CVE-2026-55637 genieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transport

genieacs-mcp is an MCP server for GenieACS written in Go. Prior to 0.3.2, the Streamable HTTP transport in cmd/server/main.go creates an unauthenticated /mcp listener on the default MCPLISTENADDR value 127.0.0.1:8080 when MCPAUTHTOKEN is unset and the httpSrv.Startaddr branch does not validate th...

CVE-2026-56709

Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail function when constructing token-bearing invitation links. Attackers can manipulate the Host header to poison invitation links and redirect users to attacker-controlled domains, bypassing the requiretrustedhost...

CVE-2026-56709

Grav before 3.9.2 is vulnerable to a Host header injection in the sendInvitationEmail() function. When constructing token-bearing invitation links, the unvalidated Host header allows an attacker to poison the link and redirect users to an attacker-controlled domain . This bypasses the require_tru...

CVE-2026-56709 Grav before 3.9.2 Host Header Injection via sendInvitationEmail

Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail function when constructing token-bearing invitation links. Attackers can manipulate the Host header to poison invitation links and redirect users to attacker-controlled domains, bypassing the requiretrustedhost...

EUVD-2026-65207

Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail function when constructing token-bearing invitation links. Attackers can manipulate the Host header to poison invitation links and redirect users to attacker-controlled domains, bypassing the requiretrustedhost...

PT-2026-81459

Name of the Vulnerable Software and Affected Versions genieacs-mcp versions prior to 0.3.2 Description The Streamable HTTP transport in cmd/server/main.go creates an unauthenticated /mcp endpoint on the default address 127.0.0.1:8080 when the MCP AUTH TOKEN variable is unset. The server fails to...

Astra Linux – Vulnerability in python-webob

WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user will be redirected to using Python’s urlparse function, and joining that parsed URL to the base URL. However, the...

Astra Linux – Vulnerability in HAPProxy

A issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. This issue can lead to a situation where the HTTP Host header is controlled by an attacker, due to a mismatch between the Host field and its corresponding authority value being mishandled...

Astra Linux - Vulnerability in Golang-1.19

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With this fix, the HTTP/1 client will now refuse to send requests that contain an invalid Request.Host or Request.URL.Host value...

Astra Linux – Vulnerability in Tomcat9

Improper input validation vulnerability. This issue affects Apache Tomcat: versions 11.0.0-M1 through 11.0.14, 10.1.0-M1 through 10.1.49, and 9.0.0-M1 through 9.0.112. The following versions were at the end of their support lifecycles at the time the CVE was created, but are still affected: 8.5.0...

Astra Linux – Vulnerability in Twisted

Twisted is an event-based framework for internet applications. It was introduced with version 0.9.4. At that time, when the host header did not match a configured host using twisted.web.vhost.NameVirtualHost, a “NoResource” resource would be returned. This caused the Host header to be rendered...

Astra Linux – Vulnerability in Firefox

The Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to the user’s browser to control it. This bug only affected Firefox when WebDriver was enabled, which is not the default configuration.. This vulnerability...

dsh2shell

dsh2shell Unauthenticated RCE PoC for expo...

CVE-2026-77087

Paperclip before 0.3.1 in default localtrusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, uses DNS rebinding to make authenticated A...

EUVD-2026-63991

Paperclip before 0.3.1 in default localtrusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, uses DNS rebinding to make authenticated A...

CVE-2026-77087 Paperclip before 0.3.1 Remote Code Execution via DNS Rebinding

Paperclip before 0.3.1 in default localtrusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, uses DNS rebinding to make authenticated A...

CVE-2026-77087

Paperclip before 0.3.1 running in its default local_trusted mode fails to validate Host headers , enabling DNS rebinding attacks. An attacker can craft a malicious webpage that, when visited by a developer with Paperclip running locally, makes authenticated API requests and executes arbitrary com...

CVE-2026-77087 Paperclip before 0.3.1 Remote Code Execution via DNS Rebinding

Paperclip before 0.3.1 in default localtrusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, uses DNS rebinding to make authenticated A...

Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

Summary Backpack\CRUD\Stats::makeCurlRequest builds a shell command using unescaped input that originates from the HTTP Host header, then passes it to exec. A specially crafted Host header can break out of the shell argument and cause the server to execute arbitrary OS commands as the web user. T...

GHSA-F5F4-3HH4-F54M Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

Impact Pipelines-as-Code installations using the GitHub App provider are vulnerable to GitHub App credential exfiltration through the webhook endpoint. Affected versions accepted the X-GitHub-Enterprise-Host request header as the GitHub Enterprise API host during GitHub App token generation. For...