K000162882: Node.js vulnerability CVE-2026-21710

Security Advisory Description A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with a header named proto and the application accesses req.headersDistinct. When this occurs, dest"proto" resolves to Object.prototype rather than undefined, causing .push...

HTTP/2 Bomb CVE-2026-49975

...

K000162870: Apache HTTP server vulnerability CVE-2026-43951

Security Advisory Description Out-of-bounds Read vulnerability in Apache HTTP Server with modheaders and modmime and multiple response languages. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. CVE-2026-43951 A remote attacker may be able to disclose sensitive information on the...

CVE-2026-73145

GHSA-58ph-q79f-7x9x: HTTP server: unbounded request accumulation...

Exploit for Path Traversal in Apache Http_Server

AI 오케스트레이션 기반 CVE 분석 — CVE-2021-41773 AI에게 CVE 분석을 시키고, A...

SUSE CVE-2026-6993

A security flaw has been discovered in go-kratos kratos up to 2.9.2. This impacts the function NewServer of the file transport/http/server.go of the component http.DefaultServeMux Fallback Handler. The manipulation results in unintended intermediary. The attack may be launched remotely. The explo...

PT-2026-80181

GHSA-58ph-q79f-7x9x: HTTP server: unbounded request accumulation...

Security Bulletin: IBM HTTP Server shipped with IBM OpenPages is affected by multiple vulnerabilities due to the included Apache HTTP Server

Summary IBM HTTP Server used by IBM WebSphere Application Server, is shipped as a supporting program of IBM OpenPages. Information about multiple vulnerabilities affecting IBM HTTP Server has been published in a security bulletin. These products have addressed the applicable CVEs. For a complete...

Apache HTTP Server 2.4.49 - Path Traversal / RCE Detection (CVE-2021-41773)

Detects CVE-2021-41773 by reading /etc/passwd via encoded /.%%2e/ traversal under /cgi-bin or /icons, and optionally confirming CGI RCE via POST to bin/sh. !/usr/bin/env python3 -- coding: utf-8 -- """Apache HTTP Server 2.4.49 path traversal / CGI RCE CVE-2021-41773.""" import re from kittysploit...

Apache HTTP Server - Path Traversal File Read (CVE-2021-41773/42013)

Reads arbitrary files via CVE-2021-41773 / CVE-2021-42013 encoded path traversal under cgi-bin/icons aliases. !/usr/bin/env python3 -- coding: utf-8 -- """Apache HTTP Server path-traversal arbitrary file read CVE-2021-41773 / CVE-2021-42013.""" from kittysploit import from...

Apache HTTP Server 2.4.49 - CGI Path Traversal RCE (CVE-2021-41773)

Exploits CVE-2021-41773 by POSTing shell commands to an encoded path ending in bin/sh under a mapped Alias/ScriptAlias cgi-bin/icons. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache HTTP Server 2.4.49 CGI path-traversal RCE CVE-2021-41773 — opens execute...

Apache HTTP Server 2.4.49-2.4.50 - CGI Path Traversal RCE (CVE-2021-42013)

Exploits CVE-2021-42013 using double-encoded .%%32%65/ traversal to reach bin/sh under a mapped Alias/ScriptAlias and run OS commands. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache HTTP Server 2.4.49-2.4.50 double-encoded CGI RCE CVE-2021-42013 — opens...

Photon OS 5.0: Apache PHSA-2023-5.0-91-0093

An update of the apache package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0093. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2026-19352

A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forgery. The attack requires access to the...

CVE-2026-19352

A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forgery. The attack requires access to the...

EulerOS 2.0 SP11 : httpd (EulerOS-SA-2026-3125)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are...

Linux Distros Unpatched Vulnerability : CVE-2026-64677

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and...

CVE-2026-64677

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...

MAL-2026-13429 Malicious code in @avi892nash/aegis-grid-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d81514bec2b648731e0db3b59e1adbd308a5b099f80af8be6caac5db71103a00 The package's default bin action starts an HTTP server grid.mjs that listens on GRIDRUNNERPORT default 7719. Incoming requests carry a base64-JSON...

Malicious code in @avi892nash/aegis-grid-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d81514bec2b648731e0db3b59e1adbd308a5b099f80af8be6caac5db71103a00 The package's default bin action starts an HTTP server grid.mjs that listens on GRIDRUNNERPORT default 7719. Incoming requests carry a base64-JSON...