[SECURITY] [DLA 4705-1] calibre security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4705-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA July 29, 2026 https://wiki.debian.org/LTS -...

UBUNTU-CVE-2026-27824

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the calibre Content Server's brute-force protection mechanism uses a ban key derived from both remoteaddr and the X-Forwarded-For header. Since the X-Forwarded-For header i...

CVE-2026-27824 calibre has IP Ban Bypass via X-Forwarded-For Header Spoofing

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the calibre Content Server's brute-force protection mechanism uses a ban key derived from both remoteaddr and the X-Forwarded-For header. Since the X-Forwarded-For header i...

CVE-2026-27824 calibre has IP Ban Bypass via X-Forwarded-For Header Spoofing

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the calibre Content Server's brute-force protection mechanism uses a ban key derived from both remoteaddr and the X-Forwarded-For header. Since the X-Forwarded-For header i...

CVE-2026-27824 calibre has IP Ban Bypass via X-Forwarded-For Header Spoofing

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the calibre Content Server's brute-force protection mechanism uses a ban key derived from both remoteaddr and the X-Forwarded-For header. Since the X-Forwarded-For header i...

CVE-2017-18462

cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled SEC-224...

IP2Location Country Blocker < 2.26.5 - Ban Bypass

The plugin bans can be bypassed by using a specific parameter in the URL https://example.com/?admin-ajax=hehe...

WordPress IP2Location Country Blocker plugin <= 2.26.4 - Ban Bypass vulnerability

Ban Bypass vulnerability discovered by Krzysztof Zając in WordPress IP2Location Country Blocker plugin versions = 2.26.4. Solution Update the WordPress IP2Location Country Blocker plugin to the latest available version at least 2.26.5...

IP2Location Country Blocker < 2.26.5 - Ban Bypass

The plugin bans can be bypassed by using a specific parameter in the URL PoC https://example.com/?admin-ajax=hehe...

CVE-2017-18462

cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled SEC-224...

CVE-2017-18462

cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled SEC-224...

CVE-2017-18462

cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP-based protection is enabled (SEC-224). The issue is documented across multiple sources as a vulnerability in cPanel up to version 62.0.16, with the fix in 62.0.17 identified. Root cause details are not elaborated in the provided doc...

CVE-2017-18462: Undefined Security Weakness

cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled SEC-224...

CVE-2010-4685: Improper Certificate Validation

Cisco IOS before 15.01XA1 does not clear the public key cache upon a change to a certificate map, which allows remote authenticated users to bypass a certificate ban by connecting with a banned certificate that had previously been valid, aka Bug ID CSCta79031...

CVE-2006-7047

The CVE-2006-7047 entry concerns include.php in Shoutpro 1.0, where a crafted path parameter could bypass IP ban restrictions by referencing an alternate bannedips.php file. The CVE description notes that this was originally reported as remote file inclusion, but the analysis indicates it cannot ...

CVE-2006-7047: Undefined Security Weakness

include.php in Shoutpro 1.0 might allow remote attackers to bypass IP ban restrictions via a URL in the path parameter that points to an alternate bannedips.php file. NOTE: this issue was originally reported as remote file inclusion, but CVE analysis suggests that this cannot be used for code...