CVE-2026-77262

CVE-2026-77262 — Arbitrary File Read in mcp-atlassian via confluenceuploadattachment Severity : High CVSS 8.6 CWE : CWE-22 — Path Traversal Affected : sooperset/mcp-atlassian 0.22.0 Fixed in : 0.22.0 Advisory : GHSA-p6hp-93wp-fh6p NVD : https://nvd.nist.gov/vuln/detail/CVE-2026-77262 Credit :...

EXPLOIT-CVE-2026-42559

CVE-2026-42559 — DNS rebinding in the rmcp Streamable HTTP server transport A self-contained Docker lab and Python proof of concept for CVE-2026-42559 GHSA-89vp-x53w-74fx / RUSTSEC-2026-0189. | ---|--- Affected| rmcp — the official Rust SDK for the Model Context Protocol — 1.4.0 Fixed in| 1.4.0...

spookyssl-pcaps

SpookySSL PCAPs and Network Coverage PCAPs or it didn't happen In the wake of the recently disclosed vulnerability in OpenSSL v3.0 through v3.0.6 CVE-2022-3602, we have looked into how an exploitation attempt appears 'on the wire'. This repository contains PCAPs of various exploitation scenarios,...

doser.go

doser.go DoS tool for HTTP requests inspired by hulk but has more functionalities written in Go: How to use? 1. Compile it go build doser.go 2. Use it For example: 999 threads sends GET requests. P.S: Do not really attack my website pls ./doser -t 999 -g 'https://stylish-bear.ru' Usage Usage of...

CVE-2024-7954POC

CVE-2024-7954POC The porteplume plugin used in SPIP versions before 4.30-alpha2, 4.2.13, and 4.1.16 has an arbitrary code execution vulnerability. Remote unauthenticated attackers can execute arbitrary PHP code as SPIP users by sending specially crafted HTTP requests...

My-Presentation-Slides

My-Presentation-Slides Orange Tsai's public presentation slides. You can find me at: Blog: https://blog.orange.tw/ Mail: [email protected] Twitter: @orange8361 2024 WorstFit: Unveiling Hidden Transformers in Windows ANSI! Black Hat Europe DEVCORE CONF 2025 Confusion Attacks: Exploiting Hidde...

CVE-2019-6440

CVE-2019-6440: Tested products: Zemana antimalware v.2.74.2.150 & Zemana antilogger v.2.74.204.150. Fixed since v.2.74.2.664 About vulnerability: This vulnerability allowed attackers to get SYSTEM privileges on target machines without user interaction. Requirements: 1. Attacker must be able to...

CVE-2026-111065

A flaw was found in aiohttp. An integer overflow in the processing of HTTP Max-Age directives can prevent connections from closing as intended. A remote attacker could exploit this vulnerability to exhaust the connection pool, leading to a temporary Denial of Service DoS...

CVE-2026-Mastodon-Streaming-CRLF-Injection

CVE-2026-XXXXX: HTTP Response Header Injection CRLF in Mastodon Streaming Server Vulnerability Overview Item| Details ---|--- CVE ID| CVE-2026-XXXXX Affected Product| Mastodon Streaming Server Affected Version| $key: $headerskey.join' ' ; Impact HTTP Header Injection: Inject ar...

square__retrofit_CVE-2018-1000850_2-4-0

Retrofit Type-safe HTTP client for Android and Java by Square, Inc. For more information please see the website. Download Download the latest JAR or grab via Maven: com.squareup.retrofit2 retrofit 2.4.0 or Gradle: implementation 'com.squareup.retrofit2:retrofit:2.4.0' Snapshots of the development...

ESFileExplorerOpenPortVuln

ES File Explorer Open Port Vulnerability - CVE-2019-6447 As per their Google Play description: ES File Explorer File Manager is a full-featured file Images, Music, Movies, Documents, app manager for both local and networked use! With over 500 million users worldwide, ES File Explorer File Manager...

CVE-2024-47176-Scanner

CVE-2024-47176 Scanner Evilsocket's PoC for CVE-2024-47176, trimmed and turned into a scanner. I literally opened it in vim and held down the d key. Read his research here. This script just sends the initial UDP packet to port 631 and triggers an http callback, signalling a vulnerable host. Usage...

fapro

FaPro Free,Cross-platform,Single-file mass network protocol server simulator 中文Readme Description FaPro is a Fake Protocol Server tool, Can easily start or stop multiple network services. The goal is to support as many protocols as possible, and support as many deep interactions as possible for...

GO-2026-6777 Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder in github.com/bishopfox/sliver

Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTPS Listener PNG Decoder in github.com/bishopfox/sliver...

CVE-2025-60876

CVE-2025-60876: busybox wget request-target injection fix A behavior-preserving fix for CVE-2025-60876, an HTTP header-injection vulnerability in BusyBox wget, plus the proof-of-concept that demonstrates it and the artifacts for submitting the fix upstream to BusyBox. The vulnerability BusyBox wg...

msdt-follina

MS-MSDT "Follina" Attack Vector John Hammond | May 30, 2022 Create a "Follina" MS-MSDT attack with a malicious Microsoft Word document and stage a payload with an HTTP server. Usage usage: follina.py -h --command COMMAND --output OUTPUT --interface INTERFACE --port PORT options: -h, --help show...

CVE-2019-18655

CVE-2019-18655 metasploit module. SEH based buffer overflow in file sharing wizard app v.1.5.0. CVE summary: File Sharing Wizard version 1.5.0 is affected of Structured Exception Handler based buffer overflow vulnerability. An unauthenticated attacker is able to perform remote command execution a...

CVE-2024-40275_Scanner

CVE-2024-40725 Scanner A Python-based detection tool for CVE-2024-40725 , an Apache HTTP Server source code disclosure vulnerability affecting versions 2.4.0 and 2.4.61. Legal notice: Only run this scanner against servers you own or have explicit written authorization to test. Unauthorized use ma...

ffuf

ffuf - Fuzz Faster U Fool A fast web fuzzer written in Go. Installation Example usage Content discovery Vhost discovery Parameter fuzzing POST data fuzzing Using external mutator Configuration files Help Interactive mode Installation Download a prebuilt binary from releases page, unpack and run! ...

http2-bomb

HTTP/2 Bomb - CVE-2026-49975 A denial-of-service DoS proof of concept targeting HTTP/2 servers. By combining HPACK amplification with stream retention, a single machine with a modest network connection can render a vulnerable server unavailable within seconds. Vulnerability CVE: CVE-2026-49975...