CVE-2026-16732 | Medium | 6.1 | 2026-08-18 | fastify is a fast and low overhead web framework for Node.js. Impact: the fix for CVE-2026-3635 added a guard on the forwarded-header reads used to derive the… |
CVE-2026-25552 | Low | 3.7 | 2026-07-31 | Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the… |
CVE-2026-63220 | Medium | 4.8 | 2026-07-31 | CodeIgniter is a PHP full-stack web framework. In versions prior to 4.7.4, IncomingRequest::isSecure() trusted the X-Forwarded-Proto and Front-End-Https header… |
CVE-2026-50243 | Low | 3.7 | 2026-07-22 | In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' module in front of the validator together with a 'response… |
CVE-2026-64619 | High | 7.5 | 2026-07-20 | FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthenticated attackers to circumvent request throttli… |
CVE-2026-63770 | High | 7.5 | 2026-07-20 | Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication handler that allows unauthenticated attackers to bypass brute-force lo… |
CVE-2026-46415 | High | 8.2 | 2026-07-20 | The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the client's IP address. Prior to version 0.10.1… |
CVE-2026-9561 | High | 8.2 | 2026-07-14 | Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP address in audit log en… |
CVE-2026-55641 | High | 8.2 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router determines whether a /v1 LLM proxy request is local by reading the client-controlled Host header… |
CVE-2026-58122 | Critical | 9.1 | 2026-07-09 | Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to circumvent local-origin IP restric… |
CVE-2026-59897 | Medium | 4.8 | 2026-07-08 | Hono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a dist… |
CVE-2026-59999 | Medium | 5.9 | 2026-07-08 | In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not. |
CVE-2026-46466 | Low | 2.7 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-57942 | Medium | 5.3 | 2026-06-29 | LibreTranslate through 1.9.7, fixed in commit 397fd22, contains an IP spoofing vulnerability in the get_remote_address() function that allows unauthenticated a… |
CVE-2026-54289 | Medium | 4.8 | 2026-06-22 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request heade… |
CVE-2026-12249 | Critical | 9.0 | 2026-06-22 | An issue was discovered in Canonical ADSys upstream versions through v0.16.2. During Active Directory Certificate Services (AD CS) certificate auto-enrollment… |
CVE-2026-48772 | Critical | 10.0 | 2026-06-19 | ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 2.0.0 through 3.0.8, the ProxySQL MySQL frontend accepts the `PROXY UNKNOWN <ad… |
CVE-2026-44046 | Medium | 5.8 | 2026-06-19 | Use of Less Trusted Source vulnerability in Apache APISIX.
Attacker can take advantage of wolf-rbac plugin under default configuration to potentially pollute… |
CVE-2020-37248 | Medium | 6.5 | 2026-06-08 | OfflineIMAP before 8.0.3 trusts the server with their STARTTLS capability prior to authentication, which allows STRIPTLS/man-in-the-middle attacks, taking over… |
CVE-2026-43634 | High | 7.5 | 2026-05-19 | HestiaCP versions 1.2.0 through 1.9.4 contain an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass authentication security contr… |
CVE-2026-44183 | Critical | 9.8 | 2026-05-12 | Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. Prior to 2.9… |
CVE-2026-40226 | Medium | 6.4 | 2026-04-10 | In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file. |
CVE-2026-35391 | High | 7.5 | 2026-04-06 | Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, the getClientIP() function in lib/admin/session.ts trusted the first… |
CVE-2026-35507 | Medium | 6.4 | 2026-04-03 | Shynet before 0.14.0 allows Host header injection in the password reset flow. |
CVE-2026-26927 | | | 2026-04-02 | Szafir SDK Web is a browser plug-in that can run SzafirHost application which download the necessary files when launched.
