PT-2026-96075

Name of the Vulnerable Software and Affected Versions github.com/temporalio/tchannel-go affected versions not specified Description The software fails to validate the one-byte checksum-type field in inbound TChannel call frames. A remote network peer can complete the standard initialization...

Linux Distros Unpatched Vulnerability : CVE-2026-93573

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass Transfer-Encoding header validation by splitting the...

SUSE SLED15 / SLES15 Security Update : python-aiohttp (SUSE-SU-2026:4031-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4031-1 advisory. - CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without...

Oracle Linux 10 : tomcat (ELSA-2026-69259)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-69259 advisory. - Resolves: RHEL-192817 tomcat: HTTP/2 request headers not validated CVE-2026-41293 - Resolves: RHEL-192648 tomcat: Improper Input Validation...

Linux Distros Unpatched Vulnerability : CVE-2026-93566

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-si...

PT-2026-96219

Name of the Vulnerable Software and Affected Versions Warpgate versions prior to 0.25.6 Description The copy server request function in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before the inject own headers function appends the authenticated...

CVE-2026-73548: Inconsistent Interpretation of HTTP Requests

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HTTP/2 client can place a complete...

VulnCheck KEV: CVE-2026-7273

Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request...

SUSE SLED15 / SLES15 Security Update : nghttp2 (SUSE-SU-2026:4029-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4029-1 advisory. This update for nghttp2 fixes the following issue: - CVE-2026-58055: HTTP/1.1 Upgrade request can lead to HTTP request...

CVE-2026-73547: Improper Input Validation

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's extauthz filter assumes that a request contains a :path pseudoheader when applying queryparameterstoset or queryparameterstoremove from an authorization...

CVE-2026-61749: Exposure of Sensitive Information to an Unauthorized Actor

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint report rendering to retrieve attacker-selected resources through the HTTP and HTTPS URL schemes or the local file URI scheme. The...

CVE-2026-73548: Inconsistent Interpretation of HTTP Requests

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HTTP/2 client can place a complete...

Linux Distros Unpatched Vulnerability : CVE-2026-93579

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage...

CVE-2026-94051 0717376 cowork_bench pdf-tools-mcp server.py ControlFlowNode server-side request forgery

A vulnerability was found in 0717376 coworkbench up to d943e75bc0fc8e3b27141979300cd8cbcd1e890d. Affected by this vulnerability is the function ControlFlowNode of the file localservers/pdf-tools-mcp/pdftoolsmcp/server.py of the component pdf-tools-mcp. Performing a manipulation of the argument...

CVE-2026-94040 vas3k TaxHacker actions.ts testLLMProviderAction server-side request forgery

A flaw has been found in vas3k TaxHacker up to 0.8.5. Affected by this vulnerability is the function testLLMProviderAction of the file app/app/apps/settings/actions.ts. Executing a manipulation of the argument provider/apiKey/model/baseUrl can lead to server-side request forgery. The attack may b...

CVE-2026-94038 NonceGeek dim-sum-app Deno Backend main.tsx textSearchV2Handler server-side request forgery

A security vulnerability has been detected in NonceGeek dim-sum-app. This impacts the function textSearchV2Handler of the file deno/main.tsx of the component Deno Backend. Such manipulation of the argument supabaseurl leads to server-side request forgery. The attack can be executed remotely. The...

CVE-2026-94105

NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to...

CVE-2026-94108

getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, o...

CVE-2026-92410

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability...

devarea

DevArea — HackTheBox プラットフォーム: HackTheBox OS: Linux ステータス: リタイア済み — 完全なウォークスルー公開中。 完全なウォークスルー: l3dsec.com/walkthroughs/devarea-htb 攻撃チェーン root@kitploit: nmap → 21 FTP anon + 80 + 8080 Jetty + 8888 Hoverfly → FTP anon → employee-service.jar Apache CXF, pre-3.5.5 → CVE-2022-46364 SSRF →...