EUVD-2026-66388

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the...

SUSE CVE-2026-95279

UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to spoof address bar via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-95291

UI misrepresentation in SecurityIndicators in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof address bar via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-95320

Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-95323

UI misrepresentation in Chromium in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. Chromium security severity: Medium...

A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You

The private email address GitLab gives you for filing issues by email is a credential. Anyone who gets it can email a patch that GitLab commits in your name, to any branch you can push to, including main, and can start CI/CD jobs that run as you. GitLab shows each user this address behind a butto...

php: php: Access control bypass via partial IPv6 address comparison

A flaw was found in PHP. The access control check for Internet Protocol version 6 IPv6 addresses in the FastCGI implementation compares only the first 12 bytes of a 16-byte address instead of the complete address. An attacker on an adjacent network with an address sharing the first 96 bits with a...

CVE-2026-57222

A flaw was found in Suricata. This vulnerability allows a remote attacker to cause an incorrect detection state by sending specially crafted IPv4 and IPv6 address pairs. The flaw occurs because the system's IPPair hash does not properly compare the IP address family, leading to the reuse of state...

CVE-2026-89331 FluentBoards 1.95 - 2.0.15 - Unauthenticated Board Member Email Address Disclosure via Public Board Endpoints

The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthenticated users to disclose the email addresses of a shared board's members, typically including administrators...

CVE-2026-89331

The FluentBoards WordPress plugin (versions 1.95-2.0.15 ) is vulnerable to an unauthenticated board member email address disclosure vulnerability. The flaw exists because the plugin fails to properly restrict member data returned by its public, token-shared board feature . This allows unauthentic...

WordPress FluentBoards plugin 1.95-2.0.15 - Unauthenticated Board Member Email Address Disclosure vulnerability

Unauthenticated Board Member Email Address Disclosure vulnerability discovered by vuxvinh in WordPress Plugin FluentBoards versions 1.95-2.0.15...

CVE-2026-14321 Divi Dash < 1.0.7 - Unauthenticated Denial of Service via IP Address Spoofing

The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored...

EUVD-2026-85023

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on one of its AJAX actions, allowing users with a subscriber-level account to disclose the display name and email address of every registered user, including administrators...

CVE-2026-14321

The divi-dash WordPress plugin, versions prior to 1.0.7 , is vulnerable to an unauthenticated Denial of Service due to insufficient validation of client IP addresses used for rate limiting and banning. An attacker can spoof arbitrary IP addresses to bypass these security measures, ban legitimate ...

EUVD-2026-85020

The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored...

CVE-2026-14321 Divi Dash < 1.0.7 - Unauthenticated Denial of Service via IP Address Spoofing

The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored...

CLEANSTART-2026-YH11240 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

CVE-2026-56854 affects multiple packages. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for individual vulnerability...

CVE-2026-92929

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request source address. An unauthenticated remote attacker can spoof a loopback address to bypass local-connection-only security controls exposed on the...

PT-2026-97185

Name of the Vulnerable Software and Affected Versions Forminator Forms WordPress plugin versions prior to 1.57.2.1 Description The plugin fails to bind saved-draft notifications to the visitor who created the draft. It accepts both the recipient address and the link included in the message direct...

PT-2026-97532

Name of the Vulnerable Software and Affected Versions Arc affected versions not specified Description An address bar spoofing issue exists where an attacker can manipulate the browser address bar. This is achieved using a element that triggers the requestFullscreen function without displaying the...