41229 matches found
CVE-2023-44487
Please note that the above code uses the libcurl library for making HTTP requests. You need to install libcurl and link against it when compiling the code. The code is a simplified version, and you may need to adjust it based on your exact requirements and the specific behavior of the HTTP/2 atta...
EUVD-2026-111549
LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host discards the OCSP URL scheme and httpalloc only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports, exposing certificate serial...
EUVD-2026-111547
LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSPsendreqnew and OCSPparseurl functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information...
PT-2026-129173
Name of the Vulnerable Software and Affected Versions ai-gateway-payload-processing affected versions not specified Description An authenticated remote attacker can perform unauthorized requests and consume another tenant's large language model LLM resources and quotas. The issue occurs because t...
PT-2026-128223
HCL BigFix AEX product is affected by a vulnerability in the aws-sdk package.. It may cause AWS API requests to be sent to unintended or nonâAWS endpoints...
PT-2026-128226
HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could allow an attacker to cause the application to send unauthorized requests to external resources. Successful exploitation could lead to access to unintended services, sensitive information disclosure, or...
CVE-2026-99114
In the Linux kernel, the following vulnerability has been resolved: ksmbd: initialize FileSystemControlFlags in FSCONTROLINFORMATION smb2getinfofilesystem reports 48 bytes for FSCONTROLINFORMATION, that is the whole of struct smb2fscontrolinfo, but never assigns FileSystemControlFlags. Those four...
PT-2026-129172
Gearboy is a Game Boy, Game Boy Color, and Super Game Boy emulator and debugger with an embedded MCP server. Gearsystem, the affected component, has an optional --mcp-http mode that accepts unauthenticated MCP requests from any reachable network peer despite localhost-only documentation and...
CVE-2024-7954POC
CVE-2024-7954POC The porteplume plugin used in SPIP versions before 4.30-alpha2, 4.2.13, and 4.1.16 has an arbitrary code execution vulnerability. Remote unauthenticated attackers can execute arbitrary PHP code as SPIP users by sending specially crafted HTTP requests...
westone-CVE-2022-1388-scanner
westone-CVE-2022-1388-scanner Undisclosed requests may bypass iControl REST authentication. Installation & Usage git clone https://github.com/Osyanina/westone-CVE-2021-21980-scanner.git cd westone-CVE-2022-1388-scanner cmd CVE-2022-1388.exe...
CVE-2022-24112
CVE-2022-24112 Apache APISIX apisix/batch-requests RCE...
CVE-2023-26208
CVE-2023-26208 Exploit Automation For Educational Purposes đ¨ đ Description This is a Python script with a graphical interface Tkinter that allows the user to test automated request submissions to a login endpoint. The goal is to simulate how servers respond to different payload sizes and analyze...
halogen
Halogen is a tool to automate the creation of yara rules based on the image files embedded within a malicious document. This can assist cyber security professionals in writing detection rules for malicious threats as well as help responders in identifying with particular threat they are dealing...
CVE-2026-116686 Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with jsonschema's default resolver, causing...
CVE-2026-116686 Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with jsonschema's default resolver, causing...
CVE-2026-116686
The Model Context Protocol Python SDK contains a vulnerability in versions 1.10.0 through 1.30.0 and 2.2.0 . The ClientSession, ClientSessionGroup, and Client tool calls use the default resolver in jsonschema to validate server-declared outputSchema documents. This allows a server to provide an u...
EUVD-2026-111366
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with jsonschema's default resolver, causing...
@better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL
Am I affected? You are affected if you use @better-auth/drizzle-adapter from 1.6.17 through versions before 1.7.7 including the 1.7.0 prereleases from beta.6 through rc.6 or @better-auth/kysely-adapter 1.6.17 through 1.6.31, and keep rate-limit records in a PostgreSQL database. All of these must ...
GHSA-44JH-23M7-HPCF @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL
Am I affected? You are affected if you use @better-auth/drizzle-adapter from 1.6.17 through versions before 1.7.7 including the 1.7.0 prereleases from beta.6 through rc.6 or @better-auth/kysely-adapter 1.6.17 through 1.6.31, and keep rate-limit records in a PostgreSQL database. All of these must ...