CVE-2026-103592 simple-php-router through 5.4.1.7 IP restriction bypass via forwarding headers

simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. Attackers can spoof X-Forwarded-For, CF-Connecting-IP, or Client-IP headers to...

CVE-2026-103592

The simple-php-router library, specifically versions through 5.4.1.7 , contains an IP restriction bypass vulnerability within the IpRestrictAccess middleware. The root cause allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections by spoofing HTTP headers such as X...

CVE-2026-103592 simple-php-router through 5.4.1.7 IP restriction bypass via forwarding headers

simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. Attackers can spoof X-Forwarded-For, CF-Connecting-IP, or Client-IP headers to...

CLEANSTART-2023-RT70997 Heap-based buffer overflow in the proxy_connect function in src/client

Security vulnerability affects the cvs package. Heap-based buffer overflow in the proxyconnect function in src/client...

CLEANSTART-2026-GF82267 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

CVE-2026-56853 affects multiple packages. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. See references for individual vulnerability details...

CLEANSTART-2026-DE50350 authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users

Security vulnerability affects the containerd package. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users...

CVE-2026-90125

A flaw was found in the SMB client of the Linux kernel. In the smb2newreadreq function, a request buffer is allocated but not properly released when certain error conditions occur during an asynchronous read operation. A remote attacker could repeatedly trigger these error conditions, leading to ...

clients web-v2026.9.1

Bitwarden Client Applications This repository houses all Bitwarden client applications except the mobile applications iOS | android. Please refer to the Clients section of the Contributing Documentation for build instructions, recommended tooling, code style tips, and lots of other great...

DEBIAN-CVE-2026-19445

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a different context to SSLSocket.context the documented way to select a certificate per server name and nothing else keeps the original ssl.SSLContext alive. Typical cases are...

redis-cve-2026-23479-check

redis-cve-2026-23479-check Безопасная, только для чтения проверка версии для CVE-2026-23479 — использование после освобождения use-after-free в коде блокирующих клиентов Redis, которое позволяет аутентифицированному пользователю выполнить удаленный код на хосте. Инструмент не эксплуатирует...

CVE-2026-19445 Use-after-free of a server-side SSLContext when sni_callback switches contexts

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a different context to SSLSocket.context the documented way to select a certificate per server name and nothing else keeps the original ssl.SSLContext alive. Typical cases are...

CVE-2026-19445

A remote, unauthenticated TLS client can trigger a server crash or a use-after-free (calling through a freed pointer) vulnerability. This occurs when the sni_callback assigns a different context to SSLSocket.context —the standard method for selecting certificates per server name—without any other...

CVE-2026-19445

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a different context to SSLSocket.context the documented way to select a certificate per server name and nothing else keeps the original ssl.SSLContext alive. Typical cases are...

Malicious Package

Overview mms-ref-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview mms-thin-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview epic-webpack-hot-dev-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2026-103227

A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gfdashresolveurl of the file src/mediatools/dashclient.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. Upgrading to version...

CVE-2026-103227

A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gfdashresolveurl of the file src/mediatools/dashclient.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. Upgrading to version...

UBUNTU-CVE-2026-103227

A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gfdashresolveurl of the file src/mediatools/dashclient.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. Upgrading to version...

firefox: thunderbird: Mitigation bypass in the Remote Settings Client component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the Remote Settings Client component...