145346 matches found
CVE-2024-40725
Outil de détection de contrebande de requêtes HTTP Ce dépôt contient un outil basé sur Python pour détecter les vulnérabilités de contrebande de requêtes HTTP, ciblant spécifiquement CVE-2024-40725. L'outil tente d'exploiter cette vulnérabilité dans le serveur HTTP Apache en envoyant des requêtes...
CVE-2017-14980.RCE
CVE-2017-14980 Эксплойт нацелен на Sync Breeze Enterprise , работающий на Windows 10 x86, build: 16299 , версии 10.0.28 , где неаутентифицированный злоумышленник может выполнить переполнение буфера через тело HTTP-запроса , что приводит к выполнению произвольного кода. Данный эксплойт предполагае...
DEBIAN-CVE-2026-107282
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original...
CVE-2026-107282
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original...
Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway
Summary Security Vulnerabilities affect IBM Voice Gateway. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-66142 DESCRIPTION: Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may...
CVE-2026-107285
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, a proxied ws request is carried through CONNECT, but NettyRequestFactory.newNettyRequest and requestUri decide whether to attach proxy...
CVE-2026-107282 AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original...
CVE-2026-107282
Removed by vendor...
CVE-2026-107282
The AsyncHttpClient (AHC) library, used in Java applications, contains a cross-host request replay vulnerability in versions prior to 3.0.13 and 2.16.1 . The root cause is that request replays update the current request but retain the target request and proxy context of the original origin. This ...
CVE-2026-107282 AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original...
NPM: Ghost: Server-Side Request Forgery in Bookmark Fetching
NPM: Ghost: Server-Side Request Forgery in Bookmark Fetching vulnerability discovered by ? in WordPress Npm ghost versions = 6.54.1, 6.65.0...
Next.js has Server-Side Request Forgery in Image Optimization
Impact An attacker-controlled, allow-listed remote URL can lead to server-side request forgery e.g. to private IPs during Image Optimization. Workaround Audit allow-listed remote URLs in images.remotePatterns see https://nextjs.org/docs/app/getting-started/imagesremote-images for hosts that may n...
GHSA-CJQ9-62Q9-8JV4 Next.js has Server-Side Request Forgery in Image Optimization
Impact An attacker-controlled, allow-listed remote URL can lead to server-side request forgery e.g. to private IPs during Image Optimization. Workaround Audit allow-listed remote URLs in images.remotePatterns see https://nextjs.org/docs/app/getting-started/imagesremote-images for hosts that may n...
NPM: Next.js has Server-Side Request Forgery in Image Optimization
NPM: Next.js has Server-Side Request Forgery in Image Optimization vulnerability discovered by ? in WordPress Npm next versions = 16.0.0, 16.3.8...
CVE-2026-107221
creationtimestamp| type| source ---|---|--- 2026-10-07 19:53:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/i5smj5dsbzi2n 2026-10-07 20:23:08+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-8mcq-6wmr-jrjv...
Security Bulletin:React Router SSR Error Handling Vulnerability in Versions 6.4.0 to 7.17.0
Summary React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor...
Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions
Impact An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect filesystem paths outside the expected working area. Depending on the backend deployment, this could compromise backend confidentiality, integrity, or availability. Patches ...
GHSA-G8RX-F7M5-7794 Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions
Impact An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect filesystem paths outside the expected working area. Depending on the backend deployment, this could compromise backend confidentiality, integrity, or availability. Patches ...
CVE-2026-76471
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient input validation of data that is...
cve-2026-34473-unauthenticated-dos-zte-routers
CVE-2026-34473 : Déni de service non authentifié dans les routeurs ZTE affectant plus de 140 000 appareils dans le monde 17+ modèles Analyse technique de CVE-2026-34473, publiée à partir de l'ensemble de divulgation original et des artefacts d'analyse du firmware. Site en direct :...