30655 matches found
CVE-2026-42008
CVE-2026-42008 is an authentication bypass in Dovecot (Open-Xchange fork) where forwarding information from a trusted proxy host is not kept separate from Dovecot's own authentication fields. A malicious or compromised trusted proxy host can inject an internal authentication field, allowing it to...
CVE-2026-42008
Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...
CVE-2026-42008
Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...
CVE-2026-42008
Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...
CVE-2026-42008
Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...
PT-2026-83226
Name of the Vulnerable Software and Affected Versions Kubeflow Pipelines versions prior to 2.17.0 Description The frontend exposes an unauthenticated server-side request forgery SSRF issue. The routePathWithReferer function accepts an arbitrary HTTP or HTTPS target and passes its origin to...
CVE-2026-42008
Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...
CVE-2026-42395: Uncontrolled Resource Consumption
A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies a...
When Verified Source Becomes Attack Input: Defending Smart Contracts against LLM-Based Vulnerability Scanning
Smart contracts are financial programs deployed on blockchains to manage digital assets. To build trust with users and investors, smart contract projects typically publish their source code on blockchain explorers and verify it against the deployed bytecode, making the on-chain program accessible...
CVE-2026-82270: Server-Side Request Forgery (SSRF)
Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/ route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authorization headers to reach internal service...
UBUNTU-CVE-2026-42395
A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies a...
PT-2026-83070
Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description A host configured as a trusted proxy can send forwarding information containing a NUL byte. This causes the login process to crash during the subsequent login attempt, leading to process...
PT-2026-83066
Name of the Vulnerable Software and Affected Versions Dovecot affected versions not specified Description Information forwarded from a host configured as a trusted proxy is not properly isolated from internal authentication fields. This allows a trusted proxy to inject values into internal...
9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass
9router exposes an OpenAI/Anthropic-compatible LLM proxy. Remote access to this proxy is intended to be protected by an API-key check in the Next.js middleware. However, 9router also defines a rewrite that maps /codex/ to the backend LLM endpoint /api/v1/responses. The middleware authorization...
CVE-2026-54745: Improper Access Control
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an unauthenticated server-side request forgery vulnerability through the /proxy/ route in frontend/server/proxy-middleware.ts. The...
CVE-2026-42008: Improper Authentication
Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...
CVE-2026-42395
A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies a...
Linux Distros Unpatched Vulnerability : CVE-2026-19538
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TL...
CVE-2026-42008: Improper Authentication
Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...
UBUNTU-CVE-2026-42008
Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...