CVE-2026-34197

CVE-2026-34197 Outil de détection de sécurité ActiveMQ Classic Ceci est un outil d'évaluation de la surface d'exposition pour Apache ActiveMQ Classic, destiné aux équipes de défense et de vérification interne, afin d'aider à évaluer les risques liés à CVE-2026-34197. Ce projet ne contient aucun...

htb-facts

HTB — Facts Facile/Linux - Saison 10 Résumé Facts est une machine Linux de difficulté Facile qui nécessite l'exploitation d'une vulnérabilité connue CVE-2025-2304 dans Camaleon CMS pour extraire des identifiants AWS S3 locaux. L'énumération des buckets S3 internes révèle une clé privée SSH qui do...

AsyncHttpClient sends origin credentials to the proxy on the plaintext CONNECT request

Impact When a request uses an HTTP proxy to reach an HTTPS origin, the client opens the tunnel with a plaintext CONNECT sent to the proxy before any TLS exists. On affected versions the origin's preemptive credentials were added to that CONNECT. A Basic realm sent Authorization: Basic...

DEBIAN-CVE-2026-93120

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: fix out-of-bounds read of qwsign osdescqwsignshow passes OSSTRINGQWSIGNLEN as the input length to utf16stoutf8s, but that argument counts UTF-16 code units while OSSTRINGQWSIGNLEN 14 is the byte size of...

DEBIAN-CVE-2026-90161

In the Linux kernel, the following vulnerability has been resolved: erofs: fix interlaced ztailpacking pclusters On-disk sizes of interlaced pclusters should be block-aligned, and ztailpacking interlaced pclusters should be invalid at all. Currently, mkfs.erofs won't generate any interlaced...

CVE-2026-85720

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, a request using an HTTP proxy to reach an HTTPS origin can expose preemptive origin credentials because NettyRequestFactory and...

EUVD-2026-80871

oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing...

EUVD-2026-80805

RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields...

GHSA-27GV-RFVV-22MV RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields

Summary An information disclosure vulnerability exists in the AMQP client implementation's authentication handling configuration. Following a successful connection handshake, the Connection.Config.SASL field stores the Authentication implementation state used to establish the session. For standar...

RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields

Summary An information disclosure vulnerability exists in the AMQP client implementation's authentication handling configuration. Following a successful connection handshake, the Connection.Config.SASL field stores the Authentication implementation state used to establish the session. For standar...

CVE-2025-1868

CVE-2025-1868: Testeur HTTP de fuite NTLM pour Advanced IP Scanner et Advanced Port Scanner Petite application PHP dockerisée qui déclenche une négociation NTLM et extrait les domaine , utilisateur et poste de travail déclarés à partir des messages NTLM de type 3. Elle ne valide pas les mots de...

CVE-2026-85719

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 and 3.0.12, requests using an authenticated SOCKS proxy can expose the proxy's credentials to the origin because NettyRequestFactory and...

CVE-2026-93161 crypto: qat - clear AES key schedule from stack

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - clear AES key schedule from stack qatalgxtsreversekey expands the forward XTS AES key on the stack. That schedule contains key material and can remain in the stack frame. Clear the temporary cryptoaesctx with...

CVE-2026-93161

CVE-2026-93161 affects the Linux kernel 's crypto: qat subsystem (Intel Quick Assist Technology crypto driver). The function qat_alg_xts_reverse_key() expands the forward XTS AES key on the stack; the resulting key schedule contains sensitive key material that can remain in the stack frame after ...

tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.

A flaw was found in Apache Tomcat. During WebSocket authentication, the HTTP Authentication Header can be exposed to unexpected hosts. This vulnerability leads to information disclosure, potentially allowing an attacker to gain access to sensitive authentication credentials...

CVE-2025-55183

CVE-2025-55183 Сканер уязвимости раскрытия исходного кода React Server Functions. Что это? CVE-2025-55183: Server Actions в React 19.0.0-19.2.1 могут быть использованы для раскрытия полного исходного кода, включая жестко заданные секреты, ключи API и учетные данные баз данных. Ссылки:...

CVE-2026-85720

CVE-2026-85720 affects the AsyncHttpClient (AHC) Java library, a popular library for executing asynchronous HTTP requests. The vulnerability exists in NettyRequestFactory and NettyRequestSender.sendRequestWithNewChannel , which attach the origin Authorization header to the plaintext CONNECT reque...

CVE-2026-85720 AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, a request using an HTTP proxy to reach an HTTPS origin can expose preemptive origin credentials because NettyRequestFactory and...

CVE-2026-85720 AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, a request using an HTTP proxy to reach an HTTPS origin can expose preemptive origin credentials because NettyRequestFactory and...

CVE-2026-85719 AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 and 3.0.12, requests using an authenticated SOCKS proxy can expose the proxy's credentials to the origin because NettyRequestFactory and...