Hermes-Proxy

Hermes Proxy Hermes Proxy is a desktop HTTP/HTTPS interception app built with Electron and Vite. It captures requests/responses, lets you replay requests, and export/import HAR files. Features Live traffic table with request/response details Replay requests with editable URL/headers Export all...

mitmproxy2swagger

mitmproxy2swagger https://user-images.githubusercontent.com/5400940/168086818-c48f60ab-3f95-42eb-b435-c8b1a6326b81.mp4 mitmproxy 캡처를 OpenAPI 3.0 사양으로 자동 변환하는 도구입니다. 즉, 앱을 실행하고 트래픽을 캡처하기만 하면 REST API를 자동으로 리버스 엔지니어링할 수 있습니다. 🆕 새 기능! 브라우저 DevTools에서 내보낸 HAR 파일 처리 지원이 추가되었습니다. 자세한 내용은 사용법 - HAR을...

CVE-2026-51152

Server-side request forgery SSRF in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.buildrequest in libs/fetcher.py constructs an httpclient.HTTPRequest from user-supplied JSON without validating URL scheme, host, or IP range. The /har/test handler does not require authentication,...

CVE-2026-51152

The software QD (versions 20220208 through 20250803) is vulnerable to a Server-side request forgery (SSRF) in the /har/test endpoint. The root cause is located in Fetcher.build_request() within libs/fetcher.py , which constructs an httpclient.HTTPRequest from user-supplied JSON without validating...

EUVD-2026-68648

Server-side request forgery SSRF in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.buildrequest in libs/fetcher.py constructs an httpclient.HTTPRequest from user-supplied JSON without validating URL scheme, host, or IP range. The /har/test handler does not require authentication,...

CVE-2026-51152

Server-side request forgery SSRF in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.buildrequest in libs/fetcher.py constructs an httpclient.HTTPRequest from user-supplied JSON without validating URL scheme, host, or IP range. The /har/test handler does not require authentication,...

PT-2026-83867

Name of the Vulnerable Software and Affected Versions QD versions 20220208 through 20250803 Description An unauthenticated remote attacker can perform a Server-side request forgery SSRF via the '/har/test' endpoint. The Fetcher.build request function in libs/fetcher.py creates an...

CVE-2026-66913

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application...

CVE-2026-66913 Zip Bomb in Lookyloo Capture Upload Allows Denial of Service

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application...

CVE-2026-66913

The CVE-2026-66913 vulnerability affects Lookyloo when processing uploaded captures and API submissions containing gzip/zlib-compressed HAR data. The root cause is unbounded decompressed size during in-memory processing of ZIP/gzip/zlib content, enabling a zip bomb to exhaust memory and disrupt s...

CVE-2026-66913 Zip Bomb in Lookyloo Capture Upload Allows Denial of Service

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application...

PT-2026-65455

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application...

Malicious code in @zalastax/nolb-har_ (npm)

The package @zalastax/nolb-har was found to contain malicious code...

Malicious code in @zalastax/nolb-har- (npm)

The package @zalastax/nolb-har- was found to contain malicious code...

MAL-2025-11938 Malicious code in @zalastax/nolb-har (npm)

The package @zalastax/nolb-har was found to contain malicious code...

MAL-2025-11941 Malicious code in @zalastax/nolb-har_ (npm)

The package @zalastax/nolb-har was found to contain malicious code...

Malicious code in @zalastax/nolb-har (npm)

The package @zalastax/nolb-har was found to contain malicious code...

MAL-2025-11939 Malicious code in @zalastax/nolb-har- (npm)

The package @zalastax/nolb-har- was found to contain malicious code...

Malicious code in pupeteer-har (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 29c5aec1082b7aaaca7ba03715be8a3319d84027ef3fff58e5d808622a6bc074 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10389 Malicious code in pupeteer-har (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 29c5aec1082b7aaaca7ba03715be8a3319d84027ef3fff58e5d808622a6bc074 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...