rbndr

rbndr Service simple de rebinding DNS rbndr est un serveur de noms très simple, non conforme, pour tester les logiciels contre les vulnérabilités de rebinding DNS. Le serveur répond aux requêtes en sélectionnant aléatoirement l'une des adresses spécifiées dans le nom d'hôte et en la renvoyant com...

behave

Behave! Расширение для браузера в разработке для мониторинга страниц, которые ведут себя плохо. Примечание : Это репозиторий кода проекта. Если вы ищете упакованные расширения: Firefox: https://addons.mozilla.org/en-US/firefox/addon/behave/ Chrome:...

EUVD-2026-67028

tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...

EUVD-2026-67027

tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, and a page i...

EUVD-2026-67023

pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named. A page in a brows...

dnsFookup

DnsFookup v 2.0.1 Cadre framework DNS Rebinding contenant : un serveur DNS bien sûr une API web Python pour créer de nouveaux sous-domaines et contrôler le serveur DNS, voir les logs, ce genre de choses une application React pourrie pour rendre ça plus confortable Journal des modifications...

dref

Framework d'exploitation par rebinding DNS Ce projet n'est plus maintenu. dref effectue le gros du travail pour le DNS rebinding. L'extrait suivant, issu de l'une de ses charges utiles intégrées, montre le cadre utilisé pour scanner un sous-réseau local depuis un navigateur compromis ; après avoi...

CVE-2025-45710

CVE-2025-45710 Подробнее читайте на: https://www.partywave.site о CVE-2024-54819 Настройка rebinder Это всего лишь пример с доступным веб-сервисом на момент написания. перейдите на https://lock.cmpxchg8b.com/rebinder.html выберите 2 адреса для переключения A,B протестируйте rebinding — случайным...

CVE-2026-81100

tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...

CVE-2026-81099

tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, and a page i...

CVE-2026-81095

pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named. A page in a brows...

CVE-2026-81102

CVE-2026-81102 affects the Dropbox Dash MCP server (src/mcp_server_dash.py), which in its network mode bound its listener to the loopback address but never validated the Host header , and included no transport-security settings. This allowed a DNS rebinding attack: a malicious page in a visitor's...

CVE-2026-81100

tiger-gh-mcp-server (by Timescale) started its MCP HTTP transport without enabling the DNS-rebinding-protection option provided by the underlying SDK. The file src/httpServer.ts called the shared httpServerFactory helper but never set the host allow-list, so the transport accepted requests regard...

CVE-2026-81099 Timescale tiger-slack DNS Rebinding via Disabled Host Header Allow-List

tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, and a page i...

CVE-2026-81099

Timescale's tiger-slack failed to enable the DNS-rebinding-protection option when starting its MCP HTTP transport in mcp/src/httpServer.ts, leaving the host allow-list disabled. This allowed a malicious web page to use DNS rebinding to steer requests to the locally bound Slack MCP server through ...

CVE-2026-81095

Timescale pg-aiguide (through 0.5.0 ) exposed a DNS-rebinding vulnerability in its MCP HTTP transport. The server at src/httpServer.ts called the httpServerFactory helper without setting the host allow-list (DNS-rebinding-protection) option provided by the underlying SDK, causing it to accept req...

CVE-2026-81092

mcp-go before 0.56.0 accepted HTTP requests on its Streamable HTTP and SSE transports without validating the Host header . Specifically, StreamableHTTPServer.ServeHTTP (server/streamable_http.go) and SSEServer.ServeHTTP (server/sse.go) served any request arriving over a loopback connection regard...

MindsDB -DNS Rebinding SSRF Protection Bypass

Detects DNS rebinding vulnerability that allows bypass of SSRF protection. The vulnerability exists in the URL validation mechanism where DNS resolution is performed without considering DNS rebinding attacks. id: CVE-2024-24759 info: name: MindsDB -DNS Rebinding SSRF Protection Bypass author: Lee...

CVE-2025-50505

CVE-2025-50505 API non authentifiée conduisant à l'exécution de commandes arbitraires et à l'escalade de privilèges dans Clash Verge Rev Description La vulnérabilité provient d'un point de terminaison API non authentifié exposé par le composant clash-verge-service, qui est installé avec des...

CVE-2026-51385

CVE-2026-51385 Рекомендация по CVE-2026-51385. Необходимо было опубликовать её, поскольку GRAPHIFY не распознала рекомендацию и не опубликовала её, а MITRE присвоила CVE-2026-51385; это и есть рекомендация. ES: Este fue mi primer cve, para ser honesto encontre una manera de romper la logica en la...