GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward

Summary The BalancerForward proxy helper in GoFiber uses Header.Add instead of Header.Set when injecting the X-Real-IP header. This appends the real client IP as a second header value rather than replacing any attacker-supplied value. Upstream servers that read the first X-Real-IP header nginx,...

CVE-2026-4767

Technical details (affected product/version, root cause, impact, or remediation) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2026-57760

Missing Authorization vulnerability in Sendcloud Sendcloud Shipping allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sendcloud Shipping: from n/a through 1.0.29...

CVE-2026-57750

Unauthenticated Broken Access Control in ez Form Calculator Premium = 2.14.1.2 versions...

CVE-2026-57746

Subscriber Broken Access Control in Booked = 3.0.0 versions...

CVE-2026-57731

Contributor Broken Access Control in Flatsome = 3.20.5 versions...

CVE-2026-57685

Subscriber Broken Access Control in Martfury - WooCommerce Marketplace WordPress Theme = 3.2.8 versions...

CVE-2026-57688

Unauthenticated Broken Access Control in POS Entegratör = 3.7.103 versions...

CVE-2026-57670

Unauthenticated Cross Site Scripting XSS in Google Maps CP = 1.2.5 versions...

CVE-2026-57669

Subscriber Broken Access Control in Advanced Contact form 7 DB = 2.0.9 versions...

CVE-2026-57355

Subscriber Broken Access Control in Classified Listing = 5.4.2 versions...

CVE-2026-57353

Subscriber Broken Access Control in Link Whisper Premium = 2.9.0 versions...

CVE-2026-39448

Unauthenticated Broken Access Control in NOWPayments for WooCommerce = 1.4.0 versions...

CVE-2026-27433

Unauthenticated Broken Access Control in Motors = 5.6.80 versions...

CVE-2025-66076

Unauthenticated Broken Access Control in Woostify Sites Library = 1.6.2 versions...

WordPress Universal Clocks plugin <= 1.2.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Universal Clocks versions = 1.2.0...

WordPress MeetingHub plugin <= 1.26.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin MeetingHub versions = 1.26.1...

WordPress VW Wedding theme <= 1.3.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Theme VW Wedding versions = 1.3.7...

WordPress Fascinate theme <= 1.1.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Theme Fascinate versions = 1.1.6...

WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Booking calendar, Appointment Booking System versions = 3.2.36...