ssrf-sheriff

SSRF Sheriff This is an SSRF testing sheriff written in Go. It was originally created for the Uber H1-4420 2019 London Live Hacking Event, but it is now being open-sourced for other organizations to implement and contribute back to. Features Respond to any HTTP method GET, POST, PUT, DELETE, etc...

CVE-2025-3639

CVE-2025-3639 PoC - Liferay Portal/DXP Login Bypass This repository contains a Proof of Concept PoC for CVE-2025-3639 , a login bypass vulnerability in Liferay Portal versions 7.3.0–7.4.3.132 and Liferay DXP various versions from 2024.Q1 to 2025.Q1.6. The PoC demonstrates how an unauthenticated...

API-SPY-API-PROBE

API-SPY 🕵️👻 A powerful directory brute-force tool designed for API reconnaissance and penetration testing. Automatically discovers hidden API endpoints, performs recursive subscanning, and probes HTTP methods for deeper API enumeration. Features ✨ Core Capabilities: 🎯 Fast endpoint discovery using...

cve-2026-43515-poc

CVE-2026-43515 — Apache Tomcat Security Constraint Bypass Exploitability verdict: confirmed exploitable. A POST request to a resource protected by a split configuration bypasses authentication entirely. The required web.xml shape is uncommon in standard deployments — see Analysis for details. Tab...

CVE-2026-111701 OtterMind Nubase through 0.1.4 Missing Authentication in Storage Object API

OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/bucketId/path is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object pat...

toxy

toxy Not actively maintained, may not work with latest node.js runtimes. If you are interested in maintaining toxy, please open an issue. Hackable HTTP proxy to simulate server failure scenarios , systems resiliency testing and unexpected network conditions , built for node.js. It was mainly...

Rejetto HTTP File Server - Template injection

This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. id: CVE-2024-23692 info: name: Rejetto HTTP File Server - Template injection author: johnk3r severity: critical description: | This...

UBUNTU-CVE-2026-18662

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous...

UBUNTU-CVE-2026-18659

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods...

GHSA-FH4F-47MF-F2GJ kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path

Summary The openapi3filter.ValidationHandler the exported, documented request-validation middleware hard-wires the legacy router routers/legacy. That router matches the incoming request method verbatim against a trie built exclusively from upper-cased canonical HTTP methods. A request carrying a...

kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path

Summary The openapi3filter.ValidationHandler the exported, documented request-validation middleware hard-wires the legacy router routers/legacy. That router matches the incoming request method verbatim against a trie built exclusively from upper-cased canonical HTTP methods. A request carrying a...

CVE-2026-111235 OpenNMS REST authorization bypass via non-canonical HTTP method

An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/ Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no...

CVE-2026-100347

The kin-openapi Go project (versions prior to 0.145.0 ) contains a vulnerability in the openapi3filter.ValidationHandler . The routers/legacy router may pass unsupported or non-canonical HTTP methods (e.g., PROPFIND or lowercase get ) for existing static paths to openapi3.PathItem.GetOperation . ...

CVE-2026-100347 kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. The default branch of GetOperation...

CVE-2026-100347 kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. The default branch of GetOperation...

CVE-2026-100347 kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. The default branch of GetOperation...

CVE-2026-18659

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods...

CVE-2026-18659 Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods...

EUVD-2026-101996

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods...

CVE-2026-18662

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous...