CVE-2026-33231

A flaw was found in NLTK Natural Language Toolkit, specifically in the nltk.app.wordnetapp component. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted GET request to the local WordNet Browser HTTP server when it is running in its default...

📄 Cursor IDE MCP Deeplink Remote Code Execution

This Metasploit module exploits the MCP deeplink functionality in Cursor IDE through social engineering. The cursor:// protocol handler can be abused when a user accepts an installation prompt, leading to arbitrary command execution...

Exploit for Path Traversal in Apache Http_Server

https://n...

CVE-2026-33231

NLTK Natural Language Toolkit is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, nltk.app.wordnetapp allows unauthenticated remote shutdown of the local WordNet Browser HTTP server whe...

CVE-2026-33231

NLTK Natural Language Toolkit is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, nltk.app.wordnetapp allows unauthenticated remote shutdown of the local WordNet Browser HTTP server whe...

CVE-2026-33231

CVE-2026-33231 affects NLTK’s nltk.app.wordnet_app in versions 3.9.3 and earlier, where the WordNet Browser HTTP server started in default mode can be remotely shutdown by an unauthenticated GET request to /SHUTDOWN%20THE%20SERVER, causing a denial of service via os._exit(0). IBM’s bulletin/Secur...

com.oracle.microtx.lra:microtx-lra-micronaut (>=24.2.2, <=26.1.1), com.slack.api:bolt-micronaut (>=1.44.0, <=1.49.0) +76 more potentially affected by CVE-2026-33012 via io.micronaut:micronaut-http-server (>=4.7.0, <=4.10.16)

io.micronaut:micronaut-http-server MAVEN version =4.7.0, =24.2.2, =1.44.0, =3.0.0, =0.0.1, =0.11.0, =1.0.0-alpha12, =1.0.0-alpha12, =1.0.0-alpha12, =0.0.27, =0.5.1, =0.0.0.1-test, =0.0.0.9-test, =0.0.0.9-test, =0.0.1.cr1, =0.0.1.cr5 - io.github.flynndi:micronaut-test 0.0.0.1 and more Source cves:...

CVE-2026-33010: Permissive Cross-domain Policy with Untrusted Domains

mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.25.1, when the HTTP server is enabled MCPHTTPENABLED=true, the application configures FastAPI's CORSMiddleware with alloworigins='', allowcredentials=True, allowmethods="", and allowheaders="". The...

httpd: Apache HTTP Server: NTLM Leakage on Windows via SSRF

A server side request forgery flaw has been discovered in the Apache HTTP server. The Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content...

httpd: Apache HTTP Server: CGI environment variable override

A configuration override flaw has been discovered in the apache HTTP server. Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server...

GHSA-JM6W-M3J8-898G Unauthenticated remote shutdown in nltk.app.wordnet_app

Summary nltk.app.wordnetapp allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when it is started in its default mode. A simple GET /SHUTDOWN%20THE%20SERVER request causes the process to terminate immediately via os.exit0, resulting in a denial of service. Details The...

Missing Authentication for Critical Function

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Missing Authentication for Critical Function in WordNet Browser HTTP server in default configuration. An attacker can cause the service to...

Exploit for Path Traversal in Apache Http_Server

CVE-2021-41773 — Apache HTTP Server 2.4.49 Path Traversal / RC...

Security Bulletin: IBM HTTP Server shipped with IBM OpenPages is vulnerable to multiple vulnerabilities

Summary IBM HTTP Server used by IBM WebSphere Application Server, that is shipped as a supporting program of IBM OpenPages. Information about multiple vulnerabilities affecting IBM HTTP Server has been published in a security bulletin. These products have addressed the applicable CVEs. For a...

Exploit for Path Traversal in Apache Http_Server

CVE-2021-41773 — Apache Path Traversal & RCE Internship Tas...

com.oracle.microtx.lra:microtx-lra-micronaut (>=24.2.2, <=26.1.1), com.slack.api:bolt-micronaut (>=1.44.0, <=1.49.0) +76 more potentially affected by CVE-2026-33012 via io.micronaut:micronaut-http-server (>=4.7.0, <=4.10.16)

io.micronaut:micronaut-http-server MAVEN version =4.7.0, =24.2.2, =1.44.0, =3.0.0, =0.0.1, =0.11.0, =1.0.0-alpha12, =1.0.0-alpha12, =1.0.0-alpha12, =0.0.27, =0.5.1, =0.0.0.1-test, =0.0.0.9-test, =0.0.0.9-test, =0.0.1.cr1, =0.0.1.cr5 - io.github.flynndi:micronaut-test 0.0.0.1 and more Source cves:...

com.oracle.microtx.lra:microtx-lra-micronaut (>=24.2.2, <=26.1.1), com.slack.api:bolt-micronaut (>=1.44.0, <=1.49.0) +76 more potentially affected by CVE-2026-33012 via io.micronaut:micronaut-http-server (>=4.7.0, <=4.10.16)

io.micronaut:micronaut-http-server MAVEN version =4.7.0, =24.2.2, =1.44.0, =3.0.0, =0.0.1, =0.11.0, =1.0.0-alpha12, =1.0.0-alpha12, =1.0.0-alpha12, =0.0.27, =0.5.1, =0.0.0.1-test, =0.0.0.9-test, =0.0.0.9-test, =0.0.1.cr1, =0.0.1.cr5 - io.github.flynndi:micronaut-test 0.0.0.1 and more Source cves:...

com.oracle.microtx.lra:microtx-lra-micronaut (>=24.2.2, <=26.1.1), com.slack.api:bolt-micronaut (>=1.44.0, <=1.49.0) +76 more potentially affected by CVE-2026-33012 via io.micronaut:micronaut-http-server (>=4.7.0, <=4.10.16)

io.micronaut:micronaut-http-server MAVEN version =4.7.0, =24.2.2, =1.44.0, =3.0.0, =0.0.1, =0.11.0, =1.0.0-alpha12, =1.0.0-alpha12, =1.0.0-alpha12, =0.0.27, =0.5.1, =0.0.0.1-test, =0.0.0.9-test, =0.0.0.9-test, =0.0.1.cr1, =0.0.1.cr5 - io.github.flynndi:micronaut-test 0.0.0.1 and more Source cves:...

io.micronaut.acme:micronaut-acme (6.0.0-m1), io.micronaut.aws:micronaut-aws-alexa-httpserver (5.0.0-m1) +43 more potentially affected by CVE-2026-33012 via io.micronaut:micronaut-http-server (>=5.0.0-m1, <=5.0.0-m15)

io.micronaut:micronaut-http-server MAVEN version =5.0.0-m1, =5.0.0-m15 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut.acme:micronaut-acme 6.0.0-m1 -...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the DefaultHtmlErrorResponseBodyProvider class. An attacker can exhaust heap memory and cause a crash by sending requests that trigger exceptions with attacker-controlled messages...