RHEL 7 / 8 : Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP3 (RHSA-2026:2994)

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:2994 advisory. Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP...

Apache Airflow 安全漏洞

Apache Airflow is an open-source platform developed by the Apache Foundation in the United States. It allows for the creation, management, and monitoring of workflows. Versions of Apache Airflow prior to 2.11.1 contained security vulnerabilities. These vulnerabilities stemmed from the ability of...

📄 Tattile Cameras 1.181.5 Default Credentials

Tattile Cameras version 1.181.5 ship with default credentials that remain active after installation and commissioning without enforcing a mandatory password change. Tattile Cameras 1.181.5 Use of Default Credentials Vendor: Tattile s.r.l. Product web page: https://www.tattile.com Affected version...

httpd: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo

A permissions bypass flaw has been discovered in the apache HTTP server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid...

mod_md: Apache HTTP Server: mod_md (ACME), unintended retry intervals

An integer overflow flaw has been discovered in the Apache HTTP server. The integer overflow in the case of failed ACME certificate renewal leads, after a number of failures 30 days in default configurations, to the backoff timer becoming 0. Attempts to renew the certificate then are repeated...

CVE-2026-2940

A vulnerability was determined in Zaher1307 tinywebserver up to 8d77b1044a0ca3a5297d8726ac8aa2cf944d481b. This affects the function tinywebserver/tiny.c of the file tinywebserver/tiny.c of the component URL Handler. This manipulation causes out-of-bounds write. The attack can be initiated remotel...

CVE-2026-27480

Static Web Server SWS is a production-ready web server suitable for static web files or assets. In versions 2.1.0 through 2.40.1, a timing-based username enumeration vulnerability in Basic Authentication allows attackers to identify valid users by exploiting early responses for invalid usernames,...

Path-Traversal-Lab

OS Path Traversal & System File Exfiltration 🎯 Executive S...

PT-2026-21909

Name of the Vulnerable Software and Affected Versions Apache HTTP Server affected versions not specified Description An integer overflow in the PSB PSD v2 RLE decoding path can cause a heap out-of-bounds read on 32-bit builds. This can lead to information disclosure or a crash when processing...

CVE-2026-2940 Zaher1307 tiny_web_server URL tiny.c out-of-bounds write

A vulnerability was determined in Zaher1307 tinywebserver up to 8d77b1044a0ca3a5297d8726ac8aa2cf944d481b. This affects the function tinywebserver/tiny.c of the file tinywebserver/tiny.c of the component URL Handler. This manipulation causes out-of-bounds write. The attack can be initiated remotel...

CVE-2026-2940

A vulnerability was determined in Zaher1307 tinywebserver up to 8d77b1044a0ca3a5297d8726ac8aa2cf944d481b. This affects the function tinywebserver/tiny.c of the file tinywebserver/tiny.c of the component URL Handler. This manipulation causes out-of-bounds write. The attack can be initiated remotel...

CVE-2026-2940

The CVE-2026-2940 entry concerns Zaher1307’s tiny_web_server, specifically the URL Handler implemented in tiny_web_server/tiny.c. The vulnerability is an out-of-bounds write in a function within tiny.c that is reachable via a remote attack. Public exploit details are noted, and the product uses o...

CVE-2026-2930

CVE-2026-2930 affects Tenda A18 firmware 15.13.07.13. The vulnerability is in the Httpd Service, specifically the function webCgiGetUploadFile in /cgi-bin/UploadCfg, where improper argument boundary handling causes a stack-based buffer overflow. Exploitation can be performed remotely, and public ...

Tiny Web Server 缓冲区错误漏洞

Tiny Web Server is a web server developed by Ahmed Zaher as an individual project. Tiny Web Server has a buffer overflow vulnerability, which stems from out-of-bounds writes in the URL processor...

PT-2026-21427

Name of the Vulnerable Software and Affected Versions Zaher1307 tiny web server versions prior to 8d77b1044a0ca3a5297d8726ac8aa2cf944d481b Description A flaw exists in the URL Handler component of Zaher1307 tiny web server. This issue allows for an out-of-bounds write, potentially enabling remote...

CVE-2026-27480

Static Web Server SWS is a production-ready web server suitable for static web files or assets. In versions 2.1.0 through 2.40.1, a timing-based username enumeration vulnerability in Basic Authentication allows attackers to identify valid users by exploiting early responses for invalid usernames,...

CVE-2026-27480

Static Web Server SWS is a production-ready web server suitable for static web files or assets. In versions 2.1.0 through 2.40.1, a timing-based username enumeration vulnerability in Basic Authentication allows attackers to identify valid users by exploiting early responses for invalid usernames,...

CVE-2026-27480 Static Web Server: Timing-Based Username Enumeration in Basic Authentication

Static Web Server SWS is a production-ready web server suitable for static web files or assets. In versions 2.1.0 through 2.40.1, a timing-based username enumeration vulnerability in Basic Authentication allows attackers to identify valid users by exploiting early responses for invalid usernames,...

CVE-2026-27480

CVE-2026-27480 affects Static Web Server (SWS) versions 2.1.0 through 2.40.1. The vulnerability is a timing-based username enumeration in Basic Authentication: the server checks whether a username exists before validating the password, causing valid usernames to take a slower path (e.g., bcrypt h...

CVE-2026-27480 Static Web Server: Timing-Based Username Enumeration in Basic Authentication

Static Web Server SWS is a production-ready web server suitable for static web files or assets. In versions 2.1.0 through 2.40.1, a timing-based username enumeration vulnerability in Basic Authentication allows attackers to identify valid users by exploiting early responses for invalid usernames,...