Fedora 43 : coturn (2026-02d5b68472)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-02d5b68472 advisory. Coturn 4.15.0 Security - Ignore STUN attributes after MESSAGE-INTEGRITY GHSA-5538-7cxj-5jcc. Per RFC 8489 9 / RFC 5389 15.4, attributes following...

CVE-2026-24033

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3, from 9.0.0 through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the iss...

CVE-2026-60113: Missing Authentication for Critical Function

AMMOS Instrument Toolkit AIT Deep Space Network DSN Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension SLE interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no...

CVE-2026-67183 TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

CVE-2026-67183 TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

CVE-2026-67183 TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

Cisco Adaptive Security Appliance (ASA)/Firepower Threat Defense (FTD) - Local File Inclusion Detection

Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software is vulnerable to local file inclusion due to directory traversal attacks that can read sensitive files on a targeted system because of a lack of proper input validation of URLs in HTTP requests processe...

Cisco Secure Firewall Management Center - Authentication Bypass Detection

Cisco Secure Firewall Management Center Software contains an authentication bypass caused by improper system process creation at boot, letting unauthenticated remote attackers execute scripts and gain root access, exploit requires crafted HTTP requests. !/usr/bin/env python3 -- coding: utf-8 --...

Public .idea Folder containing http logs Detection

Searches for .idea Folder for http-requests-log.http and http-client.cookies file !/usr/bin/env python3 -- coding: utf-8 -- """Searches for .""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Public .idea...

PT-2026-65543

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

CVE-2026-67183: Missing Release of Memory after Effective Lifetime

TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...

Multimodal-web-attack-Dataset — Updated!

MWAD: A Multimodal Web Attack Dataset for AI-Driven SQL Injection Detection Overview The Multimodal Web Attack Dataset MWAD is a novel labelled cybersecurity dataset developed as part of the author's research in cybersecurity at La Trobe University, Australia. The dataset generation methodology,...

CVE-2026-65924: Server-Side Request Forgery (SSRF)

JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery SSRF. An authenticated user - or, if anonymous access is enabled on the repository, an unauthenticated user - could cause Artifactory to issue outbound HTTP requests to arbitrary...

nginx: NGINX: Arbitrary code execution via crafted HTTP requests

A flaw was found in NGINX. An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests when the map directive uses regular expression regex matching and references regex capture variables before referencing the map output variable. This can lead to a heap...

Server-Side Request Forgery (SSRF)

org.apache.camel, camel-dns is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of DNS-related Exchange message headers dns.server, dns.name, dns.domain, etc. that can be passed from inbound HTTP requests, which allows an attacker to manipulate DNS...

EUVD-2026-48306

CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated users to kill, delete, and corrupt other tenants' backups. Attackers can send crafted POST requests with arbitrary backupCancellationDoma...

CVE-2026-12353: Missing Release of Resource after Effective Lifetime

An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly sending HTTP requests to the TLS endpoint. Depending on how the RHCS server is configured, a manual intervention to restart it may prove necessary...

CVE-2026-44907

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack versions 19.0.0...

CVE-2026-44907

The vulnerability CVE-2026-44907 is a Denial of Service affecting React server-side rendering components. An attacker can trigger high CPU usage by sending specially crafted HTTP requests to server function endpoints in affected packages: react-server-dom-webpack, react-server-dom-parcel, and rea...

CVE-2026-44907: Undefined Security Weakness

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack versions 19.0.0...