Lucene search
+L

37960 matches found

BDU FSTEC
BDU FSTEC
added 2026/07/06 12:0 a.m.10 views

The vulnerability of the Go programming language’s MIME component, which allows a hacker to trigger a service failure

The vulnerability of the Go programming language’s MIME component is related to its algorithmic complexity. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures by using a specially created MIME header...

7.8CVSS6AI score0.0056EPSS
SaveExploits0References4Affected Software2
Positive Technologies
Positive Technologies
added 2026/07/06 12:0 a.m.22 views

PT-2026-55892

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 Description Improper input validation in the camel-nats component allows a client to inject arbitrary Camel...

7.5CVSS6.2AI score0.00423EPSS
SaveExploits1References7
Positive Technologies
Positive Technologies
added 2026/07/06 12:0 a.m.31 views

PT-2026-55891

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 Description Improper input validation in the Apache Camel AWS2-SQS component allows an attacker to inject...

9.8CVSS6.1AI score0.00641EPSS
SaveExploits0References13
Positive Technologies
Positive Technologies
added 2026/07/06 12:0 a.m.63 views

PT-2026-56086

Name of the Vulnerable Software and Affected Versions Kiwi TCMS versions prior to 16.1 Description User input in the TestCase.extra link and TestPlan.extra link fields is not sanitized and is rendered verbatim, allowing for cross-site scripting XSS, a technique where malicious scripts are injecte...

6.1AI score
SaveExploits0References9
Positive Technologies
Positive Technologies
added 2026/07/06 12:0 a.m.15 views

PT-2026-55904

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 Description An injection issue exists in the Apache Camel IRC component due to improper input validation and...

6.5CVSS6.2AI score0.00561EPSS
SaveExploits1References7
Positive Technologies
Positive Technologies
added 2026/07/06 12:0 a.m.22 views

PT-2026-56074

Name of the Vulnerable Software and Affected Versions Coder versions prior to 2.29.17 Coder versions prior to 2.32.7 Coder versions prior to 2.33.8 Coder versions prior to 2.34.2 Description The workspace app proxy resolves the target app using the httpapi.RequestHost function, which prioritizes...

6.8CVSS5.9AI score0.0014EPSS
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/07/06 12:0 a.m.21 views

PT-2026-56023

Name of the Vulnerable Software and Affected Versions ajenti versions prior to 2.2.14 Description The browser-facing login and administrative UI contains a clickjacking weakness. This occurs because the core HTTP response path in ajenti-core/aj/http.py initializes an empty header list and finaliz...

5.4CVSS5.9AI score0.002EPSS
SaveExploits0References7
GithubExploit
GithubExploit
added 2026/07/05 2:59 p.m.116 views

Exploit for CVE-2026-20896

CVE-2026-20896 Gitea's official Docker image up to and inclu...

9.8CVSS7.2AI score0.31809EPSS
SaveExploits5
Snyk
Snyk
added 2026/07/03 10:20 p.m.8 views

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass due to the default configuration of REVERSEPROXYTRUSTEDPROXIES allowing all sources. An attacker can gain unauthorized access by sending spoofed reverse-proxy authentication headers such as X-WEBAUTH-USER...

9.8CVSS7.9AI score0.31809EPSS
SaveExploits5References2
Snyk
Snyk
added 2026/07/03 10:20 p.m.7 views

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass due to the default configuration of REVERSEPROXYTRUSTEDPROXIES allowing all sources. An attacker can gain unauthorized access by sending spoofed reverse-proxy authentication headers such as X-WEBAUTH-USER...

9.8CVSS7.9AI score0.31809EPSS
SaveExploits5References2
Snyk
Snyk
added 2026/07/03 10:20 p.m.13 views

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass due to the default configuration of REVERSEPROXYTRUSTEDPROXIES allowing all sources. An attacker can gain unauthorized access by sending spoofed reverse-proxy authentication headers such as X-WEBAUTH-USER...

9.8CVSS7.9AI score0.31809EPSS
SaveExploits5References2
Snyk
Snyk
added 2026/07/03 10:19 p.m.9 views

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via the handling of the forwarded-proto header when generating public URLs. An attacker can cause the application to generate spoofed canonical URLs by injecting or manipulating the forwarded-proto header value...

7.5CVSS6AI score0.00431EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/03 8:19 p.m.62 views

CVE-2026-20896 Gitea Docker image trusts spoofable reverse-proxy headers by default

Gitea Docker image versions up to and including 1.26.2 use REVERSEPROXYTRUSTEDPROXIES= by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled...

9.8CVSS0.31809EPSS
SaveExploits5References4
OSV
OSV
added 2026/07/03 8:19 p.m.9 views

CVE-2026-20896 Gitea Docker image trusts spoofable reverse-proxy headers by default

Gitea Docker image versions up to and including 1.26.2 use REVERSEPROXYTRUSTEDPROXIES= by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled...

9.8CVSS7.3AI score
SaveExploits0References6
Snyk
Snyk
added 2026/07/03 7:13 p.m.10 views

Improper Input Validation

Overview webpack-dev-server is an Uses webpack with a development server that provides live reloading. It should be used for development only. Affected versions of this package are vulnerable to Improper Input Validation through the host-validation process. An attacker can cause the server to...

6.9CVSS6AI score0.00405EPSS
SaveExploits0References2
NVD
NVD
added 2026/07/03 6:16 p.m.16 views

CVE-2026-14631

webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught...

5.3CVSS0.00405EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/03 5:23 p.m.96 views

CVE-2026-14631

Vulnerability overview: CVE-2026-14631 affects webpack-dev-server up to version 5.2.5. An unauthenticated peer sending a normal HTTP request with a malformed Host header or a WebSocket upgrade to /ws with a malformed Origin header triggers an uncaught exception in the host-validation path, crashi...

5.3CVSS6AI score0.00405EPSS
SaveExploits0References2Affected Software1
OSV
OSV
added 2026/07/03 5:23 p.m.8 views

CVE-2026-14631 webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught...

5.3CVSS6.1AI score
SaveExploits0References4
Cvelist
Cvelist
added 2026/07/03 5:23 p.m.54 views

CVE-2026-14631 webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught...

5.3CVSS0.00405EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
added 2026/07/03 1:49 p.m.8 views

nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests

A flaw in nghttp2's nghttpx proxy allows a remote attacker to perform HTTP request smuggling and cross-client response-queue poisoning. This occurs because the proxy ambiguously forwards HTTP/1.1 Upgrade requests that contain a Content-Length header to reusable keep-alive backend connections...

6.3CVSS5.7AI score0.00263EPSS
SaveExploits0References7
Rows per page
Query Builder