PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp() that allows unauthenticated attackers to evade per-IP throttling by spoofing X-Forwarded-For o...

CVE-2026-119711

PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp() that allows unauthenticated attackers

来源摘录 · NVD

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead ...

CVE-2026-118265

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-sup

来源摘录 · NVD

Echo: X-Real-IP extractor trusts the header value instead of the sending peer

## Impact In Echo v5, `ExtractIPFromRealIPHeader` checked whether the address supplied in `X-Real-IP` belonged to a tru

历史摘要 · 未重新核验 · GitHub Advisory

GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have a...

CVE-2026-112378

GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5

来源摘录 · NVD

Use of a less trusted source for the envelope sender in the external-account download of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attack...

CVE-2026-114474

Use of a less trusted source for the envelope sender in the external-account download of Progressive Robot hMailServer 6

来源摘录 · NVD

Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware...

CVE-2026-111934

Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmos

历史摘要 · 未重新核验 · GitHub Advisory

Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWED_IPS and Prometheus allowlists by spo...

CVE-2026-108736

Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attack

历史摘要 · 未重新核验 · NVD

Speedtest Tracker through 1.15.0 IP Allowlist Bypass via X-Forwarded-For Spoofing

CVE-2026-108736

Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attack

历史摘要 · 未重新核验 · OSV.dev

PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other networks' discovery rooms by supplying a forged cf-connec...

CVE-2026-108555

PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other

历史摘要 · 未重新核验 · NVD

PairDrop through 1.11.2 IP Spoofing via cf-connecting-ip Header

CVE-2026-108555

PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other

历史摘要 · 未重新核验 · OSV.dev

Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unco...

CVE-2026-108162

Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to

历史摘要 · 未重新核验 · NVD

Pingvin Share X before 1.22.0 Rate Limit Bypass via Spoofed X-Forwarded-For

CVE-2026-108163 · CVE-2026-108162

Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to

历史摘要 · 未重新核验 · OSV.dev

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Less Trusted Source vulnerability. An unauthenticated attacker with remote acc...

CVE-2026-78015

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Less Trusted Source v

历史摘要 · 未重新核验 · NVD

PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

CVE-2026-102275

### Summary PyJWT accepts internally inconsistent OKP private JWKs where the declared public key `x` does not correspon

历史摘要 · 未重新核验 · GitHub Advisory

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

CVE-2026-90711

### Impact `proxy-addr` determines which network hops are trusted proxies so that `X-Forwarded-For` can be believed. Wh

历史摘要 · 未重新核验 · GitHub Advisory

Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence check via CPUID...

CVE-2026-105051

Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence check via CPUID interception (SimpleSvm.sys

历史摘要 · 未重新核验 · GitHub Advisory

Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence check via CPUID interception (SimpleSvm.sys on AMD; hyperkd.sys and hyperhv.dll on Intel).

CVE-2026-105051

Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence check via CPUID interception (SimpleSvm.sys

历史摘要 · 未重新核验 · NVD

UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attackers to in...

CVE-2026-102630

UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header wit

历史摘要 · 未重新核验 · NVD

UnoPim 2.0.0 before 2.0.1 and 2.1.0 before 2.1.1 Cache Poisoning via X-Forwarded-Host

CVE-2026-102630

UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header wit

历史摘要 · 未重新核验 · OSV.dev

A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted...

CVE-2026-101277

A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the functio

历史摘要 · 未重新核验 · GitHub Advisory