CVE-2026-94265

When processing an HTTP redirect to a URL containing userinfo a "username:password" component, curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl...

CVE-2026-87862

Importing a "includeSubDomains" parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS...

CVE-2017-14980.RCE

CVE-2017-14980 The exploit targets Sync Breeze Enterprise running on Windows 10 x86, build: 16299 , affecting version 10.0.28 , where an unauthenticated attacker can perform a buffer overflow via an HTTP-request body , resulting in arbitrary code execution. This exploit assumes all security...

undici: undici: Denial of Service via failed HTTP/2 WebSocket handshake

A flaw was found in undici. A malicious remote server can cause a Denial of Service DoS by returning an invalid handshake response when a client attempts to establish a WebSocket connection over HTTP/2. The client mishandles the failed connection setup and leaves the underlying network stream ope...

curl: Explicit NO_PROXY /0 CIDR rules fail to bypass HTTP proxy for IP-literal requests

Summary: With an HTTP proxy configured, I found that curl sends IPv4 address-literal requests through it with NOPROXY=0.0.0.0/0, and IPv6 address-literal requests through it with NOPROXY=::/0. A zero-bit CIDR prefix should match every address in its family, so those requests should bypass the...

cve-2021-41773-exploration

Overview CVE-2021-41773 is a path traversal vulnerability discovered in Apache HTTP Server 2.4.49 in October 2021. The root cause was a failure to properly normalize dot sequences ended into the URL before checking whether requested path stayed within the web root. This vulnerability allowed an...

HTTP Request Smuggling

Overview io.vertx:vertx-core is a tool-kit for building reactive applications on the JVM. Affected versions of this package are vulnerable to HTTP Request Smuggling due to inconsistent interpretation of headers in the isContentLength and isContentType helpers of the VertxHttpRequestDecoder class,...

it355-lab4-enterprise-lan-security

IT355 Lab 4: Enterprise LAN Security & Shellshock Analysis 📌 Project Overview This repository contains a comprehensive security assessment of an enterprise LAN environment. The core focus of this project was the identification, exploitation, and remediation of the Shellshock CVE-2014-6271...

CVE-2026-103930

cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::openstream in httplib.h accepts a caller-controlled path that reaches detail::writerequestline without the detail::encodepath protection used by the ordinary buffered request path. Raw carriage-return and...

CVE-2026-102479

In Eclipse Vert.x versions 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as...

CVE-2026-109527

A flaw was found in mcp. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service DoS by exhausting system memory. Affected HTTP endpoints buffer incoming request bodies in memory without enforcing a maximum size limit. By sending excessively large or streamed...

CVE-2026-102479

In Eclipse Vert.x versions 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as...

CVE-2026-102479

In Eclipse Vert.x versions 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this list, allowing for instance Content-Xength to be interpeted as...

CVE-2026-102479

The io.vertx:vertx-core component in Eclipse Vert.x versions [5.0.0, 5.0.12] , [5.1.0, 5.1.9] , or [5.2.0, 5.2.0] contains a vulnerability in the HTTP/1.x decoder . The root cause is an improper canonicalization process for well-known HTTP headers, which allows crafted headers (e.g., Content-Xeng...

Apprise forwards configured auth headers across cross-origin HTTP redirects

Summary Apprise's HTTP-based notification plugins and its HTTP attachment / config loaders apprise/attachment/http.py, apprise/config/http.py follow HTTP 3xx redirects by default and re-send the user-configured auth headers and query parameters on the redirected request. If an operator-configured...

CVE-2026-102748

Dgraph, an open source distributed GraphQL database, is vulnerable to a Denial of Service in versions prior to 25.4.0 . When the administrative interface is enabled, Dgraph Zero registers several unauthenticated administrative HTTP routes on port 6080, specifically in dgraph/cmd/zero/run.go. An u...

EUVD-2026-101602

Multiple TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary transformation in the HTTP web-management login flow. An unauthenticated attacker on the same local network who can capture the network traffic associated with legitimate administrator login may be able to derive a...

CVE-2026-109506

Multiple TP-Link Wi-Fi range extenders are vulnerable to improper authentication due to a custom, reversible XOR-and-dictionary transformation used in the HTTP web-management login flow. An unauthenticated attacker on the same local network can derive alternative credential values by capturing ne...

USN-8931-1: Apache HTTP Server vulnerabilities

이지웅 discovered that Apache HTTP Server exposed WebDAV property information. A remote attacker could possibly use this issue to obtain sensitive information. CVE-2026-58415 Zhen Kong and Charles Vosburgh discovered that Apache HTTP Server did not properly validate FTP server responses. A remote...

CVE-2026-76083

Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON data source query runner in redash/queryrunner/jsonds.py used getallresults to combine its configured baseurl with a user-supplied query URL by using urljoin. An absolute query URL replaced the configured...