CVE-2025-55182-Exploit

CVE-2025-55182 — Next.js Flight Deserialization RCE Remote Code Execution exploit for Next.js Server Actions Flight deserialization vulnerability 📌 Overview This repository contains a working exploit for CVE-2025-55182 , a deserialization vulnerability in the Next.js Flight protocol Server Action...

CVE-2026-92474

A security flaw has been discovered in GPAC 26.08-DEV. This affects the function gfinlinegetprotolib of the file src/compositor/mpeg4inline.c of the component Proto Link Handler. The manipulation results in use after free. The attack requires a local approach. The exploit has been released to the...

CVE-2026-92474 GPAC Proto Link mpeg4_inline.c gf_inline_get_proto_lib use after free

A security flaw has been discovered in GPAC 26.08-DEV. This affects the function gfinlinegetprotolib of the file src/compositor/mpeg4inline.c of the component Proto Link Handler. The manipulation results in use after free. The attack requires a local approach. The exploit has been released to the...

CVE-2026-92474

A use after free vulnerability exists in the Proto Link Handler component of GPAC 26.08-DEV , specifically in the function gf_inline_get_proto_lib within src/compositor/mpeg4_inline.c. The flaw requires a local attack with low complexity and low privileges. Per CVSS 3.1, the impact is LOW (base s...

CVE-2026-92474 GPAC Proto Link mpeg4_inline.c gf_inline_get_proto_lib use after free

A security flaw has been discovered in GPAC 26.08-DEV. This affects the function gfinlinegetprotolib of the file src/compositor/mpeg4inline.c of the component Proto Link Handler. The manipulation results in use after free. The attack requires a local approach. The exploit has been released to the...

EUVD-2026-80955

A security flaw has been discovered in GPAC 26.08-DEV. This affects the function gfinlinegetprotolib of the file src/compositor/mpeg4inline.c of the component Proto Link Handler. The manipulation results in use after free. The attack requires a local approach. The exploit has been released to the...

CVE-2019-7609

CVE-2019-7609 Configuración de laboratorio docker para kibana-7609 Referencia : https://github.com/mpgn/CVE-2019-7609 root@kitploit: Abre Kibana Pega uno de los siguientes payloads en el visualizador de Timelion Haz clic en Run En el panel izquierdo, haz clic en Canvas ¡Tu reverse shell debería...

CVE-2018-5951

CVE-2018-5951: MikroTik RouterOS 拒绝服务漏洞 漏洞概述 MikroTik RouterOS 中存在一个漏洞，允许未经身份验证的远程攻击者强制路由器重启。攻击方式是通过 IP 协议号 97 向 RouterOS 的 IPv6 地址发送一个 1 字节的数据包。所有支持 EoIPv6 的 RouterOS 版本均可能受此攻击影响。该攻击要求目标系统已启用 IPv6 并且至少存在一个隧道接口。 攻击向量 目标系统已启用 IPv6。 没有阻止 IP 协议号 97 的 INPUT 数据的 IPv6 过滤规则。 目标系统中至少存在一个隧道接口（隧道类型无关）。 漏洞详...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Check for any of tcpbpfprots when cloning a listener. A listening socket linked to a sockmap has its skprot overridden. It points to one of the struct proto variants in tcpbpfprots. This variant depends on the...

Astra Linux – Vulnerability in Redis

Redis is an open-source, in-memory database that persists data on disk. In affected versions, a integer overflow bug in Redis can be exploited to corrupt the heap and potentially lead to remote code execution. The vulnerability involves changing the default proto-max-bulk-len and...

[SECURITY] Fedora 43 Update: rust-hickory-proto-0.26.2-1.fc43

Hickory-proto is a safe and secure low-level DNS library. This is the foundational DNS protocol library used by the other higher-level Hickory DNS crates...

CVE-2026-90580

A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side...

EUVD-2026-77070

A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side...

CVE-2026-90580 FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery

A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side...

PT-2026-90838

joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code. Attackers can supply proto keys in custom messages to replace the returned object's prototype, breaking downstream code relying on...

Fedora 44 : rust-hickory-net / rust-hickory-proto / rust-hickory-resolver (2026-3c1acd5a65)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-3c1acd5a65 advisory. Update hickory-dns crates to version 0.26.2. This includes fixes for a large number of security relevant bugs. Release notes:...

Astro - Broken Access Control

Astro 2.16.0 to 5.15.5 contains a broken access control caused by insecure use of unsanitized x-forwarded-proto and x-forwarded-port headers in URL building, letting attackers bypass middleware protection, cause DoS, SSRF, and URL pollution, exploit requires crafted headers. id: CVE-2025-64525...

CVE-2026-85063

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

CVE-2026-81315 MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header

Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil, originallowed?/3...

EEF-CVE-2026-81315 MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header

Summary Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil,...