Ollama - Remote Code Execution

Ollama before 0.1.34 does not validate the format of the digest sha256 with 64 hex digits when getting the model path, and thus mishandles the TestGetBlobsPath test cases such as fewer than 64 hex digits, more than 64 hex digits, or an initial ../ substring. id: CVE-2024-37032 info: name: Ollama ...

CVE-2021-41773

CVE-2021-41773 apache http server 漏洞（仅适用于 2.4.49） 环境要求设置 httpd.conf ... LoadModule cgimodule modules/modcgi.so 取消注释此行 ... AllowOverride none Require all denied 注释掉此行或设置为 Require all granted ... 参考资料 https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773/rapid7-analysis...

CVE-2026-103098

Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather than HTTPS, meaning the key is transmitted in plaintext across the network. An attacker with the ability to monitor network traffic could intercept the request and obtain the key...

CVE-2026-58415

A flaw was found in the moddavfs module of the Apache HTTP Server. A remote attacker can exploit this vulnerability by sending an HTTP GET request directly to the internal WebDAV Web Distributed Authoring and Versioning state directory. This allows unauthorized access to internal state files,...

CVE-2026-42528

A flaw was found in the moddav module of the Apache HTTP Server. This vulnerability allows a Denial of Service DoS by crashing server child processes. An attacker with permission to create Web Distributed Authoring and Versioning WebDAV locks can trigger a memory calculation error during lock...

CVE-2026-63718

A flaw was found in the modproxyuwsgi module of Apache HTTP Server. This issue allows HTTP response smuggling when the server processes a crafted uWSGI response containing a Transfer-Encoding header. A remote attacker can exploit this vulnerability to desynchronize HTTP communications, potentiall...

CVE-2026-73636

A flaw was found in the modauthdigest module of the Apache HTTP Server. This vulnerability allows an attacker positioned on the network to bypass authentication by replaying previously intercepted user credentials. When the server is configured with a nonce a single-use security token lifetime of...

CVE-2026-63686

A flaw was found in the modxml2enc module of the Apache HTTP Server. An untrusted backend server can cause a Denial of Service DoS by returning a crafted response with a character set whose conversion partially succeeds and then fails. Processing this response triggers an invalid memory access nu...

CVE-2026-46729

A flaw was found in the modheartmonitor module of the Apache HTTP Server. A remote, unauthenticated attacker can exploit a NULL pointer dereference vulnerability when the module is configured with a unicast listener. By sending specially crafted network traffic to the listening service, an attack...

BypassFuzzer

Bypass Fuzzer 元の403fuzzer.py : ==注: これは私の新しくてキラキラしたBurp拡張機能（1000000%優れています）に取って代わられました。ツールをご利用いただきありがとうございます！== 拡張機能はこちらにあります: https://github.com/intrudir/BypassFuzzer-Burp 401/403エンドポイントをファズしてバイパスを試みる ヘッダー、パス正規化、動詞などを使用してさまざまなチェックを実行し、ACLやURL検証のバイパスを試みます。...

CVE-2026-79768

A flaw was found in Apache HTTP Server's moduserdir module. When configured with an absolute path without wildcards for the UserDir directive, the server fails to properly resolve single-dot directory '/./' path equivalence. A remote attacker can exploit this issue by submitting a crafted HTTP...

EUVD-2026-91137

Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler that allows unauthenticated attackers to read, overwrite, and delete transfer engine metadata keys. Attackers can poison segment descriptors such as tcpdataport or re-create...

EUVD-2026-91126

deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.writebotfile. A remote caller can enumerate bot IDs and overwrite another bot's whitelisted control files through the HTTP tutorbot file route...

EUVD-2026-91120

langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code remote. The component is: src/backend/base/langflow/api/v1/validate.py:validate-postvalidatecode-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed...

EUVD-2026-91119

langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.. The component is:...

CVE-2026-103765

Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler that allows unauthenticated attackers to read, overwrite, and delete transfer engine metadata keys. Attackers can poison segment descriptors such as tcpdataport or re-create...

CVE-2026-103098

The GV-Eye software is vulnerable to sensitive information exposure due to the transmission of a sensitive key within the URL query parameter over an unencrypted HTTP connection. Because the request is sent in plaintext rather than via HTTPS, an attacker capable of monitoring network traffic can ...

EUVD-2026-91148

Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather than HTTPS, meaning the key is transmitted in plaintext across the network. An attacker with the ability to monitor network traffic could intercept the request and obtain the key...

CVE-2026-103098 GV-Eye Sensitive information exposure in URL query parameter Vulnerability

Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather than HTTPS, meaning the key is transmitted in plaintext across the network. An attacker with the ability to monitor network traffic could intercept the request and obtain the key...

react2shell-scanner

🚨 React2Shell 扫描器 React 服务端组件中的 CVSS 10.0 RCE。你的 React 19 应用存在漏洞吗？ 用于检测 CVE-2025-55182（React2Shell）的快速、精准扫描器——这是一个已被在野利用的严重远程代码执行漏洞。凭借智能的服务端组件检测实现零误报。 🚨 关于 React2Shell（CVE-2025-55182） React2Shell 是 React 服务端组件中的一个最高严重级别（CVSS 10.0）漏洞，允许未经身份验证的远程代码执行。攻击者可通过向服务端函数端点发送特制的 HTTP 请求来利用此漏洞。 关键信息： 受影响：...