CVE-2026-68981: Improper Handling of Highly Compressed Data (Data Amplification)

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

Fedora 43 : coturn (2026-02d5b68472)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-02d5b68472 advisory. Coturn 4.15.0 Security - Ignore STUN attributes after MESSAGE-INTEGRITY GHSA-5538-7cxj-5jcc. Per RFC 8489 9 / RFC 5389 15.4, attributes following...

CVE-2026-24033

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3, from 9.0.0 through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the iss...

CVE-2026-60113: Missing Authentication for Critical Function

AMMOS Instrument Toolkit AIT Deep Space Network DSN Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension SLE interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no...

CVE-2026-67183 TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

CVE-2026-67183 TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

CVE-2026-67183 TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

Public .idea Folder containing http logs Detection

Searches for .idea Folder for http-requests-log.http and http-client.cookies file !/usr/bin/env python3 -- coding: utf-8 -- """Searches for .""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Public .idea...

Microsoft Windows 'HTTP.sys' - Remote Code Execution Detection

HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability." !/usr/bin/env python3 -- coding: utf-8 --...

Cisco Adaptive Security Appliance (ASA)/Firepower Threat Defense (FTD) - Local File Inclusion Detection

Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software is vulnerable to local file inclusion due to directory traversal attacks that can read sensitive files on a targeted system because of a lack of proper input validation of URLs in HTTP requests processe...

Cisco Secure Firewall Management Center - Authentication Bypass Detection

Cisco Secure Firewall Management Center Software contains an authentication bypass caused by improper system process creation at boot, letting unauthenticated remote attackers execute scripts and gain root access, exploit requires crafted HTTP requests. !/usr/bin/env python3 -- coding: utf-8 --...

PT-2026-65543

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

CVE-2026-67183: Missing Release of Memory after Effective Lifetime

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

Multimodal-web-attack-Dataset — Updated!

MWAD: A Multimodal Web Attack Dataset for AI-Driven SQL Injection Detection Overview The Multimodal Web Attack Dataset MWAD is a novel labelled cybersecurity dataset developed as part of the author's research in cybersecurity at La Trobe University, Australia. The dataset generation methodology,...

CVE-2026-65924: Server-Side Request Forgery (SSRF)

JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery SSRF. An authenticated user - or, if anonymous access is enabled on the repository, an unauthenticated user - could cause Artifactory to issue outbound HTTP requests to arbitrary...

nginx: NGINX: Arbitrary code execution via crafted HTTP requests

A flaw was found in NGINX. An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests when the map directive uses regular expression regex matching and references regex capture variables before referencing the map output variable. This can lead to a heap...

Server-Side Request Forgery (SSRF)

org.apache.camel, camel-dns is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of DNS-related Exchange message headers dns.server, dns.name, dns.domain, etc. that can be passed from inbound HTTP requests, which allows an attacker to manipulate DNS...

EUVD-2026-48306

CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated users to kill, delete, and corrupt other tenants' backups. Attackers can send crafted POST requests with arbitrary backupCancellationDoma...

CVE-2026-12353: Missing Release of Resource after Effective Lifetime

An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly sending HTTP requests to the TLS endpoint. Depending on how the RHCS server is configured, a manual intervention to restart it may prove necessary...

CVE-2026-44907

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack versions 19.0.0...