cve-2025-31651

CVE-2025-36701 — Apache Tomcat - Rewrite rule bypass Discoverer: gregk4sec https://github.com/gregk4sec/cve Discovery Date: 2025-02-28 Affected Vendor: Apache Affected Product: Tomcat 9.0.x / 10.1.x / 11.0.x Severity: Critical / High CWE: CWE-116 Status: Under Review / Fixed / Public ✅ / Private...

CVE-2025-31651-o

CVE-2025-31651 For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. 0x01 Status PUBLIC 0x02 PoC Finder see...

CVE-2015-0057

CVE-2015-0057 Exploitation on 32-bit and 64-bit Systems Author: Aaron Adams Translation: 55-AA Translator's Note: Some parts of this article are freely translated. Please refer to the original text for any questions. Terminology: Primitive: Similar to a functional function, it is a collection of...

cve-2025-32462

cve-2025-32462 sudo/NEWS at SUDO188 · sudo-project/sudo · GitHub The sudo -h --host documentation states that -h can only be used with -l. In later updates, sudo -h was allowed to be used with -e, -i, etc. sudo --host-h -l--list /etc/sudoer.d is used to check what permissions a user has on a...

Linux Distros Unpatched Vulnerability : CVE-2026-114460

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in modqos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 7.2. It arises because ioconnectbpfpopulate fills the CONNECT filter field only when addrlen is at least 28 bytes; however, IPv6 connection paths accept addresses with a SIN6LENRFC2133 value of 24 bytes. When addrlen is 24, the filter sees n...

CVE-2026-114460

A flaw was found in modqos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this...

CVE-2026-114460 Mod_qos: query truncation during json body merging permits security-rule bypass

A flaw was found in modqos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this...

CVE-2026-114460

A flaw in mod_qos involves an off-by-one pointer calculation error that occurs when merging request body parameters with an existing URL query. This error causes the query string to be truncated during security evaluation while the actual request remains unchanged. An unauthenticated remote attac...

CVE-2026-114460 Mod_qos: query truncation during json body merging permits security-rule bypass

A flaw was found in modqos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this...

PT-2026-121292

A flaw was found in mod qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit thi...

Unity Linux 20.1020e / 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-142513)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142513 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop The ah, hbh and rt matche...

CVE-2026-114101 Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass

Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename=iso-8859-1''shell.php, or filename alone, so...

CVE-2026-114101 Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass

Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename=iso-8859-1''shell.php, or filename alone, so...

CVE-2026-114101

Coraza versions prior to 3.8.1 are vulnerable to a FILES rule bypass due to improper handling of multipart upload filenames. The issue stems from the use of Go's mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters if the charset is not utf-8 or us-ascii . This allows unauthe...

CVE-2026-114101 Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass

Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename=iso-8859-1''shell.php, or filename alone, so...

GO-2026-6668 Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza

Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza...

WS-2026-0167

istio 1.2.0-rc.0 - 1.28.10 all EOL lines, no fix, 1.29.0-alpha.0 - 1.29.8, 1.30.0-alpha.1 - 1.30.5, 1.31.0-alpha.0 - 1.31.1, 1.32.0-alpha.0: AuthorizationPolicy methods/notMethods rules compile to a case-sensitive :method matcher, so an HTTP/2 request with a different-case method bypasses DENY or...

CVE-2026-104774

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/jsdecode.go:64-70 includes the backslash in the octal buffer, causing ParseInt to fail and return a null byte. The flaw is...

EUVD-2026-97824

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlencoded.go writes ARGSPOST without enforcing the cap. The fl...