CVE-2018-11759

CVE-2018-11759 Proof of concept Description The Apache Web Server httpd specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK modjk Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported b...

Apache Tomcat JK Connect <=1.2.44 - Manager Access

Apache Tomcat JK modjk Connector 1.2.0 to 1.2.44 allows specially constructed requests to expose application functionality through the reverse proxy. It is also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is so...

Apache Tomcat JK Connect <=1.2.44 - Manager Access Detection

Apache Tomcat JK modjk Connector 1.2.0 to 1.2.44 allows specially constructed requests to expose application functionality through the reverse proxy. It is also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is so...

USN-8369-2 libapache-mod-jk regression

USN-8369-1 fixed a vulnerability in modjk. It was discovered that for Ubuntu 18.04 LTS, during the update preparation phase, a previous fix for CVE-2023-41081 was incorrectly dropped. This update reintroduces the fix for CVE-2023-41081. We apologize for the inconvenience. Original advisory detail...

Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs

Dear Maintainers,I am writing to you on behalf of the Tencent AI Sec. We have identified a potential vulnerability in one of your products and would like to report it to you for further investigation and mitigation. SummaryThe jk parameter is received in pyLoad CNL Blueprint. Due to the lack of j...

PYSEC-2026-1815 Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs

Dear Maintainers, I am writing to you on behalf of the Tencent AI Sec. We have identified a potential vulnerability in one of your products and would like to report it to you for further investigation and mitigation. Summary The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of...

USN-8369-1 libapache-mod-jk vulnerability

It was discovered that Apache Tomcat Connectors used incorrect default permissions for shared memory on Unix-like systems. A local attacker could possibly use this issue to view or modify modjk configuration data in shared memory, resulting in sensitive information exposure or a denial of service...

com.jalalkiswani:jk-app-web (>=6.2.0, <=6.4.0), com.jalalkiswani:jk-app-webstack (>=6.2.0, <=6.4.0) +9 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (8.5.72)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.72 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.jalalkiswani:jk-app-web =6.2.0, =6.2.0, =6.0.0, =6.0.0, =5.2.5, =5.2.5,...

com.jalalkiswani:jk-app-web (>=6.2.0, <=6.4.0), com.jalalkiswani:jk-app-webstack (>=6.2.0, <=6.4.0) +9 more potentially affected by CVE-2026-41284 via org.apache.tomcat.embed:tomcat-embed-core (8.5.72)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.72 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.jalalkiswani:jk-app-web =6.2.0, =6.2.0, =6.0.0, =6.0.0, =5.2.5, =5.2.5,...

com.jalalkiswani:jk-app-web (>=6.2.0, <=6.4.0), com.jalalkiswani:jk-app-webstack (>=6.2.0, <=6.4.0) +9 more potentially affected by CVE-2026-43513 via org.apache.tomcat.embed:tomcat-embed-core (8.5.72)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.72 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.jalalkiswani:jk-app-web =6.2.0, =6.2.0, =6.0.0, =6.0.0, =5.2.5, =5.2.5,...

com.jalalkiswani:jk-app-web (>=6.2.0, <=6.4.0), com.jalalkiswani:jk-app-webstack (>=6.2.0, <=6.4.0) +9 more potentially affected by CVE-2026-42498 via org.apache.tomcat.embed:tomcat-embed-core (8.5.72)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.72 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.jalalkiswani:jk-app-web =6.2.0, =6.2.0, =6.0.0, =6.0.0, =5.2.5, =5.2.5,...

CVE-2025-62872: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in JK Social Photo Fetcher facebook-photo-fetcher allows Cross Site Request Forgery.This issue affects Social Photo Fetcher: from n/a through = 3.0.4...

EUVD-2008-5494

Malware in sbrugna...

EUVD-2025-2825

Malicious code in bioql PyPI...

com.focframework:foc (>=1.7.2, <=1.7.3), com.focframework:focdatasource (>=1.7.2, <=1.7.3) +9 more potentially affected by CVE-2025-10492 via net.sf.jasperreports:jasperreports (6.2.2)

net.sf.jasperreports:jasperreports MAVEN version 6.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on net.sf.jasperreports:jasperreports and may be impacted: - com.focframework:foc =1.7.2, =1.7.2, =1.7.2, =0.0.9, =0.5.5, =0.5.8 -...

CVE-2025-57751

pyLoad is the free and open-source Download Manager written in pure Python. The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of jk parameter verification, the jk parameter input by the user is directly determined as dykpy.evaljs, resulting in the server CPU being fully occupi...

Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs

Dear Maintainers, I am writing to you on behalf of the Tencent AI Sec. We have identified a potential vulnerability in one of your products and would like to report it to you for further investigation and mitigation. Summary The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of...

Allocation of Resources Without Limits or Throttling

Overview pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the jk parameter in the CNL Blueprint process. An attacker can cause the server CPU to become fully...

CVE-2025-57751

pyLoad is the free and open-source Download Manager written in pure Python. The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of jk parameter verification, the jk parameter input by the user is directly determined as dykpy.evaljs, resulting in the server CPU being fully occupi...

CVE-2025-57751

The CVE-2025-57751 issue affects pyLoad, specifically the CNL Blueprint. The vulnerability arises from missing validation of the jk parameter, which is processed as JavaScript via evaljs (depending on Python version, via js2py or dukpy). An attacker-supplied jk can cause the server to execute arb...