Lucene search
+L

715 matches found

Kitploit
Kitploit
added 2026/08/26 6:38 a.m.2 views

CVE-2026-66754-Remote-Denial-of-Service-via-Reachable-Assertion-in-URL-Prefix-Handling-rouille-

सुरक्षा सलाह: URL प्रीफ़िक्स हैंडलिंग में रीचेबल एसर्शन के माध्यम से रिमोट डेनियल ऑफ़ सर्विस rouille निर्धारित CVE ID: CVE-2026-66754 सारांश Request::removeprefix प्रतिशत-डिकोड किए गए URL का परीक्षण करता है, लेकिन रॉ URL पर एसर्शन करता है। ऐसा अनुरोध जिसका डिकोड किया गया पाथ प्रीफ़िक्स से शुरू हो...

8.2CVSS5.2AI score0.00401EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/08/26 6:38 a.m.2 views

CVE-2026-66746-HTTP-Response-Splitting-via-Unvalidated-Response-Header-Values-rouille-

सुरक्षा सलाह: अमान्य प्रतिक्रिया हेडर मानों के माध्यम से HTTP रिस्पांस स्प्लिटिंग rouille निर्धारित CVE ID: CVE-2026-66746 सारांश rouille प्रतिक्रिया हेडर मानों को कैरिज रिटर्न या लाइन फीड के लिए जाँचे बिना क्लाइंट को लिखता है। एक एप्लिकेशन जो हमलावर-प्रभावित टेक्स्ट को हेडर मान में रखता है, इसलि...

5.4CVSS5.2AI score0.00241EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/08/26 2:59 a.m.1 views

CVE-2014-0094

CVE-2014-0094 सत्यापन के लिए। https://piyolog.hatenadiary.jp/entry/20140417/1397750195 के संदर्भ में, vulhub/java:7u55-jdk tomcat-8.0.5 struts-2.3.16 पुनः निर्मित। classLoader काम कर रहा है, लेकिन महत्वपूर्ण लॉग प्रतिशत-एन्कोडेड हो रहा है, इसलिए RCE तक नहीं पहुँच पा रहा विंडोज़ संस्करण भी जोड़ा ग...

5CVSS0.99524EPSS
SaveExploits8
Kitploit
Kitploit
added 2026/08/26 1:42 a.m.1 views

CVE-2024-38819-POC2

CVE-2024-38819: प्रूफ ऑफ कॉन्सेप्ट PoC यह CVE-2024-38819 भेद्यता के लिए एक प्रूफ ऑफ कॉन्सेप्ट है, जिसे मैंने रिपोर्ट किया था, जो पाथ ट्रैवर्सल एक्सप्लॉइट को प्रदर्शित करता है। निष्पादन चरण 1. Docker इमेज बनाएँ Spring Boot 3.3.4, जो Spring Framework 6.1.13 पर आधारित है root@kitploit: cd vuln docke...

7.5CVSS6.2AI score0.54862EPSS
SaveExploits6
Kitploit
Kitploit
added 2026/08/25 7:06 a.m.3 views

CVE-2021-41773-POC

CVE-2021-41773 भेद्यता पुनरुत्पादन रिपोर्ट भेद्यता अवलोकन CVE ID : CVE-2021-41773 भेद्यता नाम : Apache HTTP सर्वर पथ ट्रैवर्सल भेद्यता जोखिम स्तर : उच्च CVSS 7.5 प्रभावित संस्करण : Apache HTTP सर्वर 2.4.49 भेद्यता विवरण : Apache HTTP सर्वर 2.4.49 संस्करण में पथ सामान्यीकरण फ़ंक्शन apnormalizepath...

9.8CVSS8.4AI score0.99992EPSS
SaveExploits163
CVE
CVE
added 2026/08/24 1:11 p.m.13 views

CVE-2026-76842

CVE-2026-76842 affects the Mercado Pago Node.js SDK (through 3.4.0 ). The payment, paymentRefund, advancedPayment, and disbursementRefund clients interpolate caller-supplied identifiers into API request paths via template literals without percent-encoding , so URL-structural characters (dot-dot, ...

8.8CVSS5.4AI score0.0038EPSS
SaveExploits0References4
NVD
NVD
added 2026/08/24 11:16 a.m.9 views

CVE-2026-76172

fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries...

7.5CVSS0.00247EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/24 10:16 a.m.10 views

CVE-2026-75899

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

7.5CVSS0.00234EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/24 10:07 a.m.40 views

CVE-2026-76172 fast-uri vulnerable to host confusion via percent-encoded scheme normalization

fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries...

7.5CVSS0.00247EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/24 9:40 a.m.7 views

EUVD-2026-64763

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

7.5CVSS5.5AI score0.00234EPSS
SaveExploits0References2
Debian CVE
Debian CVE
added 2026/08/24 9:40 a.m.7 views

CVE-2026-75899

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

7.5CVSS5.5AI score0.00234EPSS
SaveExploits0
CVE
CVE
added 2026/08/24 9:40 a.m.18 views

CVE-2026-75899

fast-uri , a URI parser for Node.js, suffers from double percent-decoding of the hostname: it decodes percent escapes during parsing and decodes them again during authority recomposition. This violates RFC 3986 §2.4 (an implementation must not decode the same string more than once) and allows a s...

7.5CVSS5.4AI score0.00234EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/24 9:40 a.m.36 views

CVE-2026-75899 fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

7.5CVSS0.00234EPSS
SaveExploits0References2
Github Security Blog
Github Security Blog
added 2026/08/20 9:34 p.m.8 views

Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)

Summary The cross-site WebSocket hijacking fix was reimplemented as an origin check gated on a raw-URI prefix test, but Go's ServeMux routes on the percent-decoded path, so requesting /%61pi/events reaches the WebSocket handler while skipping the only origin control, and the upgrader itself accep...

6.5CVSS5.6AI score0.00216EPSS
SaveExploits2References4Affected Software1
EUVD
EUVD
added 2026/08/20 9:29 p.m.9 views

EUVD-2026-63668

Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures...

6.5CVSS5.4AI score0.00146EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/20 9:29 p.m.7 views

CVE-2026-67448 Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)

Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures...

6.5CVSS5.6AI score
SaveExploits0References5
Cvelist
Cvelist
added 2026/08/20 9:29 p.m.35 views

CVE-2026-67448 Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)

Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures...

6.5CVSS0.00146EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/20 6:16 p.m.8 views

CVE-2026-73259

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MGENABLEDIRLIST and persuade a user to visit it. The mghttpservedir and listdir path in src/http.c places the decoded request URI into the...

5.4CVSS0.0023EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/20 6:15 p.m.11 views

OSEC-2026-16 Path traversal in Cohttp.Path.resolve_local_file

The issue is that the function normalizes the URI path before percent decoding it: OCaml let resolvelocalfile docroot uri = let path = Uri.pctdecode path resolve "http" ofstring "/" uri in ... Because %2f is decoded after Uri.resolve, encoded separators survive dot-segment normalization. For...

8.7CVSS5.5AI score
SaveExploits0
CVE
CVE
added 2026/08/20 5:55 p.m.53 views

CVE-2026-63385

Libevent versions before 2.1.13 and 2.2.2-alpha contain two HTTP parsing flaws in http.c: evhttp_decode_uri_internal decodes %00 into literal NUL bytes, truncating paths to bypass validation; evhttp_header_is_valid_value accepts obsolete line folding with CRLF, enabling header injection and acces...

9.2CVSS5.3AI score0.00403EPSS
SaveExploits0References5
Rows per page
Query Builder