CVE-2026-24733

CVE-2026-24733 CVE-2026-24733이란? Apache Tomcat이 특정 security-constraint 구성에서 HTTP/0.9 스타일 HEAD 요청을 잘못 처리했습니다. CVE-2026-24733 방어적 검증기 CVE-2026-24733 , 즉 Apache Tomcat HTTP/0.9 HEAD security-constraint 우회를 위한 경량의 의존성 없는 Python 보안 검증기입니다. 이 프로젝트는 다음을 위해 설계되었습니다: 블루팀 SOC 분석가 취약점 관리 팀 권한을 부여받은 침투 테스터 보...

cve-2025-29927-lab

이 저장소는 Next.js 로 구축된 의도적으로 취약하게 만든 웹 애플리케이션을 포함하고 있습니다. CVE-2025-29927로 알려진 보안 문제를 시연하고 연구하기 위해 설계되었습니다. 이 프로젝트의 목표는 보안 연구자, 학생, 버그 바운티 헌터가 실제 환경과 유사한 환경에서 취약점이 어떻게 작동하는지 이해하도록 돕는 것입니다. !CAUTION 이 애플리케이션은 의도적으로 안전하지 않으며 프로덕션 환경에 절대 배포해서는 안 됩니다. 🔩목적 취약점이 어떻게 작동하는지 학습 안전하게 식별하고 악용하는 방법 연습 안전하지 않은...

CVE-2019-16278

CVE-2019-16278 - Nostromo nhttpd 원격 코드 실행RCE 취약점 설명 HTTP 요청 처리 과정의 디렉터리 경로 탐색directory traversal을 통해 Nostromo nhttpd 1.9.6 이하 버전에서 발생하는 원격 코드 실행RCE 취약점입니다. 영향을 받는 버전 Nostromo nhttpd 1.9.6 및 이전 버전 익스플로잇 상세 이 익스플로잇은 URL 인코딩된 CRLF 문자%0d를 사용한 디렉터리 경로 탐색 취약점을 악용하여 /bin/sh에 접근하고 임의의 명령을 실행합니다. 작동 방식: 1...

CVE-2025-55182

CVE-2025-55182 Next.js Prototype Pollution CVE-2025-55182는 nextjs의 치명적인 프로토타입 폴루션Prototype Pollution 취약점으로, 프레임워크의 요청 처리 메커니즘에서 입력값을 제대로 검증하지 않아 RCE원격 코드 실행를 허용합니다. 이 모든 사태는 nextjs가 풋내기처럼 JSON 객체를 무턱대고 신뢰하기 때문에 벌어집니다. POC 1 요청 파싱에서의 프로토타입 폴루션: nextjs는 프로토타입 체인을 오염시킬 수 있는 객체를 제대로 검증하지 않습니다. 2 안전하지...

cve-2025-43564-tomcat_put_rce_reproduction

CVE-2025-43564 — Apache Tomcat 부분 PUT 요청 처리 RCE 필드| 값 ---|--- CVE ID| CVE-2025-43564 CVSS 점수| 9.8 치명적 벡터| AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE| CWE-494 — 무결성 검사 없는 코드 다운로드 악용 상태| 공개 후 1주일 이내 실제 공격 환경야생에서 확인됨 공개일| 2025년 7월 패치| Tomcat 11.0.6, 10.1.40, 9.0.102 목차 1. 개요 2. 기술적 세부 사항 3. 영향받는 버전 4. ...

Rocky Linux 10.2 [CIQ] Security Update: qemu-guest-agent / qemu-guest-agent-debuginfo / qemu-img / etc (crlsa-2026_58571)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202658571 advisory. qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling CVE-2026-48914 Bug Fixes and Enhancements: qemu-kvm hung during drain after double pause...

Rocky Linux 9 [CIQ] Security Update: java-25-openjdk / java-25-openjdk-crypto-adapter / etc Multiple Vulnerabilities (crlsa-2026_0933)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20260933 advisory. JDK: Improve JMX connections CVE-2026-21925 JDK: Improve HttpServer Request handling CVE-2026-21933 JDK: Enhance Certificate Checking CVE-2026-21945 libpng...

Rocky Linux 9 [CIQ] Security Update: qemu-guest-agent / qemu-guest-agent-debuginfo / qemu-img / etc (crlsa-2026_39311)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202639311 advisory. qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling CVE-2026-48914 Tenable has extracted the preceding description block directly from the CIQ...

CVE-2026-103399

A flaw was found in SoupServer libsoup. When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final non-1xx response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-aliv...

CVE-2026-103399 Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue body

A flaw was found in SoupServer libsoup. When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final non-1xx response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-aliv...

CVE-2026-103399

A vulnerability exists in SoupServer (libsoup) where an HTTP/1.x client sending a request with Expect: 100-continue and a request body can trigger request smuggling . If the server returns an early final (non-1xx) response before reading the body, it fails to drain the bytes or close the connecti...

CVE-2026-103399 Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue body

A flaw was found in SoupServer libsoup. When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final non-1xx response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-aliv...

Linux Distros Unpatched Vulnerability : CVE-2026-103399

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in SoupServer libsoup. When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early...

EUVD-2026-78884

IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied requests...

ROS-20260915-73-0131

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

Astra Linux – Vulnerability in xwayland, xorg-server

A flaw was discovered in the X server’s request handling. A non-zero value for “bytes to ignore” in a client’s request can cause the server to skip processing another client’s request, potentially leading to a denial of service...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: A missing key size check in L2CAPLECONNREQ has been fixed. A check for the encryption key size is added upon receiving the L2CAPLECONNREQ. This is required by L2CAP/LE/CFC/BV-15-C, which expects...

ROS-20260911-73-0119

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

ROS-20260910-73-0147

The vulnerability in Chromium is related to errors in handling HTTP requests. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20260910-73-0092

The vulnerability of the WebNN component in Google Chrome and Microsoft Edge is related to errors in handling HTTP requests. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...