2006 matches found
CVE-2026-18174 @fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For
@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated entries, the parser trims only space characters and does not strip horizontal tabs, even though RFC 7230 defines optional whitespace as both...
CVE-2026-18174: Improper Input Validation
@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated entries, the parser trims only space characters and does not strip horizontal tabs, even though RFC 7230 defines optional whitespace as both...
CVE-2026-49332
A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys X-Forwarded-User but does not strip underscore-variant keys XForwardedUser from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing a...
CVE-2026-59897
A flaw was found in Hono, a web application framework. The AWS API Gateway v1 adapter incorrectly de-duplicates repeated request header values using a substring comparison, rather than an exact match. This can lead to incomplete data being received by middleware or application logic that relies o...
Linux Distros Unpatched Vulnerability : CVE-2026-63771
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the...
GO-2026-5777 Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi
Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi...
GO-2026-5775 Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi
Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi...
CVE-2026-54764
A flaw was found in Traefik, an HTTP reverse proxy and load balancer. The ForwardAuth middleware, even when configured to not trust forwarded headers, incorrectly uses the original incoming request to determine the X-Forwarded-Port header sent to the authentication service. This allows an...
User Impersonation
Overview zenml is a ZenML: Write production-ready ML code. Affected versions of this package are vulnerable to User Impersonation in the POST /api/v1/login and self password-change endpoints when the rate limiter uses request.client.host derived from the X-Forwarded-For header. An attacker can...
CVE-2026-11922
A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...
CVE-2026-11922 Rate-limit Bypass in zenml-io/zenml
A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...
CVE-2026-11922 Rate-limit Bypass in zenml-io/zenml
A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...
SUSE CVE-2026-63771
Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. Attackers can exploit a misconfigured reverse proxy to...
PT-2026-64225
A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...
CVE-2026-11922: Authentication Bypass by Spoofing
A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...
CVE-2026-16745
The CVE-2026-16745 entry concerns odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). The root cause is an incorrect network binding that allows a malicious actor inside the cluster to bypass authentication and impersonate any user by presenting an arbitrary access token. Th...
CVE-2026-16745 Odh-dashboard: odh-dashboard: backend port 8080 trusts x-forwarded-access-token without origin validation
A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI RHOAI. Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorize...
PT-2026-63564
Name of the Vulnerable Software and Affected Versions Next.js versions 14.1.1 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host, leading to...
EUVD-2026-42325
Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication...
CVE-2026-50755: Authentication Bypass by Spoofing
An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the X-Forwarded-For header value...