Security Bulletin:Sensitive Data Exposure in Erlang OTP inets (httpc_response module)

Summary Sensitive Data Exposure vulnerability in Erlang OTP inets httpcresponse module allows Retrieve Embedded Sensitive Data. The httpc client forwards the Authorization and Proxy-Authorization request headers to redirect targets without checking whether the redirect crosses an origin boundary...

CVE-2026-84429

A flaw was found in Django. Inefficient processing occurs when the HTTP header parsing function handles quoted parameter values containing numerous separator characters. A remote, unauthenticated attacker could exploit this flaw by sending requests with crafted header parameters, causing excessiv...

CVE-2021-23017

CVE-2021-23017 ماسح الإثبات لمفهوم فحص ثغرة تجاوز سعة المخزن المؤقت لـ NGINX DNS - CVE-2021-23017 PoC يتحقق هذا النص البرمجي بلغة Python مما إذا كان خادم nginx يحتمل أن يكون عرضة للثغرة الأمنية الحرجة CVE-2021-23017 ، التي تؤثر على محلل DNS المدمج في nginx ويمكن أن تؤدي إلى تجاوز سعة المخزن المؤق...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

CVE-2026-72744-poc

CVE-2026-72744: تسريب معلومات من نقطة نهاية Chrome DevTools في Nuxt English version نظرة عامة هذا المستودع هو إثبات مفهوم PoC لثغرة تسريب المعلومات CVE-2026-72744 الموجودة في نقطة نهاية مساحة عمل Chrome DevTools في خادم تطوير Nuxt. يحدد خادم التطوير الثغرة ما إذا كان مصدر الاتصال محليًا أم لا بنا...

CVE-2025-29927

🔍 CVE-2025-29927 - كاشف تجاوز الوسيطة في Next.js يساعد هذا الماسح الذكي المبني بلغة بايثون في اكتشاف الثغرة CVE-2025-29927 في تطبيقات Next.js — وهي عبارة عن تجاوز حرج للوسيطة middleware يسمح للمهاجمين بتخطي المصادقة باستخدام ترويسة HTTP مصممة بعناية. 🧠 لا تكتشف الأداة عمليات إعادة التوجيه عبر HTT...

CVE-2026-66746-HTTP-Response-Splitting-via-Unvalidated-Response-Header-Values-rouille-

استشارة أمنية: حقن استجابات HTTP عبر قيم ترويسات استجابة غير مُتحقق منها rouille معرّف CVE المخصص: CVE-2026-66746 الملخص تكتب rouille قيم ترويسات الاستجابة إلى العميل دون التحقق منها من وجود حرف إرجاع السطر أو تغذية السطر. أي تطبيق يضع نصًا متأثرًا من المهاجم في قيمة ترويسة، فإنه يُصدر ترويسات...

ActiveScanPlusPlus

ActiveScan++ يمتد ActiveScan++ لقدرات الفحص النشط والسلبي في Burp Suite. صُمم لإضافة الحد الأدنى من الحمل على الشبكة، ويحدد سلوك التطبيق الذي قد يكون موضع اهتمام للمختبرين المتقدمين: هجمات ترويسة المضيف المحتملة تسميم إعادة تعيين كلمة المرور، تسميم ذاكرة التخزين المؤقت، إعادة ربط DNS Edge Side...

CVE-2026-73570

CVE-2026-73570 CVE-2026-73570 PoC More echo 'EHLO mx-1787907797.invalid MAIL FROM: RCPT TO: QUIT\r\n' | nc 127.0.0.1 587...

CVE-2026-84429 Potential denial-of-service vulnerability in HTTP header parsing

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.http.parseheaderparameters was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An...

CVE-2026-84429 Potential denial-of-service vulnerability in HTTP header parsing

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.http.parseheaderparameters was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An...

CVE-2026-40864

CVE-2026-40864 — JupyterHub XSRF bypass via cross-origin form POST Sec-Fetch-Mode: no-cors Severity : Medium CVSS 5.4 CWE : CWE-352 — Cross-Site Request Forgery XSRF Affected : jupyterhub 4.1.0 ≤ version posting to a different origin — precisely the classic CSRF vector the token is supposed to...

Exploit for Missing Authentication for Critical Function in Gfi Kerio_Control

!WARNING DISCLAIMER This proof-of-concept is provide...

Detect_polyfill_CVE-2024-38537-

DetectpolyfillCVE-2024-38537 यहाँ एक Python स्क्रिप्ट है जो जाँचती है कि किसी दिए गए वेब एप्लिकेशन के Content Security Policy CSP हेडर में polyfill.io डोमेन मौजूद है या नहीं। चरण: 1. संशोधित स्क्रिप्ट checkcspfromfile.py को अपनी urls.txt फ़ाइल के समान निर्देशिका में सहेजें। 2. python...

CVE-2026-33453

camel-coap हेडर इंजेक्शन → RCE भेद्यता पुनरुत्पादक CVE-2026-33453 यह प्रोजेक्ट Apache Camel के camel-coap घटक में Camel संदेश हेडर इंजेक्शन भेद्यता का प्रदर्शन करता है, जिसे CVE-2026-33453 के रूप में ट्रैक किया गया है। एक अप्रमाणित हमलावर जो एक एकल CoAP UDP पैकेट भेज सकता है, वह Exchange में मनमा...

undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without...

netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected...

netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message

A flaw was found in netty-codec-haproxy, a component of the Netty network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy message with a malformed PP2TYPESSL TLV Type-Length-Value header. This can lead to an IndexOutOfBoundsException...

undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without...