PT-2026-108816

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description The CompressionUtils.inflate function decompresses attacker-controlled DEFLATE data without an output-size cap, allowing a...

Apache Struts 2.1.8 <= 2.3.37 / 2.5.x <= 2.5.33 / 6.x < 6.12.0 / 7.x < 7.4.0 Denial of Service (S2-077)

The version of Apache Struts installed on the remote host is 2.1.8 through 2.3.37, or 2.5.0 through 2.5.33, or 6.x prior to 6.12.0, or 7.x prior to 7.4.0. It is, therefore, affected by a denial of service vulnerability, as referenced in the S2-077 advisory: - Allocation of resources without limit...

Apache HugeGraph 1.7.0 SecurityManager Sandbox Bypass Remote Code Execution

Apache HugeGraph version 1.7.0 contains a SecurityManager sandbox bypass that allows unauthenticated remote command execution through the Gremlin endpoint. !/usr/bin/env bash Apache HugeGraph 1.7.0 Sandbox Bypass Remote Code Execution Vendor: The Apache Software Foundation Product web page:...

Apache Struts 2.5.14 <= 2.5.33 / 6.x < 6.12.0 / 7.x < 7.4.0 Denial of Service (S2-076)

The version of Apache Struts installed on the remote host is 2.5.14 through 2.5.33, or 6.x prior to 6.12.0, or 7.x prior to 7.4.0. It is, therefore, affected by a denial of service vulnerability, as referenced in the S2-076 advisory: - Asymmetric resource consumption amplification vulnerability i...

PT-2026-108866

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description The STSTokenValidator and Security Token Service STS cache validated security tokens using a non-cryptographic 32-bit hash...

PT-2026-108813

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description StaxUtils does not impose limits on the total number of elements or characters in an XML document by default. This allows a...

PT-2026-109197

Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform copies the compressed frame into the write buffer without making sure it fits. Data that does not compress, such as...

Apache Struts 2.x <= 2.3.37 / 2.5.x <= 2.5.33 / 6.x < 6.12.0 / 7.x < 7.4.0 Multiple Vulnerabilities (S2-075) (S2-078)

The version of Apache Struts installed on the remote host is 2.0.0 through 2.3.37, or 2.5.0 through 2.5.33, or 6.x prior to 6.12.0, or 7.x prior to 7.4.0. It is, therefore, affected by multiple vulnerabilities, as referenced in the S2-075 and S2-078 advisories: - Improper neutralization of specia...

AlmaLinux 9.2 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc (ALMALINUX9.2:CLSA-2026:1791536084)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791536084 advisory. - Out-of-bounds Write vulnerability in Apache HTTP Server's modcharsetlite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

AlmaLinux 9.2 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791538487)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791538487 advisory. - Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to...

fastjson

fastjson Fastjson es una librería de Java que se puede usar para convertir objetos Java a su representación JSON. También se puede usar para convertir una cadena JSON en un objeto Java equivalente. Fastjson puede trabajar con objetos Java arbitrarios, incluyendo objetos preexistentes de los cuale...

ApacheRCEEssay

CVE-2021-41773 Essay 🕸️ Description 🖼️ This repository contains an essay about CVE-2021-41773, a remote code execution vulnerability in Apache 2.4.49. This was created for a course from Faculty of Automatic Control and Computers, University POLITEHNICA of Bucharest, namely "Cyberdefences and...

Detections-CVE-2026-23918

MOVING TO: https://github.com/insomnisec/publiccvedetections FOR BETTER LONG TERM MANAGEMENT OF DETECTION PUBLICATIONS THIS REPO WILL BE REMOVED IN JUNE 2026 PLEASE USE THE OTHER REPO GOING FORWARD CVE-2026-23918 "Apache HTTP/2 Double-Free" — Detection & Response Package Published: 2026-05-04...

Log4jPatch

-- This repository has been archived -- Further development of this tool will continue at corretto/hotpatch-for-apache-log4j2. Thanks for sharing, commenting, trying it out and contributing to this project! Log4jPatch This is a POC of a simple tool which injects a Java agent into a running JVM...

poc-cve-2025-69219

CVE-2025-69219 apache airflow deserializzazione non sicura verso RCE 1. copia poc.py nella directory dags di Airflow. 2. avvia il workflow poc dall'UI. 3. controlla i log delle attività per l'output dell'esecuzione...

CVE-2020-17530

CVE-2020-17530 Quick POC for CVE-2020-17530. In Apache Struts versions 2.0.0 - 2.5.25 a forced Object Graph Navigational Language OGNL evaluation on raw user input in tag attributes may lead to remote code execution RCE. $ python CVE-2020-17530.py --help usage: CVE-2020-17530.py -h -c COMMAND -n...

cve-2025-24813-poc

CVE-2025-24813 Apache Tomcat RCE Exploit PoC This repository contains a proof-of-concept exploit for CVE-2025-24813, a Java deserialization vulnerability in Apache Tomcat. Based on absholi7ly/POC-CVE-2025-24813/. Prerequisites Docker Setup 1. Install dependencies: uv venv source .venv/bin/activat...

l4j-info

l4j-info Compiling valuable links as I find them documenting CVE-2021-44228 or Log4J Critical First Party advisories: Existing Log4J 1.2 vulnerability CVE-2019-17571 is also potentially present Apache Log4J Version 2.x Security Information VMWare critical vulnerability advisory Cisco product...

CVE-2026-34197-PoC

CVE-2026-34197 — Apache ActiveMQ Jolokia addNetworkConnector RCE Proof-of-concept and technical notes for CVE-2026-34197 , a remote code execution vulnerability in Apache ActiveMQ Classic reachable through the Jolokia JMX-HTTP bridge. Affected: ActiveMQ Classic ⚠️ For authorized testing / research...

ghostcatch

ghostcatch Python to disable AJP connectors in Apache Tomcat to remediate CVE-2020-1938 Ghostcat! Currently written for: Python 2.7 Requires: pip install progress Usage: python ghostCatch.py -help is the flag for usage Example: python ghostCatch.py -help -path is the flag to specify path Example:...