CVE-2026-75601 Static Web Server: Authentication bypass on /metrics endpoint when --basic-auth is enabled

Static Web Server SWS is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to...

CVE-2026-75601 Static Web Server: Authentication bypass on /metrics endpoint when --basic-auth is enabled

Static Web Server SWS is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to...

stunner

STUNNER Stunner é uma ferramenta para testar e explorar servidores STUN, TURN e TURN sobre TCP. TURN é um protocolo usado principalmente em videoconferências e chats de áudio WebRTC. Se você encontrar um servidor mal configurado, pode usar esta ferramenta para abrir um proxy socks local que...

CVE-2026-48908

🚨 CVE-2026-48908 — Compromission totale du serveur via téléchargement arbitraire de fichiers Téléchargement critique de fichier non authentifié → Exécution de code à distance RCE Une vulnérabilité critique dans SP Page Builder permet à des attaquants non authentifiés de télécharger des fichiers...

goshs

Vous êtes en pleine mission. Vous devez transférer un fichier, capturer un hash SMB ou monter rapidement un serveur HTTPS — et python3 -m http.server ne suffira pas. goshs est un serveur de fichiers à binaire unique, conçu pour les moments où vous avez besoin de plus que le SimpleHTTPServer de...

CVE-2025-55182

CVE-2025-55182 Preuve de concept pour CVE-2025-55182, une RCE critique non authentifiée dans les composants serveur React. ⚠️ Avertissement Ce document est fourni strictement à des fins éducatives, défensives et de recherche en sécurité autorisée. Ne PAS tenter d'exploiter des systèmes ou...

miasma

🌀 Miasma Le aziende di intelligenza artificiale continuano a fare scraping di internet su scala enorme, inghiottendo tutti i suoi contenuti per usarli come dati di addestramento per i loro prossimi modelli. Se hai un sito web pubblico, stanno già rubando il tuo lavoro. Miasma è qui per aiutarti a...

CVE-2025-55182

CVE-2025-55182 Оригинальный автор:https://github.com/msanft/CVE-2025-55182 Эта уязвимость позволяет выполнить удалённый код RCE в серверных функциях React, например предоставляемых Next.js, через небезопасные ссылки на прототипы. Я не эксперт в React или Next.js, поэтому относитесь ко всей...

CVE-2025-14847-MongoBleed

CVE-2025-14847 MongoBleed Divulgazione di memoria tramite compressione zlib di MongoDB — Analisi, Rilevamento e Mitigazione Panoramica CVE-2025-14847, comunemente conosciuta come MongoBleed , è una vulnerabilità di divulgazione di informazioni ad alta gravità che colpisce...

CVE-2025-66478

1 root@kitploit: POST / HTTP/1.1 Host: localhost:3000 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0 Next-Action: x X-Nextjs-Request-Id: b5dce965 Content-Type: multipart/form-data;...

autovpn

!CAUTION This repository is no longer being maintained. No further updates, bug fixes, or support will be provided. Please use the new version https://github.com/ttlequals0/autowire Overview Script that allows the easy creation of OpenVPN endpoints in any AWS region. To create a VPN endpoint is...

PoC-CVE-2026-23744

PoC-CVE-2026-23744 Esecuzione di codice remoto su MCPJam Inspector Riferimento https://github.com/MCPJam/inspector/security/advisories/GHSA-232v-j27c-5pp6...

CVE-2021-41773

CVE-2021-41773 Docker root@kitploit: $ sudo docker build -t . $ sudo docker run -d -t -p 80:80 --name /bin/bash $ sudo docker exec -it ./bin/apachectl -k restart Per accedere al container docker per il file di configurazione personalizzato root@kitploit: $ docker exec -it /bin/bash file di...

EUVD-2026-66679

In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the server must be configured with Brave Tracing. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier...

CVE-2026-47844 Reactor Netty HTTP Server Leaks Exception Details

In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the server must be configured with Brave Tracing. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier...

CVE-2026-47844

Reactor Netty HTTP Server may leak exception details across unrelated requests when the server is configured with Brave Tracing . Affected versions are 1.3.0–1.3.6 , 1.1.0–1.2.18 , and 1.0.52 and earlier . The CVSS 3.1 score is 5.3 (Medium) , with low integrity impact and no confidentiality or av...

snallygaster

snallygaster Encontra vazamentos de arquivos e outros problemas de segurança em servidores HTTP. o quê? snallygaster é uma ferramenta que procura por arquivos acessíveis em servidores web que não deveriam ser públicos e podem representar um risco de segurança. Exemplos típicos incluem repositório...

CVE-2025-55182

Ferramenta de Detecção em Lote CVE-2025-55182 Ferramenta eficiente de detecção em lote para a vulnerabilidade de poluição de protótipo do Next.js CVE-2025-55182. Descrição da Vulnerabilidade CVE-2025-55182 é uma vulnerabilidade de poluição de protótipo no framework Next.js, que permite a um...

coderunner

CodeRunner: आपके AI एजेंटों के लिए एक लोकल सैंडबॉक्स CodeRunner आपके AI एजेंटों और उनकी गतिविधियों को सैंडबॉक्स के भीतर सुरक्षित रूप से चलाने में मदद करता है। मुख्य उपयोग: आप हमारे सैंडबॉक्स में कई Claude Code या AI एजेंटों को डेटा हानि और डेटा बहिर्गमन exfiltration के किसी भी भय के बिना चला सकते...

sandbox-agent

Coding-Agenten in Sandboxen ausführen. Per HTTP steuern. Ein Server, der in Ihrer Sandbox läuft. Ihre App verbindet sich remote, um Claude Code, Codex, OpenCode, Cursor, Amp oder Pi zu steuern – mit Streaming von Ereignissen, Verwaltung von Berechtigungen und Sitzungen. Dokumentation — API-Refere...