CVE-2026-94127: Heap-based Buffer Overflow

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution RCE. This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth...

CVE-2026-62985: Uncaught Exception

request-filtering-agent is an https.Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 169.254.169.254 or...

CVE-2026-37604: Inconsistent Interpretation of HTTP Requests

pH7Software pH7Builder pH7 Social Dating CMS through 18.2.0 resolves the client IP address in protected/framework/Ip/Ip.class.php from the HTTPCLIENTIP and HTTPXFORWARDEDFOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout are...

EUVD-2026-84812

pH7Software pH7Builder pH7 Social Dating CMS through 18.2.0 resolves the client IP address in protected/framework/Ip/Ip.class.php from the HTTPCLIENTIP and HTTPXFORWARDEDFOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout are...

CVE-2026-37604

pH7Software pH7Builder pH7 Social Dating CMS through 18.2.0 resolves the client IP address in protected/framework/Ip/Ip.class.php from the HTTPCLIENTIP and HTTPXFORWARDEDFOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout are...

CVE-2026-91164

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validateapitoken into RequestAuthorization::UserToken without enforcing the owning user's allowedipranges against the trusted client address in...

CLSA-2026-1790006158 TuxCare security update for ip-address (1 CVE)

TuxCare rebuilt ip-address to address 1 CVE. Fixed in 6.4.0-tuxcare.3...

EUVD-2026-83941

GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not validate that a requested server-assigned job ID belongs to the pipeline and stage named in the request. An authenticated user can guess job IDs and retrieve status for jobs in pipelines the us...

kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing

A flaw was found in the Stream Control Transmission Protocol SCTP implementation within the Linux kernel. A remote attacker could send a specially crafted sequence of ASCONF Add IP Address Configuration chunks, including DEL-IP Delete IP Address parameters, to trigger a use-after-free condition...

CVE-2026-94096: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. Affected by this issue is some unknown functionality of the file /usr/bin/networktools of the component LAN IP Configuration Handler. The manipulation of the argument ipv4 results in command injection. The attack may be launched...

CVE-2026-94096

CVE-2026-94096 is a command injection vulnerability in Netcore NBR200V2 firmware 1.3.241127.071246 , located in the LAN IP Configuration Handler component (file /usr/bin/network_tools). The injection is triggered by manipulating the ipv4 argument and can be launched remotely . The exploit is rate...

CVE-2024-38063_PoC

Advertencia: ¡El exploit de ejecución remota de código de esta vulnerabilidad es potencialmente volátil! 🚀 Envío de Paquetes para la Vulnerabilidad de Ejecución Remota de Código en TCP/IP de Windows CVE-2024-38063 🎭 ¿Estás listo para desatar el caos en un entorno controlado? ¡No busques más! Este...

CVE-2026-89093

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposure by Spoofing in all versions up to, and including, 2.15.33. This is due to the isaibotuser function identifying privileged internal AI bot accounts by performing...

EUVD-2026-83478

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposure by Spoofing in all versions up to, and including, 2.15.33. This is due to the isaibotuser function identifying privileged internal AI bot accounts by performing...

CVE-2026-89093 Better Messages <= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposure by Spoofing in all versions up to, and including, 2.15.33. This is due to the isaibotuser function identifying privileged internal AI bot accounts by performing...

CVE-2026-89093

The Better Messages WordPress plugin (versions up to and including 2.15.33 ) is vulnerable to Information Exposure by Spoofing . The is_ai_bot_user() function identifies privileged internal AI bot accounts by checking for the prefix 'ai-chat-bot-' against a guest record's stored IP address, which...

CVE-2026-89093 Better Messages <= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposure by Spoofing in all versions up to, and including, 2.15.33. This is due to the isaibotuser function identifying privileged internal AI bot accounts by performing...

CVE-2026-89093: Improper Authentication

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposure by Spoofing in all versions up to, and including, 2.15.33. This is due to the isaibotuser function identifying privileged internal AI bot accounts by performing...

DEBIAN-CVE-2026-71855

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing the IP family when their raw address words, ports, protocol, VLAN, recursion...

CVE-2026-71855

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing the IP family when their raw address words, ports, protocol, VLAN, recursion...