37104 matches found
CVE-2026-40460
CVE-2026-40460 affects NGINX Plus ngx_quic_module and NGINX Open Source when HTTP/3 QUIC is enabled. An attacker could spoof the source IP to bypass authorization or rate limiting, potentially enabling unauthorized access or DoS. Remediation per the connected advisory: upgrade to vulnerable-produ...
HTTP/3 address spoofing
HTTP/3 address spoofing Severity: medium CVE-2026-40460 Not vulnerable: 1.31.0+, 1.30.1+ Vulnerable: 1.25.0-1.30.0...
CVE-2026-40460
When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
K000161068: NGINX ngx_quic_module vulnerability CVE-2026-40460
Security Advisory Description When NGINX Plus or NGINX Open Source is configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting. CVE-2026-40460 Impact This vulnerability allows a remote,...
PT-2026-40648
Name of the Vulnerable Software and Affected Versions NGINX Plus affected versions not specified NGINX Open Source affected versions not specified Description When configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address. This can lead to the bypass of...
ROS-20260513-73-0012
Vulnerability in python-django related to spoofing authentication bypass. Exploitation of the vulnerability could allow an attacker acting remotely to conduct spoofing attacks...
PT-2026-40788
Three CVEs CVE-2026-29774, CVE-2026-30015, CVE-2026-30221 exploited the fact that the protocol did not, in version 1.2, canonicalize tool names. Multiple servers in the same session could expose tools named, respectively: readfile the legitimate filesystem server…...
CVE-2026-44659
Zen is a firefox-based browser. Prior to 1.19.12b, the ZEN Browser incorrectly truncates long hostnames in the address bar and shows only the attacker-controlled prefix of the subdomain, hiding the actual registrable domain eTLD+1. As a result, an attacker can craft extremely long malicious...
CVE-2026-34327
Externally controlled reference to a resource in another sphere in Microsoft Partner Center allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-44217
sse-channel is an SSE-implementation which can be used to any node.js http request/response stream. Prior to 4.0.1, implementations that allow user-provided values to be passed to event, retry or id fields are susceptible to event spoofing, where an attacker could inject arbitrary messages into t...
CVE-2026-44217
sse-channel is an SSE-implementation which can be used to any node.js http request/response stream. Prior to 4.0.1, implementations that allow user-provided values to be passed to event, retry or id fields are susceptible to event spoofing, where an attacker could inject arbitrary messages into t...
CVE-2026-44217 sse-channel: SSE Injection via unsanitized event fields
sse-channel is an SSE-implementation which can be used to any node.js http request/response stream. Prior to 4.0.1, implementations that allow user-provided values to be passed to event, retry or id fields are susceptible to event spoofing, where an attacker could inject arbitrary messages into t...
CVE-2026-44217 sse-channel: SSE Injection via unsanitized event fields
sse-channel is an SSE-implementation which can be used to any node.js http request/response stream. Prior to 4.0.1, implementations that allow user-provided values to be passed to event, retry or id fields are susceptible to event spoofing, where an attacker could inject arbitrary messages into t...
CVE-2026-44217
The CVE-2026-44217 entry affects the sse-channel SSE implementation used in Node.js streams. Prior to version 4.0.1, passing user-provided values to the event, retry, or id fields allows event spoofing, enabling injection of arbitrary SSE messages into the stream and potentially impacting consume...
EUVD-2026-29715
User interface ui misrepresentation of critical information in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...
EUVD-2026-29712
Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally...
EUVD-2026-29687
Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally...
EUVD-2026-29697
Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally...