ldapserver

This package is a work in progress. ldapserver is a helper library for building server software capable of speaking the LDAP protocol. This could be an alternate implementation of LDAP, a custom LDAP proxy or even a completely different backend capable of "masquerading" its API as a LDAP Server...

sh4d0wup

sh4d0wup % docker run -it --rm ghcr.io/kpcyrd/sh4d0wup:edge -h Usage: sh4d0wup OPTIONS Commands: bait Start a malicious update server front Bind a http/https server but forward everything unmodified infect High level tampering, inject additional commands into a package tamper Low level tampering,...

CVE-2026-107333

Malcolm's nginx-based reverse proxy contains a URL path normalization inconsistency between its Lua-based role-based access control (RBAC) authorization layer and nginx's internal request routing logic. An authenticated user can exploit this by crafting specially formatted request paths to bypass...

wp2shell-lab

mini-wp-rest A compact, dependency-free reimplementation of a small slice of WordPress's REST API — just enough to serve a public posts collection and run several sub-requests in one round trip. Handy for teaching how WordPress routing, WPQuery, and $wpdb fit together without pulling in all of...

axios: Axios: HTTP header injection via inherited prototype properties

A flaw was found in Axios. If a separate vulnerability modifies shared object properties prototype pollution in the application environment, Axios may inherit those properties when processing request configurations rebuilt without explicit headers. An attacker can exploit this condition to inject...

axios: Axios: HTTP header injection via inherited prototype properties

A flaw was found in Axios. If a separate vulnerability modifies shared object properties prototype pollution in the application environment, Axios may inherit those properties when processing request configurations rebuilt without explicit headers. An attacker can exploit this condition to inject...

axios: Axios: HTTP header injection via inherited prototype properties

A flaw was found in Axios. If a separate vulnerability modifies shared object properties prototype pollution in the application environment, Axios may inherit those properties when processing request configurations rebuilt without explicit headers. An attacker can exploit this condition to inject...

Prototype Pollution

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution via insufficient hardening of runtime option handling in the fetch and HTTP adapters lib/adapters/fetch.js, lib/adapters/http.js, and...

Prototype Pollution

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution via insufficient hardening of runtime option handling in the fetch and HTTP adapters lib/adapters/fetch.js, lib/adapters/http.js, and related helpers...

CVE-2026-101904

A flaw was found in Axios. If a separate vulnerability modifies shared object properties prototype pollution in the application environment, Axios may inherit those properties when processing request configurations rebuilt without explicit headers. An attacker can exploit this condition to inject...

CVE-2026-100659

A flaw was found in the Netty HTTP/3 codec. This vulnerability allows access control and request routing bypasses due to missing validation of destination headers. A remote, unauthenticated attacker can exploit this flaw by sending a Hypertext Transfer Protocol HTTP request containing conflicting...

CVE-2026-100659 Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass

Netty's HTTP/3 codec io.netty:netty-codec-http3 in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both present, carry the same value. A remote unauthenticated peer can send a single...

CVE-2026-100659 Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass

Netty's HTTP/3 codec io.netty:netty-codec-http3 in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both present, carry the same value. A remote unauthenticated peer can send a single...

CVE-2026-100659 Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass

Netty's HTTP/3 codec io.netty:netty-codec-http3 in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both present, carry the same value. A remote unauthenticated peer can send a single...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in http-proxy-middleware

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in http-proxy-middleware Vulnerability Details CVEID:CVE-2026-55602 DESCRIPTION: http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents...

haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling

A flaw was found in HAProxy. A malicious FastCGI Fast Common Gateway Interface backend can exploit an integer overflow vulnerability in the fcgiconn structure's drl field. This occurs when specific contentLength and paddingLength values cause the drl field to wrap to zero, leading to incorrect...

haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling

A flaw was found in HAProxy. A malicious FastCGI Fast Common Gateway Interface backend can exploit an integer overflow vulnerability in the fcgiconn structure's drl field. This occurs when specific contentLength and paddingLength values cause the drl field to wrap to zero, leading to incorrect...

CVE-2026-67320 axios before 0.33.0 Prototype Pollution via Node HTTP adapter

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...

CVE-2026-15704

In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent trailing-slash handling between the ABAC middleware and the HTTP router. The shared router configuration used Chi's middleware.StripSlashes,...

MGASA-2026-0250 Updated haproxy packages fix security vulnerability

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgiconn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record...