The vulnerability of Visual Studio Code’s source editor, related to deficiencies in HTTP request processing, allows attackers to circumvent security restrictions.

The vulnerability of Visual Studio Code’s source editor is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to bypass security restrictions remotely...

Cisco ASA Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-2020-3561)

A vulnerability in the Clientless SSL VPN WebVPN of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to inject arbitrary HTTP headers in the responses of the affected system. The vulnerability is due to...

Cisco ASA Missing Authorization (CVE-2025-20362)

Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial...

SUSE SLES12: java-11-openjdk / java-11-openjdk-demo / java-11-openjdk-devel / etc (SUSE-SU-2026:4515-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4515-1 advisory. - CVE-2026-60589: improve resource resolving bsc1275777. - CVE-2026-61308: enhance HTTP connections bsc1275778. - CVE-2026-70907:...

Rockwell Automation Allen-Bradley Stratix 5950 Improper Input Validation (CVE-2018-0296)

A vulnerability in the web interface of the Cisco Adaptive Security Appliance ASA could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service DoS condition. It is also possible on certain software releases that the ASA will...

AlmaLinux 9.6 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791281631)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791281631 advisory. - The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined...

RHCOS 4 : OpenShift Container Platform 4.22.17 (RHSA-2026:74427)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:74427 advisory. - net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGSMAXFRAMESIZE frame CVE-2026-33814 No...

Brocade Fabric OS authentication and access control bypass via HTTP host header spoofing

: An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before 10.0.1. The web dispatcher routine evaluates internal management VLAN trust decisions using the client-supplied HTTP host header instead of the actual...

Cisco ASA Buffer Copy without Checking Size of Input (CVE-2021-1493)

A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, remote attacker to cause a buffer overflow on an affected system. The vulnerability is due to insufficient boundary checks...

Cleartext Storage of SupportLink HTTP Proxy Credentials in Diagnostic Support Bundles

: An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS versions before 10.0.1. When SupportLink is configured to use an authenticated HTTP proxy, the system stores the full proxy URL. Anyone with access to the diagnostic support...

BlackLotus-Z2A-Challenge

BlackLotus-Z2A-Challenge BlackLotus-Z2A-Challenge, 지금은 여기 볼 것 없음, 그냥 지나가 주세요 먼저 가장 중요한 것부터 순전히 미관상의 목적을 위해서만, 저는 @darthmaulwareRyan “DM” Smith 의 솔루션에서 yara 탐지 규칙을 부끄럽게도 빌려훔쳐올 것입니다 : 그냥 전문적으로 보이게 하기 위해서요. 가서 그의 트위터를 확인해 보세요, 그는 진짜 멋진 사람입니다! 추신. Ryan, 제가 그걸 훔친 것 때문에 화내지 말아 주세요 : 그리고 디스코드에서 지원해 줘서...

CVE-2026-66908

CVE-2026-66908 — camel-platform-http-main JWT iss/aud が検証されない Apache Camel の脆弱性に対する実行可能な Proof-of-Concept 再現コードです。この脆弱性では、camel-main 組み込み HTTP サーバー が、jwtIssuer も jwtAudience も設定されていない場合に、キーストアのみから JWT 認証子を構築するため、受信トークンは署名と有効期限のみ がチェックされ、iss および aud クレームは一切検証されません。 ランタイム| ディレクトリ| スタック ---|---|---...

CVE-2022-36804

CVE-2022-36804 최근 Sangfor 보안 팀이 발견한 정보에 따르면, Bitbucket Server 및 Bitbucket Data Center 구성 요소에는 명령 주입 취약점이 있습니다. 공격자는 악성 HTTP 요청을 제출하여 임의 코드를 실행할 수 있으며, Bitbucket 비공개 또는 공개 저장소에 대한 읽기 권한이 있거나 쓰기 권한이 있는 공개 저장소에 접근할 수 있는 경우 최종적으로 서버에 대한 접근 권한을 얻을 수 있습니다. 이 저장소에는 이 취약점에 대한 페이로드 파일과 전체 POC가 포함되어 있습니다...

CVE-2026-49975

CVE-2026-49975 HTTP/2 ボム ★ CVE-2026-49975 HTTP/2 ボム PoC ★ https://github.com/user-attachments/assets/89310771-f704-45d1-a6c3-d910de1dbc74 概要 CVE-2026-49975 は Apache HTTP Server における サービス拒否 DoS の脆弱性です。 この脆弱性はHTTP/2リクエスト処理パスで発生し、複数の cookie ヘッダーフィールドが LimitRequestFields に対して適切にカウントされずにマージされる可能性があります...

CVE-2025-55182-RCE-shell

CVE-2025-55182-RCE-shell Burp Suite/antsword - 대화형 셸 HTTP 하이재킹 + POST + AES-256-CBC/BASE64 탐지 -dnslog DNSLog 출력 없는 탐지 Nuclei -poc 취약점 에코 탐지 익스플로잇 -exp 대화형 셸 base64 에코 -exp2 대화형 셸 HTTP 하이재킹 + POST + Base64 -exp3 대화형 셸 HTTP 하이재킹 + POST + AES-256-CBC burpsuite...

CVE-2026-82989 CVE-2026-82989

There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input into service endpoints via network-based HTTP requests to unauthenticated endpoints...

CVE-2026-82989

ViewSonic ViewBoard smartboards, which run on an Android-based system, are vulnerable to an input injection flaw in the vCast software suite. The vulnerability exists in exposed network services, allowing a remote, unauthenticated attacker to inject arbitrary input into service endpoints via HTTP...

CVE-2026-105759 vLLM: Unbounded Prometheus label cardinality from attacker-controlled HTTP method tokens in the vLLM Rust frontend metrics middleware (unauthenticated denial of service)

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's trackhttpmetrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker can send unique arbitrary method tokens ...

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

Impact Capacitor's WebView navigation guard validated only the host and scheme of a target URL, not its path. Because the internal HTTP proxy path /capacitorhttpinterceptor is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed...

GHSA-RVM3-566M-V7FV Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

Impact Capacitor's WebView navigation guard validated only the host and scheme of a target URL, not its path. Because the internal HTTP proxy path /capacitorhttpinterceptor is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed...