CVE-2026-21962-Oracle-HTTP-Server-WebLogic-Proxy-Plug-in-Critical-

CVE-2026-21962-Oracle-HTTP-Server-WebLogic-Proxy-Plug-in-Critical- Oracle Fusion Middleware Oracle HTTP Server / WebLogic Server Proxy Plug-in 存在一个易于利用、无需身份验证、可通过网络访问的漏洞，允许通过 HTTP 进行入侵。受影响的支持版本包括 12.2.1.4.0、14.1.1.0.0、14.1.2.0.0。 CVSS 10.0（根据 Oracle / NVD 文本）且可通过 HTTP 远程访问。 check.py...

CVE-2023-4281

CVE编号: CVE-2023-4281 漏洞类型: IP地址欺骗 描述: Activity Log 插件从潜在不可信的头部中获取客户端 IP 地址，攻击者可操纵其值。这可能被用于隐藏恶意流量的来源。 复现步骤: Run the following code in the web browser and note on the backend that the IP address has been faked. await fetch"/wp-login.php", "headers": "content-type":...

CVE-2023-4279

CVE ID : CVE-2023-4279 漏洞类型 : IP 地址欺骗 描述 : 该插件从可能不可信的请求头中获取客户端 IP 地址，攻击者可以操纵该值，从而隐藏恶意流量的来源。 复现步骤 : 1. 在用户活动日志 设置中，启用“记录用户的 IP 地址”选项并保存设置。 2. 在浏览器中运行以下代码，并注意后端显示的 IP 地址已被伪造。 await fetch"/wp-login.php", "headers": "content-type": "application/x-www-form-urlencoded", "Client-Ip": "8.8.8.8", , "body"...

CVE-2026-103512

Perforce P4 Search versions prior to 2026.4.2 are vulnerable to an authentication bypass because the system trusts a client-supplied address during the validation of specific authentication requests. An attacker possessing a stolen P4 Server ticket can exploit this flaw to bypass host-based ticke...

CVE-2026-103512 Ticket host-binding bypass via spoofed client IP in P4Search

Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen P4 Server ticket can bypass host-based ticket restrictions and trusted-address controls, gaining access to P4 Search as the ticket's owner...

CVE-2026-103512 Ticket host-binding bypass via spoofed client IP in P4Search

Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen P4 Server ticket can bypass host-based ticket restrictions and trusted-address controls, gaining access to P4 Search as the ticket's owner...

Security Bulletin: IBM DataPower Gateway affected by HTTP request header leakage in XML-Firewall (CVE-2026-7366)

Summary IBM DataPower Gateway affected by HTTP request header leakage in XML-Firewall CVE-2026-7366 Vulnerability Details CVEID:CVE-2026-7366 DESCRIPTION: IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 throug...

CVE-2026-103592 simple-php-router through 5.4.1.7 IP restriction bypass via forwarding headers

simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. Attackers can spoof X-Forwarded-For, CF-Connecting-IP, or Client-IP headers to...

CVE-2026-103592

The simple-php-router library, specifically versions through 5.4.1.7 , contains an IP restriction bypass vulnerability within the IpRestrictAccess middleware. The root cause allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections by spoofing HTTP headers such as X...

CVE-2026-103592 simple-php-router through 5.4.1.7 IP restriction bypass via forwarding headers

simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. Attackers can spoof X-Forwarded-For, CF-Connecting-IP, or Client-IP headers to...

CVE-2026-103592: Use of Less Trusted Source

simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. Attackers can spoof X-Forwarded-For, CF-Connecting-IP, or Client-IP headers to...

PT-2026-103631

Name of the Vulnerable Software and Affected Versions simple-php-router versions prior to 5.4.1.8 Description The IpRestrictAccess middleware contains a flaw that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. By spoofing the X-Forwarded-For,...

CVE-2026-100390 Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6

Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access...

CVE-2026-100390 Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6

Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access...

CVE-2026-84718 Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust

A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost...

CVE-2026-88798

The Really Simple Security WordPress plugin (versions before 9.8.3 ) is vulnerable to an unbounded option growth flaw. The root cause is a failure to validate a client-supplied address value before using it as a storage key for one of the plugin's options. This allows unauthenticated attackers to...

CVE-2026-88798 Really Simple Security (Free) < 9.8.3 - Unauthenticated Unbounded Option Growth via Spoofed Client IP Header

The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages...

CVE-2026-88798 Really Simple Security (Free) < 9.8.3 - Unauthenticated Unbounded Option Growth via Spoofed Client IP Header

The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages...

PT-2026-95596

Name of the Vulnerable Software and Affected Versions Saleor versions prior to 3.20.119 Saleor versions prior to 3.21.55 Saleor versions prior to 3.22.48 Saleor versions prior to 3.23.15 Description An issue exists in the get client ip function within the saleor/account/throttling.py file. A remo...

PT-2026-94296

Name of the Vulnerable Software and Affected Versions ash authentication versions 4.12.0 through 4.14.x ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.13 Description AshAuthentication contains an issue where readers of the audit store can recover client IP addresses that the audit log...