CVE-2020-17530

CVE-2020-17530 Quick POC for CVE-2020-17530. In Apache Struts versions 2.0.0 - 2.5.25 a forced Object Graph Navigational Language OGNL evaluation on raw user input in tag attributes may lead to remote code execution RCE. $ python CVE-2020-17530.py --help usage: CVE-2020-17530.py -h -c COMMAND -n...

cve-2025-24813-poc

CVE-2025-24813 Apache Tomcat RCE Exploit PoC This repository contains a proof-of-concept exploit for CVE-2025-24813, a Java deserialization vulnerability in Apache Tomcat. Based on absholi7ly/POC-CVE-2025-24813/. Prerequisites Docker Setup 1. Install dependencies: uv venv source .venv/bin/activat...

l4j-info

l4j-info Compiling valuable links as I find them documenting CVE-2021-44228 or Log4J Critical First Party advisories: Existing Log4J 1.2 vulnerability CVE-2019-17571 is also potentially present Apache Log4J Version 2.x Security Information VMWare critical vulnerability advisory Cisco product...

CVE-2026-34197-PoC

CVE-2026-34197 — Apache ActiveMQ Jolokia addNetworkConnector RCE Proof-of-concept and technical notes for CVE-2026-34197 , a remote code execution vulnerability in Apache ActiveMQ Classic reachable through the Jolokia JMX-HTTP bridge. Affected: ActiveMQ Classic ⚠️ For authorized testing / research...

ghostcatch

ghostcatch Python to disable AJP connectors in Apache Tomcat to remediate CVE-2020-1938 Ghostcat! Currently written for: Python 2.7 Requires: pip install progress Usage: python ghostCatch.py -help is the flag for usage Example: python ghostCatch.py -help -path is the flag to specify path Example:...

cve-2025-31651

CVE-2025-36701 — Apache Tomcat - Rewrite rule bypass Discoverer: gregk4sec https://github.com/gregk4sec/cve Discovery Date: 2025-02-28 Affected Vendor: Apache Affected Product: Tomcat 9.0.x / 10.1.x / 11.0.x Severity: Critical / High CWE: CWE-116 Status: Under Review / Fixed / Public ✅ / Private...

CVE-2026-96806

The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but KeycloakJWTMiddleware then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: afte...

CVE-2026-94134

The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless hostkey is configured or nohostkeycheck is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position...

CVE-2026-94135

The Apache Airflow SFTP provider's deferrable code paths SFTPTrigger, SFTPHookAsync, SFTPClientPool disable SSH host-key verification by default unless the connection explicitly sets nohostkeycheck to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attack...

CVE-2026-92228

The Apache Airflow Keycloak provider's multi-team provisioning attachteampermissions granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team...

CVE-2025-24813-POC

CVE-2025-24813 Proof-of-Concept Standalone This repository contains a non-destructive, standalone PoC for CVE-2025-24813, a vulnerability in Apache Tomcat 9.0.55 allowing remote file upload via partial PUT requests. This exploit demonstrates code execution by uploading and accessing a benign JSP...

CVE-2026-94135 Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default

The Apache Airflow SFTP provider's deferrable code paths SFTPTrigger, SFTPHookAsync, SFTPClientPool disable SSH host-key verification by default unless the connection explicitly sets nohostkeycheck to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attack...

CVE-2026-94135 Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default

The Apache Airflow SFTP provider's deferrable code paths SFTPTrigger, SFTPHookAsync, SFTPClientPool disable SSH host-key verification by default unless the connection explicitly sets nohostkeycheck to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attack...

CVE-2026-94135

The Apache Airflow SFTP provider contains a vulnerability where the deferrable code paths (SFTPTrigger , SFTPHookAsync , and SFTPClientPool ) disable SSH host-key verification by default. This occurs unless the connection explicitly sets no_host_key_check to false. Affected deployments running SF...

CVE-2026-94135 Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default

The Apache Airflow SFTP provider's deferrable code paths SFTPTrigger, SFTPHookAsync, SFTPClientPool disable SSH host-key verification by default unless the connection explicitly sets nohostkeycheck to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attack...

CVE-2026-96806 Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token

The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but KeycloakJWTMiddleware then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: afte...

CVE-2026-96806

The Apache Airflow Keycloak auth manager is vulnerable to a session management flaw where the logout route fails to terminate the user session. Although the logout route revokes the presented token, the KeycloakJWTMiddleware component issues a new, unrevoked token within the same response, effect...

CVE-2026-96806 Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token

The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but KeycloakJWTMiddleware then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: afte...

CVE-2026-94134 Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default

The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless hostkey is configured or nohostkeycheck is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position...

CVE-2026-94134

The Apache Airflow SSH provider hook contains a vulnerability where it disables SSH host-key verification by default. Unless a host_key is configured or no_host_key_check is explicitly set to false, the hook accepts any server key. This affects both SSH and SFTP connections and allows an attacker...