CVE-2026-101087

Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate user-configurable notification and DDNS webhook URLs, but the denylist did not cover IPv6 transition ranges — specifically the 6to4 prefix 2002::/16 and the local-use IPv4/IPv6 translation prefix 64:ff9b:1::/48. Because...

CVE-2023-42793

Acerca de CVE-2023-42793 Primero necesitarás obtener el token utilizando un exploit diferente. Sin embargo, el siguiente exploit te permitirá obtener RCE en el servidor Linux, ya que codifica el payload en URL y lo envía al servidor. Cómo usar python3 ./main -t TEAMCITYTOKEN -u...

CVE-2022-30190

CVE-2022-30190 On Monday May 30, 2022, Microsoft issued CVE-2022-30190 regarding the Microsoft Support Diagnostic Tool MSDT in Windows vulnerability. A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who...

apache-struts-pwn_CVE-2017-9805

apache-struts-pwn - CVE-2017-9805 Exploit An exploit for Apache Struts CVE-2017-9805 Usage Check if the vulnerability exists against a single URL. python apache-struts-pwn.py --url 'http://example.com/struts2-rest-showcase/orders/3' Check if the vulnerability exists against a list of URLs. python...

thingsboard-ssrf-cve-2025-34282

CVE-2025-34282 — ThingsBoard SSRF via SVG Image Upload Overview Server-Side Request Forgery SSRF vulnerability in ThingsBoard IoT Platform versions before 4.2.1. An attacker with Tenant Admin access can upload a crafted SVG file containing an internal URL reference via the Image Upload Gallery...

CVE-2025-55752

CVE-2025-55752: Apache Tomcat Path Traversal Vulnerability A Docker-based reproduction environment to reproduce the path traversal vulnerability CVE-2025-55752 in Apache Tomcat 10.1.44. Overview CVE-2025-55752 is a path traversal vulnerability in the RewriteValve component of Apache Tomcat, cause...

CVE-2023-27163---SSRF-Baskets-Requests

CVE-2023-27163---SSRF-Baskets-Requests Create by TheAlchimist cve-2023-27163-ssrfbaskets.py example : cve-2023-27163-ssrfbaskets.py http://mysite.com http://localhost...

SealSecurity_Exam

SealSecurityExam Prototype pollution is a JavaScript vulnerability that enables an attacker to add arbitrary properties to global object prototypes, which may then be inherited by user-defined objects. A prototype pollution source is any user-controllable input that enables you to add arbitrary...

CVE-2026-88774

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to improper HTTP...

CVE-2026-101061

The utcp-gql and utcp-websocket libraries, in versions before 1.1.1 , are vulnerable to server-side request forgery (SSRF) . The vulnerability stems from an incomplete application of fixes for CVE-2026-44661. Specifically, the GraphQL plugin utilizes a flawed prefix check that allows bypasses usi...

CVE-2026-101061 utcp-gql and utcp-websocket before 1.1.1 SSRF via URL validation bypass

utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable prefix check allowing bypass URLs like http://127.0.0.1.attacker.example, while the WebSocket plugi...

EUVD-2026-87984

utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec and invokes a generated OAuth2-protected tool, the librar...

CVE-2026-101057 utcp-mcp before 1.1.3 SSRF via unvalidated MCP server URL

utcp-mcp the MCP plugin of python-utcp through 1.1.2 connects to the HTTP and WebSocket MCP server URLs given in a call template's mcpServers configuration without the ensuresecureurl validation that the HTTP-family plugins apply, so the HTTPS/WSS-or-loopback rule is not enforced. A call template...

CVE-2024-0195

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip pip install CVE-2024-0195 Run bellow command to check CVE-2024-0195 -h Configurations 2. We integrated with the Telegram API to receive...

CVE-2023-24044

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip pip install CVE-2023-24044 Run bellow command to check CVE-2023-24044 -h Configurations 2. We integrated with the Telegram API to receive...

EUVD-2026-87960

Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to improper HTTP...

CVE-2026-88774

CVE-2026-88774 is a policy bypass vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway caused by improper HTTP URL based expression usage. The flaw affects appliances where any policy utilizes these expressions. To remediate, users should upgrade to NetScaler ADC/Gateway 14.1-73.37 ...

claude-code-security-audit

Claude Code Security Audit & CVE-2026-21852 Scanner A security audit and environment hardening tool for Anthropic's Claude Code agentic CLI. Scans repositories for CVE-2026-21852 pre-trust execution surfaces, hook hijacking, malicious base URL redirection, and unauthenticated token exfiltration...

CVE-2022-21371

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip pip install CVE-2022-21371 Run bellow command to check CVE-2022-21371 -h Configurations 2. We integrated with the Telegram API to receive...

CVE-2020-3452

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip pip install CVE-2020-3452 Run bellow command to check CVE-2020-3452 -h Configurations 2. We integrated with the Telegram API to receive...