ssrf-sheriff

SSRF Sheriff This is an SSRF testing sheriff written in Go. It was originally created for the Uber H1-4420 2019 London Live Hacking Event, but it is now being open-sourced for other organizations to implement and contribute back to. Features Respond to any HTTP method GET, POST, PUT, DELETE, etc...

API-SPY-API-PROBE

API-SPY 🕵️👻 Un outil puissant de brute-force de répertoires conçu pour la reconnaissance d'API et les tests d'intrusion. Découvre automatiquement les points d'extrémité d'API cachés, effectue un sous-scan récursif et sonde les méthodes HTTP pour une énumération plus approfondie des API...

CVE-2026-105759

A flaw was found in vLLM. An unauthenticated remote attacker can cause a denial of service DoS by sending requests with arbitrary, non-standard HTTP method names to unguarded server routes. Because the metrics tracking middleware records raw request methods into monitoring labels without validati...

CVE-2026-105759 vLLM: Unbounded Prometheus label cardinality from attacker-controlled HTTP method tokens in the vLLM Rust frontend metrics middleware (unauthenticated denial of service)

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's trackhttpmetrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker can send unique arbitrary method tokens ...

CVE-2025-3639

CVE-2025-3639 PoC - Contournement de l'authentification dans Liferay Portal/DXP Ce dépôt contient une preuve de concept PoC pour CVE-2025-3639 , une vulnérabilité de contournement de l'authentification dans Liferay Portal versions 7.3.0 à 7.4.3.132 et Liferay DXP plusieurs versions de 2024.Q1 à...

cve-2026-43515-poc

CVE-2026-43515 — Обход ограничения безопасности Apache Tomcat Вердикт об эксплуатируемости: подтверждено, что уязвимость эксплуатируема. POST-запрос к ресурсу, защищенному разделенной конфигурацией , полностью обходит аутентификацию. Требуемая форма web.xml необычна для стандартных развертываний ...

axios: axios: Unintended HTTP method override via prototype pollution gadget

A flaw was found in axios. When sending HTTP requests that omit an explicit request method, Axios can inherit properties from the JavaScript prototype chain rather than using safe internal defaults. If an attacker manipulates shared object properties through a separate vulnerability in the same...

toxy

toxy Not actively maintained, may not work with latest node.js runtimes. If you are interested in maintaining toxy, please open an issue. Hackable HTTP proxy to simulate server failure scenarios , systems resiliency testing and unexpected network conditions , built for node.js. It was mainly...

GHSA-9FR6-4GFG-395G Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

Summary Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request url and axios url can send a state-changing HTTP method instead...

NPM: Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

NPM: Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method vulnerability discovered by ? in WordPress Npm axios versions = 0.27.2, 0.34.0...

EUVD-2026-88371

Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method...

Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

Summary Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request url and axios url can send a state-changing HTTP method instead...

Linux Distros Unpatched Vulnerability : CVE-2026-101902

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit...

SUSE CVE-2026-101902

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...

NPM: undici vulnerable to caching and replay of unsafe HTTP method responses

NPM: undici vulnerable to caching and replay of unsafe HTTP method responses vulnerability discovered by ? in WordPress Npm undici versions = 7.0.0, 7.29.1...

CVE-2026-101902

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...

AZL-105245 CVE-2026-101902 affecting package python-tensorboard 2.16.2-6

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...

DEBIAN-CVE-2026-101902

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...

UBUNTU-CVE-2026-101902

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...

CVE-2026-101902

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...