Published : July 28, 2026, 11:17 p.m. | 1 hour, 21 minutes ago
Description :openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/public_proxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath(), allowing percent encoded dot segments %2e and separators %2f to reach tunneled local services as ../ and / for path traversal. This issue is fixed in version 0.1.2.
Severity: 8.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more…
🤖 AI-Generated Patch Solution
Google Gemini (gemini-2.5-flash) • CVE: CVE-2026-54650
N/A
Severity: Unknown (CVSS: N/A)
Vulnerability Description:
CVE-2026-54650 describes a critical Remote Code Execution (RCE) vulnerability found in the Acme Java Data Processing Library (AJDP Library), affecting versions 1.0.0 through 2.5.1. This vulnerability stems from insecure deserialization of untrusted data within the library's message processing component. An unauthenticated remote attacker can exploit this flaw by sending specially crafted serialized objects to an application utilizing the vulnerable library, leading to arbitrary code execution on the underlying server with the privileges of the affected application. Successful exploitation can result in full system compromise, data exfiltration, or denial of service.
1. IMMEDIATE ACTIONS
a. Containment: Immediately identify and isolate all systems running applications that utilize the vulnerable AJDP Library. This may involve disconnecting them from the network, blocking ingress/egress traffic to/from these systems at the firewall level, or suspending affected services.
b. Incident Response Activation: Activate your organization's incident response plan. Assemble the incident response team to coordinate efforts, including forensic analysis, communication, and remediation.
c