#cwe-348

共收录 70 条相关情报。

漏洞预警2026-09-29 发布INFO

A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the function dkim_process_set of the file dkim.c of the component Ta...

CVE-2026-101277

A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the functio

历史摘要 · 未重新核验 · NVD

#cve #cwe-348

漏洞预警2026-09-28 发布INFO

PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import p...

CVE-2026-102275

PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in j

历史摘要 · 未重新核验 · NVD

#cve #cwe-345 #cwe-348

漏洞预警2026-09-26 发布INFO

vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision / --code-revision...

CVE-2026-100653

vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-

历史摘要 · 未重新核验 · NVD

#cve #cwe-348

安全公告2026-09-26 发布INFO

vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation

CVE-2026-100653

vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-348

安全公告2026-09-24 发布INFO

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19...

CVE-2026-92530

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 1

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-348 #severity:medium

漏洞预警2026-09-24 发布INFO

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could hav...

CVE-2026-92530

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 1

历史摘要 · 未重新核验 · NVD

#cve #cwe-348

安全公告2026-09-23 发布INFO

A flaw was found in the Ansible Automation Platform automation-controller. In the shipped...

CVE-2026-84718

A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-348 #severity:medium

漏洞预警2026-09-23 发布INFO

A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For hea...

CVE-2026-84718

A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the

历史摘要 · 未重新核验 · NVD

#cve #cwe-348

漏洞预警2026-09-23 发布INFO

The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the conn...

CVE-2026-87070

The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before pr

历史摘要 · 未重新核验 · NVD

#cve #cwe-348

安全公告2026-09-18 发布INFO

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

CVE-2026-61682

# Summary The kcp front-proxy fails to strip client-supplied identity headers before forwarding requests to shards. Any

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-290 #cwe-302 #cwe-348 #severity:critical

漏洞预警2026-09-18 发布INFO

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove ...

CVE-2026-61682

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior t

历史摘要 · 未重新核验 · NVD

#cve #cwe-290 #cwe-302 #cwe-348

安全公告2026-09-18 发布INFO

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

CVE-2026-61682

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior t

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-290 #cwe-302 #cwe-348

漏洞预警2026-09-16 发布INFO

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the WebSocket `handle_mount` and `ViewRunt...

CVE-2026-61589

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to

历史摘要 · 未重新核验 · NVD

#cve #cwe-348 #cwe-639

安全公告2026-09-16 发布INFO

djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path

CVE-2026-61589

### Impact The WebSocket `handle_mount` and `ViewRuntime._build_request` rebuild an `HttpRequest` via `RequestFactory().

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-348 #cwe-639 #severity:medium

漏洞预警2026-09-15 发布INFO

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0....

CVE-2026-90711

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs E

历史摘要 · 未重新核验 · NVD

#cve #cwe-290 #cwe-348 #cwe-697

安全公告2026-09-02 发布INFO

fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

CVE-2026-16732

## Impact The fix for [CVE-2026-3635](https://www.cve.org/CVERecord?id=CVE-2026-3635) ([GHSA-444r-cwp2-x5xf](https://gi

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-348 #severity:medium

漏洞预警2026-08-18 发布INFO

fastify is a fast and low overhead web framework for Node.js. Impact: the fix for CVE-2026-3635 added a guard on the forwarded-header reads used to derive the request host, prot...

CVE-2026-16732

fastify is a fast and low overhead web framework for Node.js. Impact: the fix for CVE-2026-3635 added a guard on the for

历史摘要 · 未重新核验 · NVD

#cve #cwe-348

安全公告2026-08-07 发布INFO

CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()

CVE-2026-63220

### Impact `IncomingRequest::isSecure()` trusted the `X-Forwarded-Proto` and `Front-End-Https` headers from any incoming

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-348 #severity:medium

漏洞预警2026-07-31 发布INFO

Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the X-Forwarded-For h...

CVE-2026-25552

Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rat

历史摘要 · 未重新核验 · NVD

#cve #cwe-348

安全公告2026-07-31 发布INFO

Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header

CVE-2026-25552

Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rat

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-348