36359 matches found
CVE-2026-88831 Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...
CVE-2026-88831
The BusyBox httpd component is vulnerable to a security bypass where IP deny rules with invalid CIDR prefix lengths fail open. The system leaves a parsed IP with a zeroed mask, causing the rule to match no clients and allowing potentially unauthorized access. To mitigate this, users should audit ...
CVE-2026-88831
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...
CVE-2026-88831
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients. Mitigation Audit all BusyBox httpd configuration files for syntactically valid CIDR prefix lengths. Implement network-level access controls...
CVE-2026-94127
CVE-2026-94127 — Herramienta de detección de F5 BIG-IP APM Defensiva Autor: https://github.com/FurkanKAYAPINAR/ Un detector defensivo, no explotable para CVE-2026-94127 , un desbordamiento de búfer basado en heap CWE-122 en F5 BIG-IP APM que permite a un atacante remoto no autenticado lograr...
Vulnerability concealment in F5 Networks BIG-IP Access Policy Manager
F5 Networks has identified a vulnerability in BIG-IP Access Policy Manager APM. This vulnerability allows unauthorized malicious actors to execute malicious code. To do this, the malicious actor needs to send malicious network traffic to the vulnerable system. BIG-IP APM systems are only vulnerab...
CVE-2026-83602
A flaw was found in Netdata, an open-source observability tool. An unauthenticated remote attacker can bypass IP allowlist restrictions by sending PUT requests to the /api/v3/settings endpoint. This allows the attacker to write arbitrary data to a settings file, potentially leading to a Denial of...
CVE-2026-14321
The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored...
CVE-2026-14321 Divi Dash < 1.0.7 - Unauthenticated Denial of Service via IP Address Spoofing
The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored...
CVE-2026-14321
The divi-dash WordPress plugin, versions prior to 1.0.7 , is vulnerable to an unauthenticated Denial of Service due to insufficient validation of client IP addresses used for rate limiting and banning. An attacker can spoof arbitrary IP addresses to bypass these security measures, ban legitimate ...
EUVD-2026-85020
The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored...
kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing
A flaw was found in the Stream Control Transmission Protocol SCTP implementation within the Linux kernel. A remote attacker could send a specially crafted sequence of ASCONF Add IP Address Configuration chunks, including DEL-IP Delete IP Address parameters, to trigger a use-after-free condition...
kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing
A flaw was found in the Stream Control Transmission Protocol SCTP implementation within the Linux kernel. A remote attacker could send a specially crafted sequence of ASCONF Add IP Address Configuration chunks, including DEL-IP Delete IP Address parameters, to trigger a use-after-free condition...
Apache APISIX - Remote Code Execution
A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. When the admin key was changed or the port of Admin API was changed to a port different...
kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing
A flaw was found in the Stream Control Transmission Protocol SCTP implementation within the Linux kernel. A remote attacker could send a specially crafted sequence of ASCONF Add IP Address Configuration chunks, including DEL-IP Delete IP Address parameters, to trigger a use-after-free condition...
Linux Distros Unpatched Vulnerability : CVE-2026-87121
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device. CVE-2026-87121 - The...
CVE-2026-88831: Not Failing Securely
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...
CVE-2026-87070: Use of Less Trusted Source
The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to enforce its per-visitor voting limit and to record who submitted an entry...
