PT-2026-121371

Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/...

Linux Distros Unpatched Vulnerability : CVE-2026-114437

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct...

Lotus authorization issue vulnerability

Lotus versions 0.10.2 and earlier contain an authorization issue vulnerability. This vulnerability arises because the Go event ingestion middleware validates API keys solely by checking their prefix, without verifying the stored hashedkey. As a result, attackers can use the organization’s...

SUSE CVE-2026-112942

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved whil...

middleware-apm (>=0.1.29, <=0.1.37) potentially affected by CVE-2026-113716 via virtualenv (20.0.17)

virtualenv PYPI version 20.0.17 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - middleware-apm =0.1.29, =0.1.37 Source cves: CVE-2026-113716 Source advisory: OSV:GHSA-CW65-GX24-RC82...

middleware-apm (>=0.1.29, <=0.1.37) potentially affected by CVE-2026-113724 via virtualenv (20.0.17)

virtualenv PYPI version 20.0.17 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - middleware-apm =0.1.29, =0.1.37 Source cves: CVE-2026-113724 Source advisory: OSV:GHSA-43MP-35Q3-X3FQ...

middleware-apm (>=0.1.29, <=0.1.37) potentially affected by CVE-2026-113722 via virtualenv (20.0.17)

virtualenv PYPI version 20.0.17 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - middleware-apm =0.1.29, =0.1.37 Source cves: CVE-2026-113722 Source advisory: OSV:GHSA-C978-59M8-C77V...

CVE-2026-114139

Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel pat...

CVE-2026-114139

The Sentry-Javascript SDK for JavaScript contains a middleware bypass vulnerability in its webpack integration for @sentry/nextjs . Versions 9.36.0 through 9.47.2, 10.75.2, and 11.0.0-rc.1 are affected. The root cause is that the integration skips application middleware for all paths under a conf...

CVE-2026-114139 Sentry-Javascript: Middleware Bypass when using Tunnel route

Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel pat...

CVE-2026-114139

Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel pat...

CVE-2026-114139 Sentry-Javascript: Middleware Bypass when using Tunnel route

Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel pat...

CVE-2026-114139 Sentry-Javascript: Middleware Bypass when using Tunnel route

Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel pat...

Use of Less Trusted Source

Overview Affected versions of this package are vulnerable to Use of Less Trusted Source via the ClientIPFromXFF process. An attacker can manipulate the client IP address returned by the middleware by appending a trusted-looking proxy address to the X-Forwarded-For header when connecting directly ...

Use of Less Trusted Source

Overview Affected versions of this package are vulnerable to Use of Less Trusted Source via the ClientIPFromXFF process. An attacker can manipulate the client IP address returned by the middleware by appending a trusted-looking proxy address to the X-Forwarded-For header when connecting directly ...

Use of Less Trusted Source

Overview Affected versions of this package are vulnerable to Use of Less Trusted Source via the ClientIPFromXFF process. An attacker can manipulate the client IP address returned by the middleware by appending a trusted-looking proxy address to the X-Forwarded-For header when connecting directly ...

Use of Less Trusted Source

Overview Affected versions of this package are vulnerable to Use of Less Trusted Source via the ClientIPFromXFF process. An attacker can manipulate the client IP address returned by the middleware by appending a trusted-looking proxy address to the X-Forwarded-For header when connecting directly ...

Use of Less Trusted Source

Overview Affected versions of this package are vulnerable to Use of Less Trusted Source via the ClientIPFromXFF process. An attacker can manipulate the client IP address returned by the middleware by appending a trusted-looking proxy address to the X-Forwarded-For header when connecting directly ...

middleware-apm (>=0.1.29, <=0.1.37) potentially affected by CVE-2026-113725 via virtualenv (20.0.17)

virtualenv PYPI version 20.0.17 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - middleware-apm =0.1.29, =0.1.37 Source cves: CVE-2026-113725 Source advisory: OSV:GHSA-VXJ4-Q4G9-CRJ7...

npm: Vite: Cross origin script execution through Vite custom middleware

npm: Vite: Cross origin script execution through Vite custom middleware vulnerability discovered by ? in WordPress npm vite versions = 6.4.3...