1033 matches found
CVE-2026-73857
A flaw was found in ModSecurity. When XML request body argument parsing is enabled, processing certain XML elements leaves an internal pointer uninitialized. A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted HTTP request containing an XML payload. This causes...
CVE-2025-1974
README Talk is cheap, just look at the code. Detailed can be found at https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities Usage 1. Change the ip in shell.c 2. Check the docker is available and run make shell.so. We need to build so in alpine to make sure it can works in...
CVE-2026-123864
A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys and other users' requests. TLSWrap::DoWrite calls ClearOut directly when asked to write zero bytes; if that write is issued from JavaScript running inside the...
CVE-2026-34040-PoC
CVE-2026-34040 — Docker/Moby AuthZ Plugin Bypass Lab PoC EN: A lab reproduction of a vulnerability that bypasses Docker Moby authorization AuthZ plugins using an oversized 1MB request body. Vulnerability facts Item| Value ---|--- CVE| CVE-2026-34040 CVSS 3.1| 8.8 High —...
EUVD-2026-122993
The ai-azure-content-safety plugin in Kong Gateway Enterprise skips inspection of request bodies larger than the in-memory body buffer, allowing prompts to bypass input content-safety checks...
CVE-2026-96437
The ai-azure-content-safety plugin in Kong Gateway Enterprise contains a vulnerability where it skips inspection of request bodies that exceed the size of the in-memory body buffer. This flaw allows attackers to bypass input content-safety checks by providing large prompts. The vulnerability is a...
CVE-2026-96437
The ai-azure-content-safety plugin in Kong Gateway Enterprise skips inspection of request bodies larger than the in-memory body buffer, allowing prompts to bypass input content-safety checks...
CVE-2026-86531
The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files it creates for multipart parts. A remote unauthenticated attacker can cause excessive memory or disk usage, leading to denial of service. Deploymen...
EUVD-2026-121163
The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files it creates for multipart parts. A remote unauthenticated attacker can cause excessive memory or disk usage, leading to denial of service. Deploymen...
CVE-2026-86531
The Apache TomEE embedded OpenEJB HTTP server is vulnerable to a Denial of Service (DoS) attack because it lacks limits on the size of incoming request bodies and multipart requests. Additionally, it fails to remove temporary files created during multipart processing. A remote unauthenticated att...
CVE-2026-86531 Apache TomEE: DoS via unbounded request body and multipart handling in embedded HTTP server
The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files it creates for multipart parts. A remote unauthenticated attacker can cause excessive memory or disk usage, leading to denial of service. Deploymen...
CVE-2026-86531
The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files it creates for multipart parts. A remote unauthenticated attacker can cause excessive memory or disk usage, leading to denial of service. Deploymen...
CVE-2026-86531: Apache Software Foundation Apache TomEE: The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does…
The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files it creates for multipart parts. A remote unauthenticated attacker can cause excessive memory or disk usage, leading to denial of service. Deploymen...
CVE-2026-96437: Kong Inc. Kong Gateway Enterprise: The ai-azure-content-safety plugin in Kong Gateway Enterprise skips inspection of request bodies larger than the…
The ai-azure-content-safety plugin in Kong Gateway Enterprise skips inspection of request bodies larger than the in-memory body buffer, allowing prompts to bypass input content-safety checks...
PT-2026-144835
Name of the Vulnerable Software and Affected Versions Kong Gateway Enterprise affected versions not specified Description The ai-azure-content-safety plugin fails to inspect request bodies that exceed the size of the in-memory body buffer. This allows prompts to bypass input content-safety checks...
CVE-2026-73857
ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. From 3.0.15 until 3.0.17, XML request body processing with SecParseXmlIntoArgs set to On or OnlyArgs can leave XMLNodes::parsingctxarg uninitialized in the SAX end-element callback. A sing...
EUVD-2026-120508
ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. From 3.0.15 until 3.0.17, XML request body processing with SecParseXmlIntoArgs set to On or OnlyArgs can leave XMLNodes::parsingctxarg uninitialized in the SAX end-element callback. A sing...
CVE-2026-73857 ModSecurity v3 XML Request Body Processor Uninitialized Pointer Dereference Vulnerability
ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. From 3.0.15 until 3.0.17, XML request body processing with SecParseXmlIntoArgs set to On or OnlyArgs can leave XMLNodes::parsingctxarg uninitialized in the SAX end-element callback. A sing...
CVE-2026-73857 ModSecurity v3 XML Request Body Processor Uninitialized Pointer Dereference Vulnerability
ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. From 3.0.15 until 3.0.17, XML request body processing with SecParseXmlIntoArgs set to On or OnlyArgs can leave XMLNodes::parsingctxarg uninitialized in the SAX end-element callback. A sing...
tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS
Summary The HTTP server mode of @tsparticles/mcp-server accumulates all incoming request body chunks into an in-memory Buffer array with no size limit before calling JSON.parse. An unauthenticated remote attacker can stream an arbitrarily large body to POST /mcp, exhausting the Node.js process...