API-SPY-API-PROBE

API-SPY 🕵️👻 API पुनर्जागरण और पेनिट्रेशन परीक्षण के लिए डिज़ाइन किया गया एक शक्तिशाली डायरेक्टरी ब्रूट-फोर्स उपकरण। स्वचालित रूप से छिपे हुए API एंडपॉइंट खोजता है, रिकर्सिव सबस्कैनिंग करता है, और गहन API गणना के लिए HTTP विधियों की जांच करता है। विशेषताएँ ✨ मुख्य क्षमताएँ: 🎯 वर्डलिस्ट-आधारित...

CVE-2025-3639

CVE-2025-3639 PoC - تجاوز تسجيل الدخول في Liferay Portal/DXP يحتوي هذا المستودع على إثبات المفهوم PoC لثغرة CVE-2025-3639 ، وهي ثغرة لتجاوز تسجيل الدخول في Liferay Portal الإصدارات 7.3.0–7.4.3.132 وLiferay DXP إصدارات متعددة من 2024.Q1 إلى 2025.Q1.6. يُظهر الإثبات كيف يمكن لمستخدم غير مصادق مع...

cve-2026-43515-poc

CVE-2026-43515 — Apache Tomcat सुरक्षा बाधा बाईपास शोषणीयता निर्णय: शोषणीय की पुष्टि हुई। एक विभाजित कॉन्फ़िगरेशन द्वारा संरक्षित संसाधन के लिए POST अनुरोध प्रमाणीकरण को पूरी तरह से बायपास करता है। आवश्यक web.xml आकार मानक परिनियोजन में असामान्य है — विवरण के लिए विश्लेषण देखें। विषय सूची अवलोकन...

ssrf-sheriff

SSRF Sheriff This is an SSRF testing sheriff written in Go. It was originally created for the Uber H1-4420 2019 London Live Hacking Event, but it is now being open-sourced for other organizations to implement and contribute back to. Features Respond to any HTTP method GET, POST, PUT, DELETE, etc...

EUVD-2026-70981

MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...

CVE-2026-85546 MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests

MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...

toxy

toxy Not actively maintained, may not work with latest node.js runtimes. If you are interested in maintaining toxy, please open an issue...

SUSE CVE-2026-37236

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

Rejetto HTTP File Server - Template injection

This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. id: CVE-2024-23692 info: name: Rejetto HTTP File Server - Template injection author: johnk3r severity: critical description: | This...

Linux Distros Unpatched Vulnerability : CVE-2026-37236

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP- Method-Override header in ServeMux.ServeHTTP without...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the ServeHTTP method of ServeMux runtime/mux.go, which rewrites r.Method from the client-supplied X-HTTP-Method-Override header on form-urlencoded POST requests without restricting the allowed methods. An...

AZL-98346 CVE-2026-37236 affecting package cf-cli 8.7.11-8

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98256 CVE-2026-37236 affecting package cri-o 1.30.1-1

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98373 CVE-2026-37236 affecting package keda 2.14.1-16

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98388 CVE-2026-37236 affecting package moby-engine 25.0.3-19

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98349 CVE-2026-37236 affecting package cloud-provider-kubevirt 0.5.1-6

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98361 CVE-2026-37236 affecting package docker-compose 2.27.0-13

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98394 CVE-2026-37236 affecting package prometheus-adapter 0.12.0-7

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98355 CVE-2026-37236 affecting package cri-tools 1.32.0-7

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98436 CVE-2026-37236 affecting package telegraf 1.31.0-28

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...