galah

TL;DR: Galah /ɡəˈlɑː/ - pronounced ‘guh-laa’ is an LLM-powered web honeypot designed to mimic various applications and dynamically respond to arbitrary HTTP requests. Galah supports major LLM providers, including OpenAI, GoogleAI, GCP's Vertex AI, Anthropic, Cohere, and Ollama. Unlike traditional...

wotop

Web-On-Top-Of-Protocol WOTOP ██╗ ██╗ ██████╗ ████████╗ ██████╗ ██████╗ ██║ ██║██╔═══██╗╚══██╔══╝██╔═══██╗██╔══██╗ ██║ █╗ ██║██║ ██║ ██║ ██║ ██║██████╔╝ ██║███╗██║██║ ██║ ██║ ██║ ██║██╔═══╝ ╚███╔███╔╝╚██████╔╝ ██║ ╚██████╔╝██║ ╚══╝╚══╝ ╚═════╝ ╚═╝ ╚═════╝ ╚═╝ Introduction WOTOP is a tool meant to...

cdb

Pown CDB Pown CDB is a Chrome Debug Protocol utility. The main goal of the tool is to automate common tasks to help debug web applications from the command-line and actively monitor and intercept HTTP requests and responses. This is particularly useful during penetration tests and other types of...

Linux Distros Unpatched Vulnerability : CVE-2026-65059

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses. Furl inflates a response body sent with a gzip, x-gzi...

CVE-2026-65059: Improper Handling of Highly Compressed Data

Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses. Furl inflates a response body sent with a gzip, x-gzip or deflate Content-Encoding and appends the output to the response string with no size limit. It does this whether or not the request...

ColonelClustered

Colonel Clustered - Response Similarity Clustering v1.0.1 A Burp Suite extension for clustering HTTP responses to find outliers. Intro This is a plugin I've been thinking about building for many years, simply because I'm moderately annoyed by how we analyze results of fuzzing attacks in Burp...

SUSE CVE-2026-118374

LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to...

CVE-2026-118374

LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to...

PT-2026-127740

LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to http...

CVE-2026-118374: OpenBSD LibreSSL: LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to…

LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to...

Python CPython input validation error vulnerability

A vulnerability related to input validation exists in Python versions prior to CPython 3.16.0. This vulnerability stems from improper handling of non-hexadecimal or negative integers in response bodies and chunk parsing, potentially leading to misinterpretation of HTTP responses...

ssrf-sheriff

SSRF Sheriff Este es un sheriff de pruebas SSRF escrito en Go. Fue creado originalmente para el Uber H1-4420 2019 London Live Hacking Event, pero ahora se está publicando como código abierto para que otras organizaciones lo implementen y contribuyan. Características Responde a cualquier método HT...

CVE-2026-82043 UTMStack < 11.2.16 Account Enumeration via Password Reset Endpoint

UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and...

CVE-2026-82043: Observable Response Discrepancy

UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and...

netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion

A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses 103, followed by a 200 with a GET body, then another 200 for a HEAD request when the client pipelines GET the...

FreeRDP: FreeRDP: Resource exhaustion due to oversized chunked HTTP responses

A vulnerability in FreeRDP allows a malicious RD Gateway to bypass client-side size limits by sending oversized chunked HTTP responses. This exhausts the client's memory, resulting in a Denial of Service DoS...

CRLF Injection

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to CRLF Injection via improper validation of newline characters in subdomain redirect URLs. An attacker can inject arbitrary web server configuration directives by supplying specially...

aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability involves an out-of-bounds heap read in the C response parser when processing malformed HTTP responses. An attacker operating a malicious server, or even an accidental malformed response, could exploit th...

aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability involves an out-of-bounds heap read in the C response parser when processing malformed HTTP responses. An attacker operating a malicious server, or even an accidental malformed response, could exploit th...

UBUNTU-CVE-2026-54770

WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response.makelocationabsolute in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin strips leading C0 control characters and spaces. An attacker-controlled valu...