CVE-2026-107399

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agentresponsefollowmetarefresh when Mechanizefollowmetarefresh is enabled. A page containing a meta refresh to another origin causes headers...

EUVD-2026-95318

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agentresponsefollowmetarefresh when Mechanizefollowmetarefresh is enabled. A page containing a meta refresh to another origin causes headers...

CVE-2026-107399

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agentresponsefollowmetarefresh when Mechanizefollowmetarefresh is enabled. A page containing a meta refresh to another origin causes headers...

CVE-2026-107399 Mechanize sends credential headers to another origin after a meta refresh

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agentresponsefollowmetarefresh when Mechanizefollowmetarefresh is enabled. A page containing a meta refresh to another origin causes headers...

CVE-2026-107399

The Mechanize library (prior to version 2.14.1 ) fails to enforce an origin trust boundary within the Mechanize::HTTP::Agent#response_follow_meta_refresh function when follow_meta_refresh is enabled. This flaw allows a page containing a meta refresh to an external origin to cause the library to r...

CVE-2026-107399 Mechanize sends credential headers to another origin after a meta refresh

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agentresponsefollowmetarefresh when Mechanizefollowmetarefresh is enabled. A page containing a meta refresh to another origin causes headers...

Exploit for Path Traversal in Apache Http_Server

Apache HTTP Server 2.4.50 Path Traversal and RCE CVE-2021-420...

CVE-2026-78399

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an authenticated user to cause a denial of service using a specially crafted HTTP query due to improper allocation of system resources...

CVE-2025-8671-vulnerability-POC-

CVE-2025-8671-vulnerability-POC- CVE-2025-8671 vulnerability POC CVE-2025-8671 Vulnerability Scanner A professional security research tool for detecting the MadeYouReset vulnerability CVE-2025-8671 in HTTP/2 servers. This scanner uses multiple detection heuristics to identify servers vulnerable t...

BurpSuiteHTTPSmuggler

Burp Suite HTTP Smuggler A Burp Suite extension to help pentesters to bypass WAFs or test their effectiveness using a number of techniques. This extension has been developed by Soroush Dalili @irsdl from NCC Group. The initial release v0.1 only supports the Encoding capability that can be quite...

cachegrab

Cachegrab Cachegrab is a tool designed to help perform and visualize trace-driven cache attacks against software in the secure world of TrustZone-enabled ARMv8 cores. For an overview of how Cachegrab works under the hood, see the Cachegrab release announcement. Using Cachegrab on Android It is...

DatajackProxy

Datajack Proxy Datajack Proxy a tool to intercept non-HTTP traffic between a native application and a server. This would allow for communications interception and modification, even if encryption and certificate pinning were in use. This is done by hooking the application and intercepting calls t...

creep-web-app-scanner

creep-web-app-scanner A very primitive website scanner currently under development by an NCC Group employee and University graduate with 20% research time. creep currently crawls a site, and searches for potentially interesting information within each page. creep will crawl your HTTP only target...

HTTPSignatures

HTTPSignatures Burp Suite Extension HTTPSignatures is a Burp Suite extension that implements the Signing HTTP Messages draft-ietf-httpbis-message-signatures-01 specification draft document. This allows Burp Suite users to seamlessly test applications that require HTTP Signatures. Features...

CVE-2026-78399 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an authenticated user to cause a denial of service using a specially crafted HTTP query due to improper allocation of system resources...

EUVD-2026-95272

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an authenticated user to cause a denial of service using a specially crafted HTTP query due to improper allocation of system resources...

CVE-2026-78399

IBM Security Verify Access (versions 10.0 through 10.0.9.2) and IBM Verify Identity Access (versions 11.0 through 11.0.3) are vulnerable to a Denial of Service (DoS) attack. An authenticated user can trigger the DoS by sending a specially crafted HTTP query , which leads to an improper allocation...

requests-racer

Requests-Racer Requests-Racer is a small Python library that lets you use the Requests library to submit multiple requests that will be processed by their destination servers at approximately the same time, even if the requests have different destinations or have payloads of different sizes. This...

BurpSuite-Grand-Master-Tools

BurpSuite-Grand-Master-Tools Bynu11secur1ty — A modular toolkit that transforms Burp captures into instant, repeatable actions. Convert. Reuse. Open. Automate. 🚀 Elevator pitch BurpSuite-Grand-Master-Tools is a lightweight, auditable, and extensible toolkit for pentesters and bug bounty hunters...

Iot_Hacking_Camera_0day

IotHackingCamera0day Iot Camera 0day AHD DVR ADN-448 is prone to unauth buffer overflow over the http interface. Simple browse to web server inferface and enter a stupid ammount of data to username and password , and see how the camera reboots. Please see the video for confirmation : Happy IoT-...