traefik-CVE-2024-45410-poc

Sfida CTF Shadow Corp Benvenuto alla sfida Capture the Flag CTF di Shadow Corp! Questa sfida metterà alla prova le tue abilità nell'identificare e sfruttare vulnerabilità relative agli header di sicurezza e al comportamento dei proxy HTTP. La tua missione è bypassare le protezioni e scoprire...

rewrite-cve-2026-22732

rewrite-cve-2026-22732 Ricetta OpenRewrite che rileva codice vulnerabile a CVE-2026-22732, un difetto di Spring Security in cui l'impostazione di Content-Length tramite uno dei tre metodi di risposta bypassa OnCommittedResponseWrapper di Spring Security. Poiché il wrapper non vede mai l'header,...

wphunter

Strumento WPHunter ☣ WPHunter Uno scanner di vulnerabilità per WordPress Puoi usare questo strumento sul tuo sito WordPress per controllare la sicurezza del tuo sito trovando le vulnerabilità presenti. Oltre 75 milioni di siti web funzionano con WordPress, che ora alimenta il 26% del Web...

CVE-2026-54477

CVE-2026-54477: Im Admin-Panel fehlende Security-Header Clickjacking / XSS Advisory Feld| Wert ---|--- CVE| CVE-2026-54477 ICSA| ICSA-26-183-03 Gardyn IoT Hub CVSS 3.1| 5.4 Mittel Vector 3.1| CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Vector 4.0|...

nginxconfig.io

...

cve-2026-22732-demo

CVE-2026-22732 Demo Minimale Reproduktion von CVE-2026-22732 — Spring Security HTTP-Response-Header werden stillschweigend verworfen, wenn Controller-Code direkt in die Servlet-Response schreibt. Die Schwachstelle Spring Security verwendet standardmäßig „lazy“ Header-Schreiben. Wenn ein Controlle...

Recon-Scan

Recon-Scan ReconScan é um scanner de reconhecimento passivo de código aberto com backend FastAPI, pipeline de worker assíncrono e frontend de página única. Você pode verificar o site implantado em https://recon-scan.vercel.app/ O objetivo é sinal rápido: execute uma varredura, obtenha resultados...

zappzarapp-php-security

⚡ zappzarapp/security Comprehensive PHP security library providing CSP, Security Headers, CSRF protection, Secure Cookies, Password Validation, Input Sanitization, Rate Limiting, SRI, Secrets Loading, Encryption, Session Security, TOTP two-factor authentication, Signed URLs, and Security Event...

CVE-2026-21784

HCL IntelliOps Event Management IEM is affected by missing or insecure Cross-Origin Security headers. This issue makes the application's environment and resources susceptible to unauthorized external interaction and potential exploitation...

EUVD-2026-63323

HCL IntelliOps Event Management IEM is affected by missing or insecure Cross-Origin Security headers. This issue makes the application's environment and resources susceptible to unauthorized external interaction and potential exploitation...

CVE-2026-21784

HCL IntelliOps Event Management (IEM) ships with missing or insecure Cross-Origin Resource Sharing (CORS) headers, allowing unauthorized external origins to read application resources. CVSS 3.1 rates this MEDIUM (4.8), requiring high privileges and user interaction. No patch version, exploit, or ...

SUSE CVE-2026-47723

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in internal/web/ or internal/api/ set the standard browser-security headers. grep for Content-Security-Policy, X-Frame-Options, Strict-Transport-Security,...

CVE-2026-47723

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in internal/web/ or internal/api/ set the standard browser-security headers. grep for Content-Security-Policy, X-Frame-Options, Strict-Transport-Security,...

CVE-2026-47723

Nebula-mesh is affected by missing security headers in internal/web/ and internal/api/ paths prior to v0.3.1 (up to v0.3.0). The root cause is absence of standard headers such as CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Strict-Transport-Security in responses, enabling cl...

CVE-2026-47723 nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in internal/web/ or internal/api/ set the standard browser-security headers. grep for Content-Security-Policy, X-Frame-Options, Strict-Transport-Security,...

CVE-2026-47723

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in internal/web/ or internal/api/ set the standard browser-security headers. grep for Content-Security-Policy, X-Frame-Options, Strict-Transport-Security,...

CVE-2026-47723 nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in internal/web/ or internal/api/ set the standard browser-security headers. grep for Content-Security-Policy, X-Frame-Options, Strict-Transport-Security,...

EUVD-2026-48424

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in internal/web/ or internal/api/ set the standard browser-security headers. grep for Content-Security-Policy, X-Frame-Options, Strict-Transport-Security,...

CVE-2026-54163

secureheaders manages application of security headers with many safe defaults. Prior to 7.3.0, secureheaders builds the Content-Security-Policy value by stitching directives with ; separators, and buildsandboxlistdirective, buildmediatypelistdirective, and buildreporttodirective interpolate...

CVE-2026-54163

secureheaders manages application of security headers with many safe defaults. Prior to 7.3.0, secureheaders builds the Content-Security-Policy value by stitching directives with ; separators, and buildsandboxlistdirective, buildmediatypelistdirective, and buildreporttodirective interpolate...