CVE-2026-55584

CVE-2026-55584 - phpSysInfo IP Allowlist Bypass CWE-290, CVSS 7.5 High, phpSysInfo = 3.4.5 Refs: GHSA-786w-p5pm-cvgh, CVE.org PSIALLOWED resolves the client IP from the attacker-controlled X-Forwarded-For then Client-IP headers before falling back to REMOTEADDR. There is no trusted-proxy concept,...

NocoBase - VM Sandbox Escape to Remote Code Execution

NocoBase Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist controlled by WORKFLOWSCRIPTMODULES env var. The console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console.stdout and...

CVE-2026-125109

Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Requesthostwithport, baseurl, and url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host allowlist that use thes...

Linux Distros Unpatched Vulnerability : CVE-2026-125109

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Requesthostwithport, baseurl, and url can return an attacker-controlled...

DEBIAN-CVE-2026-125109

Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Requesthostwithport, baseurl, and url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host allowlist that use thes...

CVE-2026-125109 Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header — incomplete fix of CVE-2026-34835

Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Requesthostwithport, baseurl, and url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host allowlist that use thes...

CVE-2026-125109 Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header — incomplete fix of CVE-2026-34835

Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Requesthostwithport, baseurl, and url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host allowlist that use thes...

CVE-2026-125109 Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header — incomplete fix of CVE-2026-34835

Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Requesthostwithport, baseurl, and url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host allowlist that use thes...

CVE-2026-125109

The Rack modular Ruby web server interface is vulnerable in versions 3.0 through 3.1.23 and 3.2.8 . The Rack::Request#host_with_port, #base_url, and #url methods can return an attacker-controlled invalid authority derived verbatim from the Host, X-Forwarded-Host, or Forwarded: host= headers. If a...

GHSA-WCHH-MRV2-5H4Q ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header

Summary A remote attacker from any IP address defeats the operator-configured source-IP allowlist mcpallowedremoteips / apitokenallowedremoteips by sending a single X-Forwarded-For: header. The router is created with gin.New and never calls SetTrustedProxies, so gin trusts every proxy by default...

ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header

Summary A remote attacker from any IP address defeats the operator-configured source-IP allowlist mcpallowedremoteips / apitokenallowedremoteips by sending a single X-Forwarded-For: header. The router is created with gin.New and never calls SetTrustedProxies, so gin trusts every proxy by default...

CVE-2026-125109: rack: Rack is a modular Ruby web server interface

Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Requesthostwithport, baseurl, and url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host allowlist that use thes...

PT-2026-141151

Name of the Vulnerable Software and Affected Versions Rack versions 3.0 through 3.1.22 Rack versions 3.2.0 through 3.2.7 Description Rack is a modular Ruby web server interface. The host with port, base url, and url functions in Rack::Request can return an invalid authority controlled by an...

CVE-2026-27876

CVE-2026-27876: Grafana SQL Expressions Arbitrary File Write to RCE CVSS 9.1 Critical | Arbitrary File Write | Remote Code Execution Demo https://github.com/user-attachments/assets/c84a4b63-7928-4dba-a069-3bafa036ce56 Summary Grafana's SQL Expressions feature sqlExpressions toggle uses an...

log4j-4255

log4j2 4255 — FilteredObjectInputStream allowlist bypass via java.rmi.MarshalledObject A self-contained, containerised lab that reproduces Apache log4j2 issue4255 end-to-end against the official Log4j 2.26.1 artifacts on JDK 17 , with positive controls, a hardened oracle, and a validated...

CVE-2026-86041

ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New without configuring SetTrustedProxies, causing c.ClientIP to trust a spoofed X-Forwarded-For value. An unauthenticated remote attacker can suppl...

CVE-2026-86041 ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header

ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New without configuring SetTrustedProxies, causing c.ClientIP to trust a spoofed X-Forwarded-For value. An unauthenticated remote attacker can suppl...

CVE-2026-86041

The open source personal finance application ezBookkeeping is vulnerable to an IP allowlist bypass in versions 0.10.0 through 1.6.0 . The root cause is that the Gin router is initialized without SetTrustedProxies, allowing c.ClientIP() to trust spoofed X-Forwarded-For headers. An unauthenticated ...

CVE-2026-121425

A flaw was found in Nodemailer. This vulnerability allows a remote attacker to cause information disclosure by redirecting outgoing messages to attacker-chosen recipients and bypassing recipient allowlists. The issue occurs because the address parser prematurely terminates email address groups wh...

CVE-2026-88809

A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint /meta/proxy. This endpoint is intended to forward requests only to destinations that appear on a configured allowlist. The allowlist decision was evaluated in a place where it could not stop a request from being...