 (1 CVE)

TuxCare rebuilt guzzlehttp/psr7 to address 1 CVE. Fixed in 1.1.0-p2+tuxcare...

CVE-2026-67355

A flaw was found in guzzlehttp/guzzle. The software does not correctly enforce the "host-only" scope for cookies, which means it stores the request host in the cookie's domain field instead of restricting the cookie to the exact host. This vulnerability could allow an attacker who controls a...

CVE-2026-67339

A flaw was found in guzzlehttp/guzzle, where it fails to properly isolate Proxy-Authorization headers from origin servers when using cURL handlers. A remote attacker could exploit this vulnerability when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle misclassifies as...

CVE-2026-67354

A flaw was found in guzzlehttp/guzzle. This vulnerability, located in the RedirectMiddleware, can lead to information disclosure. When the optional allowredirects.referer setting is enabled, the middleware copies the URI fragment the portion after '' from a referring request into the generated...

CVE-2026-67353

A flaw was found in guzzlehttp/guzzle. A remote attacker can exploit this vulnerability by sending an excessive number of large 'Set-Cookie' header fields from a malicious server. This causes the application's CookieJar to store an unbounded amount of data in memory, leading to resource exhaustio...

CLSA-2026-1786546010 TuxCare security update for guzzlehttp/guzzle (2 CVEs)

TuxCare rebuilt guzzlehttp/guzzle to address 2 CVEs. Fixed in 7.10.0-p3+tuxcare...

CLSA-2026-1786527009 TuxCare security update for guzzlehttp/psr7 (5 CVEs)

TuxCare rebuilt guzzlehttp/psr7 to address 5 CVEs. Fixed in 1.1.0-p1+tuxcare...

CLSA-2026-1785554486 TuxCare security update for guzzlehttp/psr7 (2 CVEs)

TuxCare rebuilt guzzlehttp/psr7 to address 2 CVEs. Fixed in 1.4.2-p2+tuxcare...

CLSA-2026-1785380882 TuxCare security update for guzzlehttp/guzzle (8 CVEs)

TuxCare rebuilt guzzlehttp/guzzle to address 8 CVEs. Fixed in 6.5.8-p2+tuxcare...

CLSA-2026-1784856237 TuxCare security update for guzzlehttp/guzzle (9 CVEs)

TuxCare rebuilt guzzlehttp/guzzle to address 9 CVEs. Fixed in 7.10.0-p2+tuxcare...

CLSA-2026-1783386132 TuxCare security update for guzzlehttp/guzzle (2 CVEs)

TuxCare rebuilt guzzlehttp/guzzle to address 2 CVEs. Fixed in 6.0.2-p1+tuxcare...

CLSA-2026-1783645385 TuxCare security update for guzzlehttp/guzzle (1 CVE)

TuxCare rebuilt guzzlehttp/guzzle to address 1 CVE. Fixed in 6.0.2-p2+tuxcare...

CLSA-2026-1779065200 TuxCare security update for guzzlehttp/guzzle (5 CVEs)

TuxCare rebuilt guzzlehttp/guzzle to address 5 CVEs. Fixed in 6.3.3-p1+tuxcare...

Linux Distros Unpatched Vulnerability : CVE-2026-67354

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allowredirects.referer setting...

CVE-2026-67354

guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allowredirects.referer setting is enabled, the middleware copies the URI fragment the portion after '' from the referring request into the generated Referer header whe...

Improper Input Validation

guzzlehttp/psr7 is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of URI host components in Uri::assertValidHost, which fails to reject authority delimiters, embedded ports, and malformed IPv6 brackets, allowing an attacker to craft malicious URIs tha...

EUVD-2026-42319

guzzlehttp/psr7: Host Confusion via Weak URI Host Validation...

Linux Distros Unpatched Vulnerability : CVE-2026-59882

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost does not reject URI host components containing...