citrixmash_scanner

CVE-2019-19781 citrixmash scanner A multithreaded scanner for Citrix appliances that are vulnerable to CVE-2019-19781. The scanner does not attempt to compromise/exploit hosts and avoids downloading any sensitive content. A HEAD request is used to determine if a target is vulnerable. False...

SUSE CVE-2026-115823

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses wi...

Linux Distros Unpatched Vulnerability : CVE-2026-115823

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman...

DEBIAN-CVE-2026-115823

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses wi...

CVE-2026-115823

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses wi...

CVE-2026-115823

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses wi...

CVE-2026-115823

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses wi...

CVE-2026-115823

The Starman web server for Perl (versions before 0.4019 ) contains a vulnerability where it incorrectly sends response bodies for HEAD requests on both array and streaming response paths. Because Starman omits chunked framing for these requests while still writing the body, it causes desynchroniz...

CVE-2026-115823 Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses wi...

CVE-2026-115823 Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses wi...

EUVD-2026-109560

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses wi...

CVE-2026-115823

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses wi...

PT-2026-123059

Name of the Vulnerable Software and Affected Versions Starman versions prior to 0.4019 Description Starman for Perl sends response bodies for HEAD requests, which leads to response desynchronization on keep-alive or pipelined connections. For HEAD requests, the software omits chunked framing but...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the pure-Python HTTP request parser in aiohttp/httpparser.py, where the method variable used to determine whether a request body should be treated as empty is incorrectly sourced from a local parameter rather...

tomcat: security constraint bypass with HTTP/0.9

A flaw was found in Tomcat. An improper input validation vulnerability allows an attacker to bypass security constraints. Specifically, if a security constraint is configured to permit HEAD requests to a URI but deny GET requests, a malformed or specification invalid HEAD request using the HTTP/0...

tomcat: security constraint bypass with HTTP/0.9

A flaw was found in Tomcat. An improper input validation vulnerability allows an attacker to bypass security constraints. Specifically, if a security constraint is configured to permit HEAD requests to a URI but deny GET requests, a malformed or specification invalid HEAD request using the HTTP/0...

Exploit for Improper Input Validation in Apache Tomcat

CVE-2026-24733 What is CVE-2026-24733? Apache Tomcat incor...

CVE-2026-5096

The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the loadpreviousfieldvalue method in class-evf-form-task.php accepting arbitrary URL values from $POST data for upload fields without domain restriction,...

CVE-2026-63642 MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/nodehelper.js accepts the CHECKARTICLEURL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetchurl, method: "HEAD" without validating the...

PT-2026-77237

Name of the Vulnerable Software and Affected Versions MagicMirror² versions prior to 2.37.0 Description The checkArticleUrl function in defaultmodules/newsfeed/node helper.js accepts the CHECK ARTICLE URL notification via the unauthenticated Socket.IO namespace /newsfeed. The system performs a...