impersonate-proxy

impersonate-proxy English | 日本語 | 简体中文 A local MITM proxy that lets you control TLS fingerprints JA3/JA4, HTTP/2 fingerprints, HTTP header order, User-Agent, and source IP headers — all from a single YAML config file. A Chrome extension is included for toggling the proxy and switching fingerprint...

EUVD-2026-91120

Langflow: Title Authenticated Remote Code Execution in validatecode via Malicious Decorators Description...

CVE-2026-77262

CVE-2026-77262 — Произвольное чтение файлов в mcp-atlassian через confluenceuploadattachment Серьёзность : Высокая CVSS 8.6 CWE : CWE-22 — Path Traversal Затронуто : sooperset/mcp-atlassian 0.22.0 Исправлено в : 0.22.0 Консультация : GHSA-p6hp-93wp-fh6p NVD :...

EXPLOIT-CVE-2026-42559

CVE-2026-42559 — DNS-ребайндинг в транспортном уровне Streamable HTTP сервера rmcp Автономный Docker-лабораторный стенд и Python-эксплойт proof of concept для CVE-2026-42559 GHSA-89vp-x53w-74fx / RUSTSEC-2026-0189. | ---|--- Затронуто| rmcp — официальный Rust SDK для Model Context Protocol — 1.4....

CVE-2026-46453

camel-elasticsearch-rest-client Репродуктор инъекции через заголовки без префикса CVE-2026-46453 Этот проект демонстрирует инъекцию заголовков сообщений / обход авторизации в компоненте camel-elasticsearch-rest-client Apache Camel, отслеживаемую как CVE-2026-46453. Компонент читает несколько...

CVE-2026-105742 Docling: Configured HTTP headers sent to every remote image host named by a document

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.95.0 until 2.132.0, the HTML image resource loader in docling/backend/utils/imageresourceloader.py forwards headers configured through the HTMLBackendOptions.heade...

CVE-2026-105742

The docling library (versions 2.95.0 through 2.132.0 ) contains a vulnerability in the HTML image resource loader located at docling/backend/utils/image_resource_loader.py. When enable_remote_fetch=True and fetch_images=True are set, the loader forwards custom headers—such as API keys and cookies...

CVE-2025-60876

CVE-2025-60876: busybox wget 요청 대상 삽입 수정 CVE-2025-60876에 대한 동작을 유지하는 수정 사항입니다. 이는 BusyBox wget의 HTTP 헤더 삽입 취약점이며, 이를 증명하는 개념 증명PoC과 수정 사항을 BusyBox 업스트림에 제출하기 위한 아티팩트가 포함되어 있습니다. 취약점 BusyBox wget은 URL 경로와 쿼리를 HTTP 요청 라인에 그대로 복사합니다. 원시 CR0x0D, LF0x0A 또는 기타 제어 바이트를 포함하는 URL은 요청 라인을 분할하고 공격자가 제어하는 헤더...

http2-bomb

HTTP/2 Bomb - CVE-2026-49975 Доказательство концепции отказа в обслуживании DoS, нацеленное на HTTP/2 серверы. Комбинируя усиление HPACK с удержанием потоков, одна машина с умеренным сетевым подключением может вывести уязвимый сервер из строя в течение секунд. Уязвимость CVE: CVE-2026-49975...

CVE-2026-95265

Feehi CMS 2.1.1 contains a Server-Side Request Forgery SSRF vulnerability in the UEditor catchimage endpoint. The private-IP validation does not block loopback or link-local addresses, allowing an attacker to make the server probe internal HTTP services through response differences...

CVE-2026-105647

Ghost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result i...

CVE-2026-105648

Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A...

CVE-2026-66752-HTTP-Request-Smuggling-via-Unparsed-Transfer-Encoding-Values-tiny_http-

Уведомление о безопасности: контрабанда HTTP-запросов через неинтерпретируемые значения Transfer-Encoding tinyhttp Назначенный CVE ID: CVE-2026-66752 Сводка tinyhttp проверяет только наличие заголовка Transfer-Encoding. Он никогда не смотрит на значение. Любое значение, включая кодировки, не...

CVE-2017-12617

CVE-2017-12617 CVE-2017-12617 — критическая уязвимость удалённого выполнения кода RCE, обнаруженная в Apache Tomcat поражаются системы, в которых включены HTTP PUT-запросы путем установки параметра инициализации "read-only" сервлета Default в значение "false". Версии Tomcat до 9.0.1 Beta, 8.5.23,...

PoC_CVE-2019-0217

이 저장소는 CVE-2019-0217에 대한 개념 증명 익스플로잇과 해당 CVE에 취약한 웹 서버를 설정하기 위한 Dockerfile을 포함하고 있습니다. CVE 설명 Apache HTTP Server 2.4 릴리스 2.4.38 및 이전 버전에서 스레드 서버에서 실행될 때 modauthdigest의 경쟁 조건으로 인해 유효한 자격 증명을 가진 사용자가 다른 사용자 이름을 사용하여 인증하고 구성된 액세스 제어 제한을 우회할 수 있었습니다. 배경 HTTP 다이제스트 인증 클라이언트가 HTTP 다이제스트 인증이 있는 리소스에 접근하...

CVE-2026-105766 Chainguard Academy (edu) Nginx directory redirect downgrades HTTPS requests to HTTP

Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy edu from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0e50739c225f5aee2e803800a47fc0feb906 allows an on-path network attacker to read or modify documentatio...

CVE-2026-105766 Chainguard Academy (edu) Nginx directory redirect downgrades HTTPS requests to HTTP

Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy edu from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0e50739c225f5aee2e803800a47fc0feb906 allows an on-path network attacker to read or modify documentatio...

CVE-2026-105766

The Chainguard Academy (edu) website is vulnerable to an HTTPS to HTTP downgrade attack due to the use of the backend-facing $scheme variable in the nginx.conf trailing-slash directory redirect. This issue exists in versions from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0...

Security Bulletin: Due to the use of Spring Security's WebAuthn, IBM Sterling Control Center is vulnerable to Incorrect Authorization (CVE-2026-47841)

Summary Spring Security's WebAuthn is used by IBM Sterling Control Center as part of dependency in spring-security-web-6.4.12.jar. Vulnerability Details CVEID:CVE-2026-47841 DESCRIPTION: An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when usi...

CVE-2026-46587

camel-couchbase CCB Header Injection Reproducer CVE-2026-46587 Этот проект демонстрирует инъекцию заголовков сообщений в компонент camel-couchbase Apache Camel, отслеживаемую как CVE-2026-46587. Компонент считывает несколько заголовков Exchange для управления своим поведением — CCBKEY ключ...