CVE-2026-81099

tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, and a page i...

CVE-2026-81092

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...

CVE-2026-30045

An integer overflow in the /nnrf-disc/v1/nf-instances component of open5gs v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted HTTP/2 GET request...

CVE-2026-55758 CC: Tweaked: Incomplete fix for GHSA-5jh9-2h63-pw4q: RFC 8215 NAT64 prefix (64:ff9b:1::/96) bypasses SSRF protection

CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to 1.120.0, the SSRF protection in projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java blocks the RFC 6052 64:ff9b::/96 NAT64 prefix but omits the R...

CVE-2026-55758 CC: Tweaked: Incomplete fix for GHSA-5jh9-2h63-pw4q: RFC 8215 NAT64 prefix (64:ff9b:1::/96) bypasses SSRF protection

CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to 1.120.0, the SSRF protection in projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java blocks the RFC 6052 64:ff9b::/96 NAT64 prefix but omits the R...

CVE-2026-55758

CC: Tweaked , a mod for Minecraft adding programmable computers, has an SSRF protection bypass in its AddressPredicate.java component. Prior to 1.120.0 , the protection blocks the RFC 6052 64:ff9b::/96 NAT64 prefix but omits the RFC 8215 64:ff9b:1::/48 local-use prefix, so PrivatePattern.matches(...

Strutscli

StrutsExp Uso strutsexp http://example.com/index.action...

CVE-2025-5349-Scanner

CVE-2025-5349 Schwachstellen-Scanner Verwendung root@kitploit: python3 scanner.py 10.0.0.5 10.0.0.6 -p 80 python3 scanner.py netscaler.local --https -p 443...

CVE-2025-31650

Apache Tomcat 10.1.39 - Denial of Service DoS Dieses Tool führt eine hochvolumige, asynchrone HTTP/2-Anfrageflut durch, die fehlerhafte priority-Header verwendet, um die Stabilität von Apache Tomcat-Servern der Versionen 10.1.10 bis 10.1.39 zu testen. ⚠️ Dies ist ausschließlich für Bildungs- und...

cve-2023-44487

CVE-2023-44487 HTTP/2 Rapid Reset Es gibt einige Beispiele in diesem Repository, die nicht vollständig getestet wurden, um die Auswirkungen zu analysieren, aber ich wollte nur das Konzept dieses Angriffs umsetzen starting many streams and immediately sending RSTSTREAM frame to avoid reaching...

cve-analysis-exploitation-mitigation

CVE Analysis, Exploitation & Mitigation A hands-on cybersecur...

vuln-CVE-2022-41082

vuln-CVE-2022-41082 https & http PER HTTP: nmap -p80 --script exchange-vuln-check.nse PER HTTPS: nmap -p443 --script exchange-vuln-check.nse SALVA I RISULTATI IN UN FILE nmap -p80 --script exchange-vuln-check.nse -oN results.txt...

FakeAuth

FakeAuth FakeAuth ist ein Tool, das nach Benutzeranmeldeinformationen fragt und diese über das HTTP-Protokoll exfiltriert. Inspiriert von folgenden Projekten 1. hlldz's PICKL3 https://github.com/hlldz/pickl3 Erwarten Sie schmutzigen Code und ein paar Fehler ; Installation Keine speziellen...

CVE-2019-16724

Descrizione della vulnerabilità File Sharing Wizard 1.5.0 consente a un attaccante remoto di ottenere l'esecuzione di codice arbitrario sfruttando un overflow del buffer basato su Structured Exception Handler SEH in un parametro HTTP POST. Questo exploit è stato testato su Windows 7 Home...

CVE-2025-8671-vulnerability-POC-

CVE-2025-8671-vulnerability-POC- CVE-2025-8671-Schwachstellen-POC CVE-2025-8671-Schwachstellenscanner Ein professionelles Sicherheitsforschungstool zur Erkennung der MadeYouReset -Schwachstelle CVE-2025-8671 in HTTP/2-Servern. Dieser Scanner verwendet mehrere Erkennungsheuristiken, um Server zu...

EUVD-2026-67078

startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and its authentication middleware was optional: middlewares are...

CVE-2026-81735

UI-TARS-desktop (ByteDance) — the mcp-http-server package defaulted its listen address to :: when no host was supplied, binding Streamable HTTP and SSE MCP transports to every network interface. Authentication middleware was optional, and the @agent-infra/mcp-server-commands and @agent-infra/mcp-...

CVE-2026-81691 openssl_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLs

opensslencrypt versions before 1.4.9 fail to validate server URLs in login and registerwithemail functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including clientid, passwords, and JWTs to achieve full keyserve...

CVE-2026-81099

Timescale's tiger-slack failed to enable the DNS-rebinding-protection option when starting its MCP HTTP transport in mcp/src/httpServer.ts, leaving the host allow-list disabled. This allowed a malicious web page to use DNS rebinding to steer requests to the locally bound Slack MCP server through ...

EUVD-2026-67028

tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...