claude-create-CVE-2025-29927

Next.js Middleware Vulnerability Tester CVE-2025-29927 This application demonstrates the Next.js middleware authorization bypass vulnerability CVE-2025-29927. About The Vulnerability CVE-2025-29927 is an authorization bypass vulnerability in Next.js middleware. By sending a specially crafted HTTP...

EUVD-2026-107261

chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For...

Echo: Decompress permits unbounded gzip expansion in v4

Impact Echo v4's opt-in Decompress middleware exposed a gzip-decoded request stream without limiting its expanded size. A small compressed request could therefore produce a very large decoded body. Handlers that read or bind that body could consume excessive memory or CPU, and repeated or...

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

Impact Echo's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validating whether the configured upstream accepted it. If the upstream returned an ordinary HTTP response and kept the connection alive, subsequent HTTP requests on that connection were...

toxy

toxy Not actively maintained, may not work with latest node.js runtimes. If you are interested in maintaining toxy, please open an issue. Hackable HTTP proxy to simulate server failure scenarios , systems resiliency testing and unexpected network conditions , built for node.js. It was mainly...

UBUNTU-CVE-2026-114437

In the Golang Chi web framework, the ClientIPFromXFF middleware skips...

CVE-2026-114437

In the Golang Chi web framework, the ClientIPFromXFF middleware skips...

Oracle WebCenter Sites (October 2026 CPU)

The 12.2.1.4.0 and 14.1.2.0.0 versions of WebCenter Sites installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware component: WebCenter Sites Apache Log4j...

Node.js Module TanStack Start 1.143.12 < 1.168.56 / 1.168.57 / 1.168.60 / 1.169.39 XSS (CVE-2026-102989)

The versions of the TanStack Start Node.js modules installed on the remote host are 1.143.12 or later, prior to their respective patched versions. They are, therefore, affected by a cross-site scripting vulnerability: - The server-function transport passes request payload fields into internal...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell-poc — Go edition A Go toolkit for CVE-2026-109618...

GHSA-MCHM-GJX6-7H55 Sentry-Javascript: Middleware Bypass when using Tunnel route

Impact The tunnelRoute option makes the SDK send browser events to a path on your own Next.js server for example /monitoring, where a rewrite forwards them to Sentry to prevent ad blockers from blocking them. To keep those envelope requests from being rejected by your middleware, the SDK skips...

EUVD-2026-107549

Sentry-Javascript: Middleware Bypass when using Tunnel route...

Sentry-Javascript: Middleware Bypass when using Tunnel route

Impact The tunnelRoute option makes the SDK send browser events to a path on your own Next.js server for example /monitoring, where a rewrite forwards them to Sentry to prevent ad blockers from blocking them. To keep those envelope requests from being rejected by your middleware, the SDK skips...

CVE-2026-115333

Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashedkey. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ ...

CVE-2026-115333 Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix

Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashedkey. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ ...

CVE-2026-115333 Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix

Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashedkey. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ ...

CVE-2026-115333

The Lotus platform (through version 0.10.2 ) is susceptible to an improper authentication vulnerability within the Go event ingestion middleware . The root cause is that the middleware validates API keys based on the prefix only , failing to verify the secret against the stored hashed_key. An att...

EUVD-2026-108135

Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashedkey. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ ...

Vulnerabilities in Oracle Fusion Middleware

Oracle has identified several vulnerabilities in various products, including the Oracle SOA Suite, Oracle WebLogic Server, Oracle Data Integrator, Oracle Identity Manager, Oracle Access Manager, Oracle WebCenter Content, Oracle Fusion Middleware including Helidon, and Oracle HTTP Server. These...

Linux Distros Unpatched Vulnerability : CVE-2026-114437

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct...