CVE-2026-78169

A stack-based buffer overflow in the UTT HiPER 1250GW (up to 3.2.7-210907-180535 ) affects the strcpy function within the file /goform/aspRemoteApConfTempSend of the HTTP Request Handler component. Manipulation of the Profile argument triggers the overflow, allowing a remote attack. CVSS 4.0 rate...

PT-2026-79806

Name of the Vulnerable Software and Affected Versions UTT HiPER 1250GW versions prior to 3.2.7-210907-180535 Description An issue exists in the HTTP Request Handler component where a stack-based buffer overflow occurs. This happens when the strcpy function in the '/goform/aspRemoteApConfTempSend'...

CVE-2026-75922

Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATHINFO written unencoded to the upstream request line. PSGI hands PATHINFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it...

EUVD-2026-64662

Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATHINFO written unencoded to the upstream request line. PSGI hands PATHINFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it...

CVE-2026-75922 Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line

Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATHINFO written unencoded to the upstream request line. PSGI hands PATHINFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it...

CVE-2026-75922

Reverse::Proxy (CPAN module by LNATION) versions before 0.04 for Perl are vulnerable to HTTP request smuggling via a percent-decoded PATH_INFO written unencoded into the upstream request line. Because PSGI delivers PATH_INFO already decoded, a client-controlled %0d%0a in the URL becomes a raw CRL...

BurpSuite-Grand-Master-Tools

BurpSuite-Grand-Master-Tools Dinu11secur1ty — Un toolkit modulare che trasforma le catture di Burp in azioni istantanee e ripetibili. Converti. Riutilizza. Apri. Automatizza. 🚀 Presentazione rapida BurpSuite-Grand-Master-Tools è un toolkit leggero, verificabile ed estensibile per pentester e...

Burp2Malleable

Burp2Malleable Schnelles Python-Dienstprogramm, das ich geschrieben habe, um HTTP-Anfragen aus Burp Suite in Cobalt Strike Malleable C2-Profile umzuwandeln. Damit kannst du abgefangene/erstellte Anfragen aus BurpSuite oder ZAP, POSTMAN usw. nehmen, die festlegen, wie dein Datenverkehr aussehen bz...

CVE-2026-17252

A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability by sending a specially crafted malformed HTTP request...

CVE-2026-17252 Unauthenticated Denial of Service via Composed HTTP Parsing and Stack-Based Out-of-Bounds Write Vulnerability in TL-MR6400 Web Management Interface

A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability by sending a specially crafted malformed HTTP request...

CVE-2026-17252 Unauthenticated Denial of Service via Composed HTTP Parsing and Stack-Based Out-of-Bounds Write Vulnerability in TL-MR6400 Web Management Interface

A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability by sending a specially crafted malformed HTTP request...

CVE-2026-17251 Unauthenticated Denial of Service via Null Pointer Dereference in HTTP Request Parsing

A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie header. Successful exploitation may cause...

Security update for sccache

This update for sccache fixes the following issues: CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes bsc1274146. CVE-2026-66746: rouille: HTTP Response Splitting via Unvalidated Response Header Values bsc1273881. CVE-2026-66754: rouille:...

Linux Distros Unpatched Vulnerability : CVE-2026-63382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate...

CVE-2026-73256

Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The httpcb function in src/http.c tests hm.proto.len with an...

CVE-2026-73257

Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The clcount and tecount checks in the mghttpparse and httpcb paths in src/http.c accept both...

AZL-97536 CVE-2026-63382 affecting package mysql 8.0.46-1

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttpfindheader can select only the first...

CVE-2026-63382

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttpfindheader can select only the first...

AZL-97560 CVE-2026-63382 affecting package ntp 4.2.8p17-2

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttpfindheader can select only the first...

DEBIAN-CVE-2026-63379

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttpreadtrailer and merges them into request headers. The fix introduces evhttpparseheadersimpl and a temporary trailer header list. An unauthenticated remote...