@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport

@zereight/mcp-gitlab exposes its Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicious web page can use DNS rebinding to route browser requests to a victim's local MCP listener while preserving an attacker-controlled Host and Origin. The server accepts those...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in http-proxy-middleware

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in http-proxy-middleware Vulnerability Details CVEID:CVE-2026-55602 DESCRIPTION: http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents...

CVE-2022-22972

CVE-2022-22972 POC for CVE-2022-22972 affecting VMware Workspace ONE, vIDM, and vRealize Automation 7.6. Technical Analysis A technical root cause analysis of the vulnerability can be found on our blog:...

CVE-2022-24181

CVE-2022-24181 and CVE-2022-26616. both are probably same Open-journal-system-Vulnerability XSS via Host Header injection and Steal Password Reset Token of another user Step to reproduce: 1. Go to this site: https://who's-using-ojs-software.com 2. And capture this request in burp , and send to...

CVE-2021-23017

CVE-2021-23017 PoC Scanner NGINX DNS Overflow Vulnerability Check - CVE-2021-23017 PoC This Python script checks if an nginx server is potentially vulnerable to the critical CVE-2021-23017 vulnerability, which affects the integrated DNS resolver in nginx and can cause a buffer overflow. 🔍 What do...

CVE-2026-72744-poc

CVE-2026-72744: Fuga de información del endpoint Chrome DevTools de Nuxt PoC English version Resumen Este repositorio es una Prueba de Concepto PoC de la vulnerabilidad de fuga de información CVE-2026-72744 presente en el endpoint del workspace de Chrome DevTools del servidor de desarrollo de Nux...

EUVD-2026-78642

AVideo through 29.0 contains an unauthenticated server-side request forgery vulnerability in the checksiteavailability function that accepts attacker-controlled HTTP Host headers. Attackers can send requests to submitIndex.php or ajax.php with arbitrary Host headers to probe internal network host...

CVE-2026-54167 Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before...

CVE-2026-49468-LiteLLM-Auth-Bypass

CVE-2026-49468 — LiteLLM Unauthenticated Auth Bypass via Host-Header Route Confusion Pre-authentication authentication/authorization bypass in the LiteLLM proxy BerriAI. A single crafted Host header makes the proxy evaluate its auth decision against a public health route while FastAPI still...

CVE-2026-54182

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest in src/Stats.php is reached from...

CVE-2026-54182 backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest in src/Stats.php is reached from...

CVE-2026-54182 backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest in src/Stats.php is reached from...

CVE-2026-54182

backpack/crud , a Laravel Backpack package for building admin panels, contains a pre-auth OS command injection in Stats::makeCurlRequest (src/Stats.php). The function builds a shell command from the HTTP Host header and passes it to exec() without adequate escaping. The path is reached from Backp...

Astra Linux – Vulnerability in HAPProxy

A issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. This issue can lead to a situation where the HTTP Host header is controlled by an attacker, due to a mismatch between the Host field and its corresponding authority value being mishandled...

starlette-host-header-lab

Starlette Host-Header URL Confusion Lab X41-2026-002 A self-contained, containerized training lab reproducing the Starlette authentication-bypass vulnerability disclosed by X41 D-Sec. Advisory: X41-2026-002 GHSA: GHSA-86qp-5c8j-p5mr CWE: 436 — Interpretation Conflict / Untrusted Input in Function...

BadHost-CVE-2026-48710-Exploit

BadHost — CVE-2026-48710 Scanner Detection-only scanner for the BadHost auth-bypass in Starlette / FastAPI — where auth middleware reads request.url.path instead of request.scope"path", allowing a crafted Host header to smuggle an allowlisted path and bypass authentication. root@kitploit: GET...

CVE-2026-90580

A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side...

EUVD-2026-77070

A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side...

CVE-2026-90580

FlowiseAI Flowise (up to version 3.0.2) contains a server-side request forgery (SSRF) vulnerability in the Evaluations Endpoint . The flaw resides in the axios.post function within packages/server/src/controllers/evaluations/index.ts, where manipulation of the Host or X-Forwarded-Proto header all...

CVE-2026-90580 FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery

A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side...