In Szafir SDK Web it is possible to c… |
CVE-2026-33690 | Medium | 5.3 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `getRealIpAddr()` function in `objects/functions.php` trusts user-contr… |
CVE-2026-3635 | Medium | 6.1 | 2026-03-23 | Summary
When trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom fu… |
CVE-2025-69240 | High | 8.8 | 2026-03-16 | Raytha CMS allows an attacker to spoof `X-Forwarded-Host` or `Host` headers to attacker controlled domain. The attacker (who knows the victim's email address) … |
CVE-2026-22201 | Medium | 5.3 | 2026-03-13 | wpDiscuz before 7.6.47 contains an IP spoofing vulnerability in the getIP() function that allows attackers to bypass IP-based rate limiting and ban enforcement… |
CVE-2025-55292 | High | 8.2 | 2026-01-28 | Meshtastic is an open source mesh networking solution. In the current Meshtastic architecture, a Node is identified by their NodeID, generated from the MAC add… |
CVE-2026-24910 | Medium | 5.9 | 2026-01-27 | In Bun before 1.3.5, the default trusted dependencies list (aka trust allow list) can be spoofed by a non-npm package in the case of a matching name (for file… |
CVE-2025-13694 | Medium | 5.3 | 2026-01-07 | The AA Block Country plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.0.1. This is due to the plugin trusting user… |
CVE-2025-15154 | Medium | 5.3 | 2025-12-28 | A security vulnerability has been detected in PbootCMS up to 3.2.12. The affected element is the function get_user_ip of the file core/function/handle.php of t… |
CVE-2025-32900 | Medium | 4.3 | 2025-12-05 | In the KDE Connect information-exchange protocol before 2025-04-18, a packet can be crafted to temporarily change the displayed information about a device, bec… |
CVE-2025-59951 | Critical | 9.1 | 2025-10-01 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The official Docker image for Termix versions 1… |
CVE-2025-58422 | Low | 3.1 | 2025-09-08 | RICOH Streamline NX versions 3.5.1 to 24R3 are vulnerable to tampering with operation history. If an attacker can perform a man-in-the-middle attack, they may… |
CVE-2025-53522 | Medium | 5.3 | 2025-08-20 | Movable Type contains an issue with use of less trusted source. If exploited, tampered email to reset a password may be sent by a remote unauthenticated attack… |
CVE-2025-48825 | Low | 2.5 | 2025-06-13 | RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.7.0 contains an issue with use of less trusted source, which may allow an attacker who can conduct a man-i… |
CVE-2025-48865 | Critical | 9.1 | 2025-05-30 | Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. Prior to version 1.6.6, Fabio allows clients to remove X-Forwarded headers (ex… |
CVE-2025-47149 | Medium | 5.3 | 2025-05-23 | The optional feature 'Anti-Virus & Sandbox' of i-FILTER contains an issue with improper pattern file validation. If exploited, the product may treat an unautho… |
CVE-2025-1245 | Medium | 6.5 | 2025-05-16 | Bypass Connection Restriction vulnerability in Hitachi Infrastructure Analytics Advisor (Data Center Analytics component), Hitachi Ops Center Analyzer (Hitach… |
CVE-2025-47424 | High | 7.1 | 2025-05-09 | Retool (self-hosted) before 3.196.0 allows Host header injection. When the BASE_DOMAIN environment variable is not set, the HTTP host header can be manipulated. |
CVE-2025-43918 | Medium | 6.4 | 2025-04-19 | SSL.com before 2025-04-19, when domain validation method 3.2.2.4.14 is used, processes certificate requests such that a trusted TLS certificate may be issued f… |
CVE-2025-24856 | Medium | 4.2 | 2025-03-16 | An issue was discovered in the oidc (aka OpenID Connect Authentication) extension before 4.0.0 for TYPO3. The account linking logic allows a pre-hijacking atta… |
CVE-2025-27913 | High | 7.5 | 2025-03-10 | Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email message… |
CVE-2024-54840 | Medium | 4.2 | 2025-02-03 | PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 does not properly address environment issues that can contribute… |
CVE-2024-10977 | Low | 3.1 | 2024-11-14 | Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq… |
CVE-2024-47880 | High | 8.1 | 2024-10-24 | OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `export-rows` command can be used in such a way that it reflect… |
CVE-2022-4534 | Medium | 5.3 | 2024-10-08 | The Limit Login Attempts (Spam Protection) plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.3. This is due to insu… |
CVE-2024-45410 | Critical | 9.8 | 2024-09-19 | Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-… |
CVE-2022-4533 | Medium | 5.3 | 2024-09-19 | The Limit Login Attempts Plus plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.1.0. This is due to insufficient re… |
CVE-2022-4529 | Medium | 5.3 | 2024-09-05 | The Security, Antivirus, Firewall – S.A.F plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.3.5. This is due to ins… |
CVE-2022-4539 | Medium | 5.3 | 2024-08-31 | The Web Application Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1.2. This is due to insufficient res… |
CVE-2022-4536 | Medium | 5.3 | 2024-08-31 | The IP Vault – WP Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.1. This is due to insufficient restric… |
CVE-2022-4532 | Medium | 6.5 | 2024-08-17 | The LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1. This is due to insuf… |
CVE-2024-6171 | Medium | 5.3 | 2024-07-09 | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and inc… |
CVE-2022-44593 | Low | 3.7 | 2024-06-21 | Use of Less Trusted Source vulnerability in SolidWP Solid Security allows HTTP DoS.This issue affects Solid Security: from n/a through 9.3.1. |
CVE-2024-0789 | Medium | 5.3 | 2024-06-19 | The WP Maintenance plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 6.1.9.2 due to insufficient IP address valid… |
CVE-2024-23105 | High | 7.5 | 2024-05-14 | A Use Of Less Trusted Source [CWE-348] vulnerability in Fortinet FortiPortal version 7.0.0 through 7.0.6 and version 7.2.0 through 7.2.1 allows an unauthentica… |
CVE-2024-27773 | High | 8.8 | 2024-03-18 |
Unitronics Unistream Unilogic – Versions prior to 1.35.227 -
CWE-348: Use of Less Trusted Source may allow RCE
|
CVE-2023-2897 | Low | 3.7 | 2023-06-09 | The Brizy Page Builder plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.4.18. This is due to an implicit trust of… |
CVE-2022-4537 | Medium | 6.5 | 2023-05-09 | The Hide My WP Ghost – Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.0.18. This is due to insuf… |
CVE-2022-2255 | High | 7.5 | 2022-08-25 | A vulnerability was found in mod_wsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-… |
CVE-2022-31813 | Critical | 9.8 | 2022-06-09 | Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism… |
CVE-2021-21374 | High | 8.1 | 2021-03-26 | Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimb… |
CVE-2021-21373 | High | 7.5 | 2021-03-26 | Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimb… |