httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi

A flaw was found in the modproxyuwsgi module of Apache HTTP Server. This issue allows HTTP response smuggling when the server processes a crafted uWSGI response containing a Transfer-Encoding header. A remote attacker can exploit this vulnerability to desynchronize HTTP communications, potentiall...

CVE-2026-11101-HTTP-Cache-Poisoning-via-Unkeyed-Query-Parameter

CVE-2026-11101 – HTTP Cache Poisoning via Unkeyed Query Parameter Overview A web cache uses only the URL path as the cache key, ignoring query parameters. An attacker can append a malicious payload to an unkeyed parameter e.g., utmcampaign and poison the cache. Subsequent visitors receive the...

CVE-2026-63718

A flaw was found in the modproxyuwsgi module of Apache HTTP Server. This issue allows HTTP response smuggling when the server processes a crafted uWSGI response containing a Transfer-Encoding header. A remote attacker can exploit this vulnerability to desynchronize HTTP communications, potentiall...

CVE-2026-51376

PoC of BLE cache poisoning attack in Bitchat 1.15.0 Write up: https://barghest.asia/blog/bitchat-cache-poisoning/ Requirements: bleak, pynacl Usage: python3 barghest.py --scan python3 barghest.py --target...

CVE-2026-31431-PocC

CVE-2026-31431-PoC CVE-2026-31431 PoC reproduced in C, usable for exploitation when Python is not available on the target environment. Vulnerability Basic Information Vulnerability type: Linux kernel AFALG subsystem page cache poisoning, achieving local privilege escalation and possible container...

CVE-2025-40778

CVE-2025-40778 Proof of Concept Educational demonstration of DNS Cache Poisoning vulnerability via Additional Records injection. ⚠️ Disclaimer FOR EDUCATIONAL PURPOSES ONLY This tool is provided for educational and authorized security testing purposes only. Unauthorized use of this tool against...

CVE-2026-104056

The Authlib library (version 1.7.2 and below) is vulnerable to a flaw where OpenID Connect (OIDC) and OAuth discovery metadata are cached without validation or issuer-origin binding. A remote attacker providing a malicious discovery response can replace legitimate service endpoints with attacker-...

CVE-2026-31431

copyfun CVE 2026-31431 の簡単なエクスプロイトデモ copyfun は、指定されたターゲットファイルのキャッシュを、提供されたペイロードバイトで汚染します。...

linux-copy-fail-CVE-2026-31431

Linux Copy-Fail Analysis CVE-2026-31431 🛡️ This repository contains an in-depth analysis, Proof-of-Concept PoC, and laboratory test results for the CVE-2026-31431 vulnerability, popularly known as "Copy-Fail". Copy-Fail exploits a logic flaw in the Linux Kernel’s Crypto API AFALG combined with the...

copy-fail_LPE_Interactive

CVE-2026-31431 Copy Fail Exploit Linux kernel page cache poisoning exploit tool with support for non-interactive command execution. Vulnerability Overview CVE-2026-31431 is a logic flaw in the Linux kernel, present in the authesn AEAD algorithm implementation. Through the AFALG and splice system...

copy-fail-tiny-elf-CVE-2026-31431

Copy Fail Tiny ELF - CVE-2026-31431 Minimal 436-bytes exploit for Copy Fail, thanks to the power of golfing Magic This ELF ultra golfs the exploit by being totally unmapped, rwx, and by using itself conditionally as the ELF payload to use to poison the cache. More cursed ELF internals golfs comin...

CVE-2026-1010-WebSocket-Connection-Smuggling-via-Malformed-Upgrade-Header

CVE-2026-1010 – WebSocket Connection Smuggling Overview A reverse proxy and backend disagree on how to parse an HTTP request with a malformed WebSocket upgrade header. The proxy treats it as one request, while the backend interprets it as two, allowing an attacker to smuggle a hidden request. Thi...

dompdf-rce

RCE exploit for dompdf This repository contains a vulnerable demo application using dompdf 1.2.0 and an exploit that achieves remote code execution via a ttf+php polyglot file. For more details, please visit https://positive.security/blog/dompdf-rce Instructions 1. Run the demo application $ cd...

CVE-2026-63030

CVE-2026-63030 - WordPress REST API Batch Route Confusion PoC Description Proof-of-concept exploit for CVE-2026-63030, a pre-authentication vulnerability in WordPress versions 6.9.0 through 7.0.1. It chains: REST API batch route confusion validation vs dispatch mismatch SQL injection via...

next_js_poisoning

CVE-2024-4698 is a cache poisoning vulnerability in Next.js that impacts versions 13.5.1 to 13.5.7, as well as 14.0.0 through 14.2.10. The issue arises when websites leverage the next/image?url= API with the ?url= parameter, enabling attackers to load images hosted on their own servers. These...

RLSA-2026:73428 Important: nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

BIND-9-Cache-Poisoning-PoC---CVE-2025-40778

BIND 9 キャッシュポイズニング PoC - CVE-2025-40778 概念の概要 この脆弱性により、攻撃者はBINDリゾルバのDNSキャッシュを破壊し、正規ユーザーを気付かれないまま悪意のあるIPアドレスへリダイレクトさせることができます。 攻撃の核となるロジック: この攻撃は信頼を悪用することに依存しています。被害者はリゾルバを信頼し、リゾルバ（BIND）は権威サーバから受け取った回答を信頼します。この欠陥は、BIND が DNS レスポンスの ADDITIONAL...

CVE-2024-46982-Reproduction

Getting Started 1. Install Node.js LTS 2. npm install 3. npm run build 4. npm run start Exploitation 1: Stored XSS via Cache Poisoning 1. Send the following HTTP request Attack Request using any HTTP client. GET /poc?nextDataReq=1 HTTP/1.1 Host: localhost:3000 User-Agent: alert'XSS'...

RLSA-2026:74085 Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation CVE-2026-85152 undici: undici: TLS...

Rocky Linux 9 [CIQ] Security Update: bind / bind-chroot / bind-debuginfo / bind-debugsource / bind-devel / etc Multiple Vulnerabilities (crlsa-2022_8068)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20228068 advisory. bind: DNS forwarders - cache poisoning vulnerability CVE-2021-25220 bind: DoS from specifically crafted TCP packets CVE-2022-0396 Tenable has extracted the...