burp-jq

Burp JQ This is a Burp Extension to apply jq queries to JSON content from the HTTP message viewer. Build $ gradle fatJar Credits Burp JQ relies on jackson-jq, a Java implementation of jq. jq jackson jackson-jq...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Cap'n Proto vulnerabilities (USN-8650-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8650-1 advisory. Chanho Kim and Jihyeok Han discovered that Cap'n Proto incorrectly handled negative Content-Length values...

AlmaLinux 9.2 [TuxCare] Security Update: squid Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1736503631)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1736503631 advisory. - Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is...

CVE-2026-48205

A flaw was found in the Apache Camel DNS component. An unauthenticated remote attacker could exploit an improper input validation vulnerability by manipulating DNS operation parameters in HTTP message headers. This allows the attacker to perform a Server-Side Request Forgery SSRF attack,...

Malicious code in http-message-signatures-extension (npm)

--- Credit: OpenSSF source...

cve-2026-47864 - MEDIUM - Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution

cve-2026-47864 - MEDIUM - Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the SerializingHttpMessageConverter process. An attacker can execute arbitrary code by sending a specially crafted HTTP request with the Content-Type set to application/x-java-serialized-object and a...

CVE-2026-55766

Summary (CVE-2026-55766): guzzlehttp/psr7 (PHP) before 2.12.1 is vulnerable to CRLF injection in the HTTP start-line fields (method, protocol version, reason phrase) when attacker-controlled data ends up in those fields and the message is serialized or forwarded. The flaw requires the malformed m...

MGASA-2026-0150 Updated perl-libwww-perl & perl-HTTP-Message packages fix security vulnerabilities

LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects...

CVE-2026-32239

A flaw was found in the KJ-HTTP component of Cap’n Proto. When processing HTTP messages, a negative Content-Length value could be implicitly converted to an unsigned integer, resulting in an extremely large length value. An attacker could exploit this behavior by sending specially crafted HTTP...

MAL-2025-48843 Malicious code in http-message-signatures-extension (npm)

--- -= Per source details. Do not edit below this line.=-...

EUVD-2018-18299

Malware in sbrugna...

EUVD-2019-5197

Malware in sbrugna...

EUVD-2022-43522

Malicious code in bioql PyPI...

EUVD-2023-1431

Malicious code in bioql PyPI...

EUVD-2025-29041

Malicious code in bioql PyPI...

EUVD-2022-38163

Malicious code in bioql PyPI...

CVE-2025-59058 httpsig-rs's HMAC verification is vulnerable to timing attack

httpsig-rs is a Rust implementation of IETF RFC 9421 http message signatures. Prior to version 0.0.19, the HMAC signature comparison is not timing-safe. This makes anyone who uses HS256 signature verification vulnerable to a timing attack that allows the attacker to forge a signature. Version...

PT-2025-37315

Name of the Vulnerable Software and Affected Versions: httpsig-rs versions prior to 0.0.19 Description: httpsig-rs is a Rust implementation of IETF RFC 9421 http message signatures. The HMAC signature comparison is not timing-safe in versions prior to 0.0.19, potentially allowing an attacker to...

TencentOS Server 2: squid (TSSA-2024:0116)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0116 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...