CVE-2025-29927-Nextjs-Bypass-PoC

PoC: CVE-2025-29927 - Next.js 中间件绕过 本仓库包含一个概念验证（PoC），演示了如何通过利用与内部 HTTP 标头相关的漏洞，绕过 Next.js v13.5.6 中的中间件安全检查。 漏洞概述：CVE-2025-29927 这是什么？ CVE-2025-29927 是一个 中间件绕过 漏洞，存在于 Next.js 1.11.4 及以下，以及 12.3.5、13.5.9、14.2.25 和 15.2.3 之前的版本中。它允许外部攻击者跳过开发者在 middleware.ts 文件中实现的安全逻辑——例如身份验证、机器人检测或地理位置重定向。 根本原因：标头...

CVE-2024-47167-Environment-Setup

组件： 1. gradiocontainer: 在端口5678上托管内部HTTP服务器 2. targetinternalserver: 启动一个使用有漏洞的gradio版本4.40.0的Python应用...

CVE-2026-55526

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, spidertools.hostisblocked does not resolve ordinary hostnames before scrapepage fetches them. A hostname such as 127.0.0.1.nip.io passes validation and resolves to loopback, permitting internal HTTP access. The fix uses...

CVE-2026-18359 Server-Side Request Forgery (SSRF) in eScriptorium

Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the server issue arbitrary HTTP requests to internal hosts, including the cloud instance metadata service, via the metsuri or iiifuri parameter o...

PYSEC-2026-2986 pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber

Impact OGC API - Process execution requests can use the subscriber object to requests to internal HTTP services. Patches The issue has been patched in master branch and made available as part of the 0.23.3 release. The patch disables any HTTP requests made to internal resources by default unless...

CVE-2026-28385

In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery SSRF vulnerability in the image import functionality allows authenticated users with the cancreateimages entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a...

CVE-2026-47139

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM supports excluding public network builtins from the wildcard builtin option. With this configuration direct access to http, https, http2, net, dgram, tls, dns, and dns/promises is blocked. However, Node.js also exposes...

CVE-2026-47139 vm2: NodeVM network builtin exclusions bypass via internal _http_client and _http_server

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM supports excluding public network builtins from the wildcard builtin option. With this configuration direct access to http, https, http2, net, dgram, tls, dns, and dns/promises is blocked. However, Node.js also exposes...

EUVD-2026-36444

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM supports excluding public network builtins from the wildcard builtin option. With this configuration direct access to http, https, http2, net, dgram, tls, dns, and dns/promises is blocked. However, Node.js also exposes...

CVE-2026-47139 vm2: NodeVM network builtin exclusions bypass via internal _http_client and _http_server

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM supports excluding public network builtins from the wildcard builtin option. With this configuration direct access to http, https, http2, net, dgram, tls, dns, and dns/promises is blocked. However, Node.js also exposes...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via the auth function in the file internal/http/evolutionhandlers.go. An attacker can gain unauthorized access or perform actions with insufficient permissions by sending crafted requests remotely. Remediation...

GHSA-R9PM-GXMW-WV6P NodeVM network builtin exclusions bypass via internal _http_client and _http_server

Summary NodeVM supports excluding public network builtins from the wildcard builtin option. With this configuration direct access to http, https, http2, net, dgram, tls, dns, and dns/promises is blocked. However, Node.js also exposes underscored internal HTTP builtins such as httpclient and...

NodeVM network builtin exclusions bypass via internal _http_client and _http_server

Summary NodeVM supports excluding public network builtins from the wildcard builtin option. With this configuration direct access to http, https, http2, net, dgram, tls, dns, and dns/promises is blocked. However, Node.js also exposes underscored internal HTTP builtins such as httpclient and...

PT-2026-45022

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.4 Description NodeVM allows the exclusion of public network builtins from the wildcard builtin option, which blocks direct access to modules such as 'http', 'https', 'http2', 'net', 'dgram', 'tls', 'dns', and...

CVE-2026-22726

Route Services can be leveraged to send app traffic to network destinations outside of an app's configured egress rules. As a result, a malicious developer with access to Cloudfoundry could configure a route-service that would allow it to send requests to HTTP services on internal networks...

CloudFoundry CF Deployment 和CloudFoundry Routing release 安全漏洞

CloudFoundry CF Deployment and CloudFoundry Routing are both products of the CloudFoundry Foundation. CloudFoundry CF Deployment is a code deployment component. CloudFoundry Routing release is a collection of application routing components. Both CloudFoundry CF Deployment and CloudFoundry Routing...

CVE-2026-22726 Route Services Firewall Bypass

Route Services can be leveraged to send app traffic to network destinations outside of an app's configured egress rules. As a result, a malicious developer with access to Cloudfoundry could configure a route-service that would allow it to send requests to HTTP services on internal networks...

PT-2026-36253

Route Services can be leveraged to send app traffic to network destinations outside of an app's configured egress rules. As a result, a malicious developer with access to Cloudfoundry could configure a route-service that would allow it to send requests to HTTP services on internal networks...

CVE-2025-52186

Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c 2025-06-02 contains a Server-Side Request Forgery SSRF vulnerability in the game export API. The players parameter is passed directly to an internal HTTP client without validation, allowing remote attackers to force the server to...

Log Injection

Django is vulnerable to log injection. The vulnerability is due to unescaped user input in request.path during internal HTTP response logging, allowing attackers to manipulate logs, forge entries, or hide malicious activity...