5079 matches found
CVE-2026-61682 kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra- identity headers before forwarding requests to shards. Any...
CVE-2026-66753-HTTP-Header-Injection-via-Unvalidated-CR-and-LF-in-Header-Values-tiny_http-
安全公告：未验证的 CR 和 LF 导致 HTTP 头注入（tinyhttp） 分配的 CVE ID： CVE-2026-66753 概要 tinyhttp 不会拒绝 HTTP 头值中的回车或换行，无论方向如何。 在请求侧，readnextline 仅在 CRLF 处结束一个头行，因此单独的 LF 会保留在解析后的值中并到达应用程序。在响应侧，Header::frombytes 仅验证字节是 ASCII，而响应写入器会原样发出值，因此包含 CRLF 的值会拆分响应。 将请求头值反射到响应头中，或将请求头重新序列化到另一连接的应用程序，因此会继承一个注入原语，且没有任何迹象表明有问题。...
CVE-2026-11113-SMTP-Header-Injection-in-Contact-Form
CVE-2026-11113 – 联系表单中的 SMTP 头注入 程序代码（Python） root@kitploit: contactformserver.py - Mails feedback without sanitizing headers from flask import Flask, request import smtplib app = Flaskname @app.route'/contact', methods='POST' def contact: sender = request.form'email' message =...
EulerOS Virtualization 2.11.1 : perl-HTTP-Tiny (EulerOS-SA-2026-3451)
According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values.The...
CVE-2026-25604-PoC
CVE-2026-25604 PoC Apache Airflow 的 AWS Auth Manager 中，Host 头注入导致 SAML 身份验证绕过 攻击者可以在 SAML 登录流程中注入恶意的 Host 头，使断言使用者服务（ACS）URL 指向攻击者控制的服务器。这使攻击者能够捕获有效的 SAML 响应 并重放这些响应以未授权访问 受害者的 Airflow 实例——或在不同访问控制的多个 Airflow 实例间重用令牌。 受影响版本 软件包| 受影响版本| 修复版本 ---|---|--- apache-airflow-providers-amazon| 8.0.0 –...
SUSE-SU-2026:1117-1 Security update for python311
This update for python311 fixes the following issues: Update to python 3.11.15: - CVE-2025-6075: quadratic complexity in os.path.expandvars bsc1252974. - CVE-2025-11468: header injection with carefully crafted inputs bsc1257029. - CVE-2025-12084: quadratic complexity in xml.minidom node ID cache...
USN-8780-1 libsoup2.4, libsoup3 vulnerabilities
It was discovered that libsoup incorrectly handled certain URLs when using an HTTP proxy. A remote attacker could possibly use this issue to inject arbitrary HTTP headers. CVE-2026-1467 It was discovered that libsoup did not remove proxy authentication credentials when following HTTP redirects. A...
CVE-2026-85077
Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place...
CVE-2026-85077
A flaw was found in Sanic. The HTTP/1.1 response pipeline does not properly validate carriage-return or line-feed characters in response header names and values. This allows applications that place attacker-controlled data in response headers, filenames, or cookie attributes to inject additional...
CVE-2025-27636-RCE-in-Apache-Camel
CVE-2025-27636 – Apache Camel RCE 针对 Apache Camel 头注入 RCE（CVE-2025-27636）的简单 Python 漏洞利用程序。 用法 一次性命令执行 root@kitploit: ┌──root㉿user-/run/…/user/2024/HTBox/CVE-2025-27636 └─ python3 CVE-2025-27636.py -t http://192.168.159.120 -c "id" Executing: id uid=0root gid=0root groups=0root 读取文件 root@kitploit...
CVE-2026-85077 Sanic: HTTP response header injection via missing CR/LF validation in Sanic HTTP/1.1 responses
Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place...
CVE-2026-85077
Sanic , an open-source Python web server/framework, is affected by an HTTP response header injection vulnerability (CVSS 3.1: 8.2 HIGH ). The root cause resides in the HTTP/1.1 response pipeline in sanic/response/types.py , which serializes header names and values without rejecting carriage-retur...
CVE-2026-85077 Sanic: HTTP response header injection via missing CR/LF validation in Sanic HTTP/1.1 responses
Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place...
CVE-2025-29927
CVE-2025-29927 — Next.js 中间件身份验证绕过 概述 想象一下，夜店门口站着个保安，如果你告诉他“我已经进来了”，他就不检查直接放你进去。这正是 CVE-2025-29927 所描述的情况。 Next.js 中的中间件在处理请求之前运行，因此是处理身份验证的理想位置。Next.js 使用一个内部的 x-middleware-subrequest 头部来防止递归请求并避免无限循环。此漏洞表明，可以完全绕过或跳过中间件的执行——包括在到达受保护路由之前关键的如身份验证等安全检查。 受影响版本 分支| 修复版本 ---|--- 15.x| /" \ -H...
CVE-2026-49042
CVE-2026-49042 — camel-langchain4j-tools 提示注入 → 标头注入 针对同一 Apache Camel 漏洞的可运行概念验证复现程序，每种运行时一个：...
CVE-2026-26898-Xiaomi-SSRF-HostHeaderInjection
CVE-2026-26898: 小米路由器4A千兆版 - 通过Host头注入的SSRF漏洞 -orange 摘要 小米路由器4A千兆版存在服务器端请求伪造（SSRF）漏洞。路由器的Web界面未能验证HTTP Host 头，允许未认证的攻击者 强制路由器发起任意出站TCP连接。...
CVE-2026-27739-POC
-CVE-2026-27739-poc curl -H "X-Forwarded-For: http://169.254.169.254/latest/meta-data/" self.target 2. Inyección de encabezados mediante contaminación de prototipos CVSS: 7.5 Descripción : Angular SSR procesa parámetros de consulta no seguros que afectan la cadena de prototipos Impacto :...
CVE-2026-29954
KubePlus ResourceComposition ChartURL SSRF + Inyección de Cabeceras Esta vulnerabilidad existe en el componente de manejo de recursos ResourceComposition de KubePlus, permitiendo a un atacante con privilegios de Provider acceder a servicios internos mediante SSRF manipulando el parámetro chartURL...
CVE-2026-33149-PoC
CVE-2026-33149 — Tandoor Recipes 中的 Host 头注入漏洞 概述 Tandoor Recipes 在 settings.py 中默认将 ALLOWEDHOSTS 设置为 ''，导致 Django 在未经验证的情况下接受 HTTP Host 头中的任意值 。该应用在多个安全敏感场景中使用 request.buildabsoluteuri 生成绝对 URL。攻击者若能发送带有精心构造的 Host 头的请求，即可将所有服务器生成的 URL 重定向到攻击者控制的域名。 最严重的影响是邀请链接投毒...