axios package vulnerabilities: CVE-2026-42043, CVE-2026-42044, CVE-2026-40175 and CVE-62718

CVE-2026-40175 Title: Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain Description Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution ...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: httpd (UTSA-2023-000273)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-000273 advisory. Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the...

UBUNTU-CVE-2026-61629

nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing an...

CVE-2026-58268: Memory Allocation with Excessive Size Value

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parserstream.go allocates a SIP body buffer from the client-controlled Content-Length header before ParseMaxMessageLength is enforced. An unauthenticated peer can send a stream-transpor...

CVE-2026-71300

CVE-2026-71300 — camel-atmosphere-websocket dispatch header injection Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the camel-atmosphere-websocket producer selects its WebSocket recipients from websocket. Exchange headers whose names fall outside the Camel namespac...

Low: Red Hat Security Advisory: libarchive security update

An update for libarchive is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

CVE-2026-49975

CVE-2026-49975 HTTP/2 Bomb ★ CVE-2026-49975 HTTP/2 Bomb PoC ★ https://github.com/user-attachments/assets/89310771-f704-45d1-a6c3-d910de1dbc74 Overview CVE-2026-49975 is a Denial of Service DoS vulnerability in Apache HTTP Server. The vulnerability occurs in the HTTP/2 request handling path, where...

CVE-2026-48203

CVE-2026-48203 — camel-solr SolrParam. / SolrField. Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:...

CVE-2004-1561-Icecast-Header-Overwrite-buffer-overflow-RCE-2.0.1-Win32-

CVE-2004-1561-Icecast-Header-Overwrite-buffer-overflow-RCE-2.0.1-Win32- Uso Listener de reverse shell con Ncat root@kitploit: root@Kali:/TryHackme/Ice nc -nlvp 443 listening on any 443 ... connect to 192.168.92.128 from UNKNOWN 192.168.92.133 49211 Microsoft Windows Version 6.1.7601 Copyright c...

CVE-2026-27944

CVE-2026-27944 - Nginx UI Unauthenticated Backup Download & Decryption https://img.shields.io/badge/python-3.6+-blue.svg https://img.shields.io/badge/license-MIT-green https://img.shields.io/badge/PoC-Exploit-red A proof‑of‑concept PoC exploit for CVE‑2026‑27944, a critical vulnerability in Nginx...

CVE-2025-29927_Scanner

CVE-2025-29927 Checker 📌 Introducción Este script verifica la vulnerabilidad CVE-2025-29927 en servidores Next.js, probando múltiples payloads en el encabezado x-middleware-subrequest para detectar accesos no autorizados. ❓ ¿Qué es CVE-2025-29927? CVE-2025-29927 es una vulnerabilidad que permite...

refresh

Refresh This container emulates the vulnerable functionality of CVE-2022-1388 in an F5 Router allowing RCE. CVE-202201388 stems from a complicated relationship between different authentication mechanisms and broxying that stripped Headers allowing improper access to admin endpoints in the webapp...

cve-2026-41940-PoC

CVE-2026-41940 ⚠ This tool is created solely for educational or bug bounty purpose only. Unauthorized use outside of controlled environments is strictly prohibited. Description A tool for exploiting CVE-2026-41940, a critical authentication bypass in cPanel & WHM CVSS 10.0, allowing unauthenticat...

CVE-2025-55182

CVE-2025-55182 / CVE-2025-66478 — Next.js Middleware / RSC Bypass Analysis The author assumes no liability for misuse or damage caused by this research Provided strictly for educational and defensive purposes Description This repository contains a small laboratory and Proof-of-Concept analysis fo...

spookyssl-pcaps

SpookySSL PCAPs and Network Coverage PCAPs or it didn't happen In the wake of the recently disclosed vulnerability in OpenSSL v3.0 through v3.0.6 CVE-2022-3602, we have looked into how an exploitation attempt appears 'on the wire'. This repository contains PCAPs of various exploitation scenarios,...

CVE-2026-78329

CVE-2026-78329 — camel-undertow header filter strategy not applied websocket. injection Runnable proof-of-concept reproducer for the Apache Camel vulnerability where UndertowEndpoint defaulted its headerFilterStrategy to the base HttpHeaderFilterStrategy and pushed that instance into the...

CVE-2019-19633

CVE-2019-19633 lib/G/functions.php in Chevereto 1.0.0 through 1.1.4 Free, and through 3.13.5 Core, allows an attacker to perform bruteforce attacks without triggering the implemented protection mechanism by manipulating the X-Forwarded-For header in the request. The IP in the header has to be...

CVE-2026-46453

camel-elasticsearch-rest-client Unprefixed-Header Injection Reproducer CVE-2026-46453 This project demonstrates a message-header injection / authorization bypass in Apache Camel's camel-elasticsearch-rest-client component, tracked as CVE-2026-46453. The component reads several Exchange headers to...

CVE-2026-46457

CVE-2026-46457 — camel-nats Inbound Header Injection SSRF Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:...

Scanner_CVE_2026-42945

Scanner for detecting Nginx instances vulnerable to CVE-2026-42945 NGINX RIFT. Accepts individual IPs, CIDR ranges, and ASNs as input. About CVE-2026-42945 affects all Nginx versions prior to 1.30.1. The tool probes HTTP and HTTPS on default ports, reads the Server header from the response, and...