CVE-2026-110865

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules.headers to inject cust...

CVE-2026-110865 Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules.headers to inject cust...

CVE-2026-110865

Versions of Renovate before 44.60.1 are vulnerable to an HTTP Header Allowlist Bypass via shared presets. The root cause is the failure to validate hostRules[].headers within shared presets, allowing users to evade allowedHeaders restrictions. Attackers can provide internal or external presets to...

CVE-2026-110865 Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules.headers to inject cust...

CVE-2026-110865: Improper Protection of Alternate Path

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules.headers to inject cust...

PT-2026-114179

Name of the Vulnerable Software and Affected Versions Renovate versions prior to 44.60.1 Description An allowlist bypass exists that enables repository users to circumvent the allowedHeaders restriction. This occurs when hostRules headers are placed within shared presets. An attacker can provide...

CVE-2026-83536

A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header...

hsecscan

hsecscan Un escáner de seguridad para cabeceras de respuesta HTTP. Requisitos Python 2.x Módulos de Python os.path argparse sqlite3 urlparse urllib2 urllib json ssl Instalación $ pip install hsecscan Uso $ hsecscan usage: hsecscan.py -h -P -p -H Header -u URL -R -i -U User-Agent -D DBFILE -d 'POS...

CVE-2026-83536: Uncontrolled Resource Consumption

A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header...

h2t

h2t - Herramienta de Endurecimiento HTTP Descripción h2t es una herramienta simple para ayudar a los administradores de sistemas a endurecer sus sitios web. Hasta ahora h2t verifica las cabeceras del sitio web y recomienda cómo mejorarlas. Dependencias Python 3 colorama requests Instalación $ git...

wonitor

Monitor web Monitor de cambios de endpoints web rápido y sin configuración. Para comparar respuestas, una lista seleccionada de encabezados HTTP y el cuerpo completo de la respuesta se almacenan en un archivo local de almacenamiento clave/valor. No se necesita configuración. para aumentar el...

wsvuls

WSVuls Escáner de vulnerabilidades de sitios web que detecta problemas versión de servidor desactualizada y cabeceras HTTP inseguras. ¿Qué es WSVuls? WSVuls es una herramienta de línea de comandos simple y potente para Linux, Windows y macOS. Está diseñada para desarrolladores/testers y para...

ipsourcebypass

Este script de Python se puede usar para eludir las restricciones de fuente IP usando cabeceras HTTP. Características 17 cabeceras HTTP. Multihilo. Exportación JSON con --json outputfile.json. Detección automática de las soluciones más exitosas. Uso $ ./ipsourcebypass.py -h IP source bypass using...

PT-2026-117847

Security vulnerability affects the apache-nifi package. When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written...

CVE-2026-107714

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agentresponseredirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cooki...

EUVD-2026-95320

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agentresponseredirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cooki...

EUVD-2026-94589

AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader Bypass of CVE-2024-53990 Fix...

CVE-2023-5648

In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL paths, aiding unauthenticated attackers to perform attacks such as Cross-Site Scripting, Clickjacking, Information disclosure, and more...

EUVD-2023-60709

In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL paths, aiding unauthenticated attackers to perform attacks such as Cross-Site Scripting, Clickjacking, Information disclosure, and more...

CVE-2026-87670

An authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST API gateway. The internal gate guarding restricted management endpoints relies exclusively on client-controlled HTTP headers. An authenticated user with any valid REST session can spoof these headers ...