CVE-2026-55613 uhttpd: HTTP request smuggling via ubus POST body parse-error desync

uhttpd is a small HTTP server. In unpatched repository snapshots, uhubusdatasend in ubus.c can desynchronize HTTP request boundaries when a POST /ubus JSON body arrives in multiple TCP segments. An initial segment completing a JSON object sets du-jsobj; a later segment takes the existing-object...

CVE-2026-55613 uhttpd: HTTP request smuggling via ubus POST body parse-error desync

uhttpd is a small HTTP server. In unpatched repository snapshots, uhubusdatasend in ubus.c can desynchronize HTTP request boundaries when a POST /ubus JSON body arrives in multiple TCP segments. An initial segment completing a JSON object sets du-jsobj; a later segment takes the existing-object...

CVE-2026-86350

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-86350 Write-up: https://abraxaslabs.tech/research/CVE-2026-86350 CVE-2026-86350 Apache Tomcat 9.0.121 - Apache Software Foundation I am @abraxasnull. Loopback lab. The client is CVE-2026-86350-Abraxas-Labs.py...

CVE-2024-51358

CVE-2024-51358: SSRF in Heimdall application A server-side request forgery SSRF vulnerability was discovered in Heimdall version 2.6.1, specifically within the Add Application feature. This flaw allows remote attackers to perform HTTP requests. References: Heimdall GitHub repository:...

CVE-2026-62864

The Ring Clojure web applications library is vulnerable to a Regular-Expression Denial of Service (ReDoS) in versions prior to 1.15.5 . The wrap-nested-params function in the ring.middleware.nested-params namespace uses a backtracking regular expression to match parameter names from URL query str...

CVE-2025-0108-Authentication-Bypass-checker

This tool tests whether a target PAN-OS device is vulnerable to the CVE-2025-0108 authentication bypass vulnerability . It sends a crafted HTTP request to the target and analyzes the response to determine if the device is exploitable. Usage single ip python authbypasscve20250108.py -u...

CVE-2026-78403 Unauthenticated Stack Buffer Overflow in Sentinel Keys Server

Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. Sentinel Keys Server does not check the length of the first field in the HTTP request. An attacker may craft an HTTP request and send it to Sentinel Keys Server. ...

CVE-2020-3452_Cisco_ASA_PathTraversal

CVE-2020-3452CiscoASAPathTraversal Proof-of-concept script for CVE-2020-3452 — Cisco ASA/FTD Path Traversal vulnerability. Supports automated extraction of known file targets with a hard limit on successful downloads for safety. Intended for authorized security testing and research purposes only....

Cisco-UCS-Manager-2.2-1d-Remote-Command-Execution

Cisco-UCS-Manager-2.2-1d-Remote-Command-Execution - Cisco Bug: CSCur90888 Exploit Title : Cisco UCS Manager - 2.21d - Remote Command Execution Description : An unspecified CGI script in Cisco FX-OS before 1.1.2 on Firepower 9000 devices and Cisco Unified Computing System UCS Manager before 2.24b,...

CLEANSTART-2026-EJ52703 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension

Security vulnerability affects the thingsboard package. Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat via invalid chunk extension...

Security Bulletin: InformixHQ vulnerabilities in openjs

Summary InformixHQ prior to 3.3.3 uses vulnerable version of openjs Vulnerability Details CVEID:CVE-2026-18540 DESCRIPTION: undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original...

cve-2024-21762-poc

cve-2024-21762-poc CVE-2024-21762 is a critical vulnerability in Fortinet's FortiOS and FortiProxy products, located in their SSL VPN component. This vulnerability allows unauthenticated remote attackers to execute arbitrary code or commands on the target system through specially crafted HTTP...

Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server, which impacts IBM Tivoli Netcool Configuration Manager(ITNCM).

Summary IBM WebSphere Application Server is a required product for IBM Tivoli Netcool Configuration ManagerITNCM version 6.4.2. Multiple vulnerabilities were addressed in IBM WebSphere Application Server. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes sectio...

CLEANSTART-2026-ZM16945 When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and t...

Security vulnerability affects the activemq package. When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data...

CLEANSTART-2026-BN16634 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33)

Security vulnerability affects the sonarqube package. Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' CWE-444 in Elasticsearch can lead to information disclosure via HTTP Request Smuggling CAPEC-33...

CVE-2019-19781-poc

CVE-2019-19781-poc Modified PoC, suitable for Python3 python3 CVE-2019-19781.py http://example.com...

CVE-2026-55613: openwrt uhttpd: uhttpd is a small HTTP server

uhttpd is a small HTTP server. In unpatched repository snapshots, uhubusdatasend in ubus.c can desynchronize HTTP request boundaries when a POST /ubus JSON body arrives in multiple TCP segments. An initial segment completing a JSON object sets du-jsobj; a later segment takes the existing-object...

RHEL 9 : Satellite 6.18 (RHSA-2026:92860)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92860 advisory. openvox-agent: curl: Cookie injection via malicious HTTP server using super cookies CVE-2026-8924. openvox-agent: heap buffer overflow in C...

RHEL 9 : Satellite 6.19 (RHSA-2026:92861)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92861 advisory. This advisory provides security fixes for affected packages used by Red Hat Satellite. The updates address the vulnerabilities described...

CVE-2026-116127: Inconsistent Interpretation of HTTP Requests

Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection. The request method is not passed to the response writer, so whatever body the application returns for a HEAD request is sent. With...