CVE-2026-67184 TinyWeb 0.0.8 Null Pointer Dereference DoS via Malformed HTTP Request

TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute function fails to allocate the Url object when version...

CVE-2026-67184

Summary: TinyWeb 0.0.8 and earlier are affected by a null pointer dereference due to a failure in HttpParser::execute() when parsing an HTTP request line with an invalid version. The code path leaves Url as NULL and then buildResponse() dereferences it without validating valid_requ, causing a SIG...

CVE-2026-67183

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

CVE-2026-67181

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to...

CVE-2026-67181

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to...

UBUNTU-CVE-2026-66752

tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize request framing by sending a Transfer-Encoding header with any value, including non-chunked codings, which causes the library to unconditionally apply chunk-decoding and discard...

CVE-2026-67182 Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Header Injection

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters 0x0A into client-supplied request header values that are copied verbatim to upstream connections without validation. Attackers...

CVE-2026-67182 Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Header Injection

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters 0x0A into client-supplied request header values that are copied verbatim to upstream connections without validation. Attackers...

EUVD-2026-49895

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters 0x0A into client-supplied request header values that are copied verbatim to upstream connections without validation. Attackers...

CVE-2026-67182

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters 0x0A into client-supplied request header values that are copied verbatim to upstream connections without validation. Attackers...

CVE-2026-67181 Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Transfer-Encoding Header

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to...

CVE-2026-67181

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to...

CVE-2026-67181 Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Transfer-Encoding Header

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to...

McAfee Network Data Loss Prevention 9.3.x - Cross-Site Scripting Detection

McAfee Network Data Loss Prevention User-Agent 9.3.x contains a cross-site scripting vulnerability which allows remote attackers to get session/cookie information via modification of the HTTP request. !/usr/bin/env python3 -- coding: utf-8 -- """McAfee Network Data Loss Prevention User-Agent 9.""...

SonicWall Email Security <= 10.0.9.x - Unauthenticated Admin Account Creation Detection

SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. !/usr/bin/env python3 -- coding: utf-8 -- """SonicWall Email Security version 10.""" from kittysploit import from lib.protocols.http.httpclient...

D-Link DIR-3040 1.13B03 - Information Disclosure Detection

D-Link DIR-3040 1.13B03 is susceptible to information disclosure in the Syslog functionality. A specially crafted HTTP network request can lead to the disclosure of sensitive information. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute...

Erxes Detect

Detects Erxes Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Erxes Detect.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Erxes Detect', 'description': 'Detects Erxes Detect.', 'author':...

SPIP Porte Plume Plugin - Remote Code Execution Detection

The porteplume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request. !/usr/bin/env python3 -- coding: utf-8 -- """Th...

Snoop Servlet - Information Disclosure Detection

The Snoop Servlet returns information about the HTTP request itself and sometimes. It could help an attacker to prepare more advanced attacks. !/usr/bin/env python3 -- coding: utf-8 -- """The Snoop Servlet returns information about the HTTP request itself and sometimes.""" from kittysploit import...

Caucho Resin >=4.0.52 <=4.0.56 - Directory traversal Detection

There is a Directory traversal vulnerability in Caucho Resin, as distributed in Resin 4.0.52 - 4.0.56, which allows remote attackers to read files in arbitrary directories via a ; in a pathname within an HTTP request. !/usr/bin/env python3 -- coding: utf-8 -- """There is a Directory traversal...