CVE-2026-118651

The Echo Go web framework (versions 4.0.0 through 5.4.0 ) contains a vulnerability where the Proxy middleware forwards an attacker-supplied X-Real-IP header to upstream services by default. This occurs when Echo.IPExtractor is not configured, allowing a remote client to spoof their client address...

CVE-2026-118651 Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default

Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...

CVE-2026-118651: Origin Validation Error

Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...

CVE-2026-35191

A flaw was found in OpenSSL. This vulnerability allows a remote attacker to abuse the server to amplify network traffic in a Denial of Service DoS attack. When the server is configured without client address validation, incoming datagrams containing multiple QUIC packets cause the server to...

CVE-2026-88742

Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting XSS in the client address field...

CVE-2026-90711

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...

CVE-2026-88742: Improper Neutralization of Input During Web Page Generation

Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting XSS in the client address field...

EUVD-2026-79298

Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting XSS in the client address field...

CVE-2026-88742

Bacularis versions 1.0.0 through 6.5.0 are vulnerable to Stored cross-site scripting (XSS) . The vulnerability exists within the client address field , where improper neutralization of input during web page generation allows for script injection. Exploitation details are not provided in the docum...

CVE-2026-88742

Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting XSS in the client address field...

PT-2026-92470

Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting XSS in the client address field...

CVE-2026-88742

Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting XSS in the client address field...

CVE-2026-73742 Improper Client Address Validation allows Request Attribution Spoofing in Fabric Composer API Endpoint

A vulnerability in an API endpoint of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to spoof the source address attributed to their requests. Successful exploitation could allow an attacker to cause inaccurate attribution information to be recorded on the...

CVE-2026-38447

osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the ke...

PT-2026-67467

osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the ke...

CVE-2026-38447

osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the ke...

CVE-2026-38447

The software osTicket (versions

CVE-2026-38447

osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the ke...

EUVD-2026-52402

osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the ke...

CVE-2026-38447

osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the ke...