TencentOS Server 4: pcs (TSSA-2026:1351)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1351 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

CLEANSTART-2024-VS44516 vulnerability was found in RamseyK httpserver

Security vulnerability affects the pacparser package. A vulnerability was found in RamseyK httpserver...

tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption

A flaw was found in Tornado, a Python web framework and asynchronous networking library. Its gzip decompression routines process data in limited-size chunks but do not enforce an overall limit on the total accumulated decompressed data. This vulnerability allows a malicious server to consume...

tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption

A flaw was found in Tornado, a Python web framework and asynchronous networking library. Its gzip decompression routines process data in limited-size chunks but do not enforce an overall limit on the total accumulated decompressed data. This vulnerability allows a malicious server to consume...

Rocky Linux 9 [CIQ] Security Update: java-25-openjdk / java-25-openjdk-crypto-adapter / etc Multiple Vulnerabilities (crlsa-2026_0933)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20260933 advisory. JDK: Improve JMX connections CVE-2026-21925 JDK: Improve HttpServer Request handling CVE-2026-21933 JDK: Enhance Certificate Checking CVE-2026-21945 libpng...

Rocky Linux 9 [CIQ] Security Update: java-1.8.0-openjdk / java-1.8.0-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2022_7007)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20227007 advisory. OpenJDK: excessive memory allocation in X.509 certificate parsing Security, 8286533 CVE-2022-21626 OpenJDK: HttpServer no connection count limit Lightweigh...

CVE-2026-84997

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedDecoder could enter an infinite loop while processing a malformed Transfer-Encoding: chunked body because handleData required its buffer to shrink on every...

CVE-2026-54135: Uncontrolled Resource Consumption

AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation of AirSane that allows a remote unauthenticated attacker to cause a Denial of Service DoS via memory exhaustion OOM. In...

CLSA-2026-1787222376 java-1.7.0-openjdk: Fix of 11 CVEs

CVE-2024-20952: Enhance TLS connection support JDK-8317547, JDK-8302017 - CVE-2025-21587: Better TLS connection support JDK-8337692 - CVE-2026-34268: Enhance key generation JDK-8371935 - CVE-2026-22007: Enhance crypto algorithm support JDK-8369575 - CVE-2026-21925: Improve JMX connections...

CLSA-2026-1787222328 java-1.7.0-openjdk: Fix of 8 CVEs

CVE-2024-20952: Enhance TLS connection support JDK-8317547, JDK-8302017 - CVE-2025-21587: Better TLS connection support JDK-8337692 - CVE-2026-34268: Enhance key generation JDK-8371935 - CVE-2026-22007: Enhance crypto algorithm support JDK-8369575 - CVE-2026-21925: Improve JMX connections...

CVE-2026-66064

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection...

CVE-2026-66063

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName on / but did not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This...

CVE-2026-64863

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issu...

CVE-2026-54719

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder...

Google frontend HttpServer Detection

Detects Google frontend HttpServer. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Google frontend HttpServer.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Google frontend HttpServer Detection', 'description...

Apple HttpServer Detect

Detects Apple HttpServer Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Apple HttpServer Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Apple HttpServer Detect', 'description': 'Detects Apple...

CVE-2026-66064: Improper Resolution of Path Equivalence

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection...

CVE-2026-66063: Improper Limitation of a Pathname to a Restricted Directory

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName on / but did not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This...

CVE-2026-54719: Missing Authorization

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder...

CVE-2026-64863: Improper Access Control

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issu...