CVE-2026-4253-Scanner

CVE-2026-42530 — Safe-Check 扫描器 针对 NGINX HTTP/3（QUIC）释放后使用漏洞的非破坏性批量扫描器 在不触发漏洞的前提下，盘点你的哪些主机存在风险。 ⚠️ 免责声明 本工具仅用于授权的安全测试 ——测试你自己的基础设施，或你有明确书面授权进行评估的系统。它执行只读指纹识别 ，并不会 利用漏洞。你有责任确保测试在授权范围内，并遵守适用法律及负责任的披露原则。作者不对滥用行为承担任何责任。 🔍 关于漏洞 CVE-2026-42530 是 NGINX 的 ngxhttpv3module 中存在的释放后使用漏洞（CWE-416）。当 NGINX 配置为提供...

DEBIAN-CVE-2026-105800

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

CVE-2026-105800

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

CVE-2026-105800

The i18next-http-backend library, used for loading translation resources in Node.js , browsers , and Deno , is vulnerable to Server-Side Request Forgery (SSRF) and URL injection prior to version 4.0.2 . The root cause is incomplete URL validation where attacker-controlled language or namespace va...

CVE-2026-105800

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

CVE-2026-105800 i18next-http-backend incomplete URL validation permits SSRF

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

CVE-2026-105800 i18next-http-backend incomplete URL validation permits SSRF

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

CVE-2026-105800 i18next-http-backend incomplete URL validation permits SSRF

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

EUVD-2026-93433

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

CVE-2025-29927

🔍 CVE-2025-29927 - Next.js 中间件绕过检测器 这个基于Python的智能扫描器帮助检测Next.js应用程序中的CVE-2025-29927 漏洞——一种关键的中间件绕过漏洞，允许攻击者通过精心构造的HTTP头来跳过身份验证。 🧠 该工具不仅识别HTTP重定向，还识别客户端重定向机制，例如、基于关键词的登录重定向以及静默认证绕过。 🚀 功能 ✅ 交互式输入（目标URL和路径） ✅ 智能检测： x-middleware-subrequest 绕过头 基于的重定向 包含关键字如 login、sign in、authentication 的HTML内容 ✅...

CVE-2026-66746-HTTP-Response-Splitting-via-Unvalidated-Response-Header-Values-rouille-

安全公告：未经验证的响应头值导致的 HTTP 响应拆分（rouille） 分配的 CVE ID： CVE-2026-66746 摘要 rouille 在将响应头值写入客户端时，不会检查其中是否包含 回车符或换行符。因此，应用程序若将受攻击者影响的文本 放入响应头值，就会在线路上发出额外的响应头，甚至是 整整第二个 HTTP 响应。 rouille 的两个特性使该漏洞在普通代码中也能触达。Request::getparam 会进行百分号解码，因此查询字符串中的 %0d%0a 会变成真正的 CRLF。 而 session::session 会将客户端自己的 Cookie 值复制到...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.17 packages and security update

Red Hat OpenShift Container Platform release 4.22.17 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

tomcat-line-check

tomcat-line-check CVE-2026-24880 · GHSA-563x-q5rq-57qp —— Apache 那句 upgrade to version 11.0.20, 10.1.52 or 9.0.116 对你成不成立? 对多数人不成立,而且有四种不同的不成立方式。这个工具扫你的构件,告诉你是哪一种。 java -jar tomcat-line-check.jar /path/to/tomcat 解压部署的 Tomcat java -jar tomcat-line-check.jar app.war war java -jar...

CVE-2026-24733

CVE-2026-24733 什么是 CVE-2026-24733？Apache Tomcat 在某些安全约束配置下错误地处理了 HTTP/0.9 风格的 HEAD 请求。 CVE-2026-24733 防御性验证器 一个轻量级、无依赖的 Python 安全验证器，用于检测 CVE-2026-24733 ，即 Apache Tomcat HTTP/0.9 HEAD 安全约束 绕过漏洞。 该项目专为以下人员设计： 蓝队 SOC 分析师 漏洞管理团队 获得授权的渗透测试人员 安全研究人员 CI/CD 安全检查 内部资产验证 仅限授权测试。 仅扫描您拥有或已获得明确测试许可的系统。 什么是...

CVE-2026-84429 Potential denial-of-service vulnerability in HTTP header parsing

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.http.parseheaderparameters was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An...

CVE-2026-84429 Potential denial-of-service vulnerability in HTTP header parsing

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.http.parseheaderparameters was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An...

CVE-2026-25089

🚨 CVE-2026-25089 - FortiSandbox 关键操作系统命令注入漏洞 📖 概述 CVE-2026-25089 是影响多个 Fortinet FortiSandbox 部署的一个关键 操作系统命令注入（CWE-78） 漏洞。 未经身份验证的远程攻击者可通过发送特制 HTTP 请求利用此缺陷，从而在底层操作系统上执行任意命令。 ⚠️ 成功利用可能导致设备完全沦陷及远程代码执行（RCE）。 🎯 漏洞详情 字段| 值 ---|--- CVE| CVE-2026-25089 严重性| Critical CWE| CWE-78 攻击类型| 操作系统命令注入 认证| 不需要 用户交互...

Retrofit-1

Retrofit Square, Inc. 为 Android 和 Java 提供的类型安全 HTTP 客户端。 更多信息请参见官方网站。 下载 下载最新 JAR 包或通过 Maven 获取： com.squareup.retrofit2 retrofit 2.4.0 或通过 Gradle： implementation 'com.squareup.retrofit2:retrofit:2.4.0' 开发版本的快照可在 Sonatype 的 snapshots 仓库 中获取。 Retrofit 至少需要 Java 7 或 Android 2.3。 ProGuard 如果您使用...

mod_auth_openidc security update

An update is available for modauthopenidc. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The modauthopenidc is an OpenID Connect authentication module for...