CVE-2026-126083 Action Pack: Possible IP spoofing in Action Dispatch RemoteIp

Action Pack is a framework for handling and responding to web requests. From 8.1 until 8.1.4.1, Since Rails 8.1.0, ActionDispatch::RemoteIp derives request.remoteip from Rack::Requestforwardedfor, which under Rack 3 reads the RFC 7239 Forwarded header in preference to X-Forwarded-For. When a...

EUVD-2026-122936

Action Pack is a framework for handling and responding to web requests. From 8.1 until 8.1.4.1, Since Rails 8.1.0, ActionDispatch::RemoteIp derives request.remoteip from Rack::Requestforwardedfor, which under Rack 3 reads the RFC 7239 Forwarded header in preference to X-Forwarded-For. When a...

CVE-2026-126083

The Action Pack framework (Rails 8.1.0 through 8.1.4) is vulnerable to IP spoofing when running with Rack 3 . The vulnerability exists because ActionDispatch::RemoteIp derives request.remote_ip from Rack::Request#forwarded_for, which prioritizes the RFC 7239 Forwarded header over X-Forwarded-For....

CVE-2026-126083 Action Pack: Possible IP spoofing in Action Dispatch RemoteIp

Action Pack is a framework for handling and responding to web requests. From 8.1 until 8.1.4.1, Since Rails 8.1.0, ActionDispatch::RemoteIp derives request.remoteip from Rack::Requestforwardedfor, which under Rack 3 reads the RFC 7239 Forwarded header in preference to X-Forwarded-For. When a...

CVE-2026-126083

Action Pack is a framework for handling and responding to web requests. From 8.1 until 8.1.4.1, Since Rails 8.1.0, ActionDispatch::RemoteIp derives request.remoteip from Rack::Requestforwardedfor, which under Rack 3 reads the RFC 7239 Forwarded header in preference to X-Forwarded-For. When a...

CVE-2026-126073 Action Pack: Possible cache poisoning in Action Pack content negotiation

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack negotiates the format of a rendered response from the Accept, X-Requested-With and, for XHR requests without Accept, Content-Type request headers, but...

CVE-2026-126073 Action Pack: Possible cache poisoning in Action Pack content negotiation

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack negotiates the format of a rendered response from the Accept, X-Requested-With and, for XHR requests without Accept, Content-Type request headers, but...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

Important: Red Hat Security Advisory: rhc security, bug fix, and enhancement update

An update for rhc is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

WordPress ARForms plugin <= 7.2.4 - Unauthenticated Arbitrary File Upload to Remote Code Execution via X-FILENAME Header vulnerability

Unauthenticated Arbitrary File Upload to Remote Code Execution via X-FILENAME Header vulnerability discovered by LionTree in WordPress Plugin ARForms versions = 7.2.4...

WordPress ARforms plugin <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting via Referer Header vulnerability

Unauthenticated Stored Cross-Site Scripting via Referer Header vulnerability discovered by Huynh Pham Thanh Luc - Noventiq Vietnam in WordPress Plugin ARForms versions = 7.2.4...

EUVD-2026-120481

Rack: Multipart boundary ambiguity guard in Rack::Multipart::Parser can be bypassed with a quoted boundary value, allowing WAF bypass...

GHSA-P8X9-V4HV-2W4G Rack: Multipart boundary ambiguity guard in Rack::Multipart::Parser can be bypassed with a quoted boundary value, allowing WAF bypass

Summary The guard added for CVE-2026-26961 GHSA-vgpv-f759-9wx3, which rejects multipart requests with more than one boundary parameter, only inspects the part of the Content-Type header after the boundary it extracts. A Content-Type whose first boundary parameter is empty or begins with a quote,...

Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header — incomplete fix of CVE-2026-34835

Summary Rack::Requesthostwithport, and therefore baseurl and url, return the raw authority string when it fails validation. An attacker-controlled Host, X-Forwarded-Host, or Forwarded: host= value containing characters that are not permitted in an authority is embedded verbatim in URLs generated ...

GHSA-2J8W-XCRC-X985 Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header — incomplete fix of CVE-2026-34835

Summary Rack::Requesthostwithport, and therefore baseurl and url, return the raw authority string when it fails validation. An attacker-controlled Host, X-Forwarded-Host, or Forwarded: host= value containing characters that are not permitted in an authority is embedded verbatim in URLs generated ...

CVE-2026-125331

HarnessRouter is a self-hosted unified API for running agent harnesses with sessions, streaming, files, cancellation, and failure handling. Prior to 0.31.8, a console that is not in self-hosted mode attaches the server's internal key to requests carrying an Authorization header before validating...

CVE-2026-125729

Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it. The call method sets the policy in a response header named "content-security-protocol" instead of "Content-Security-Policy". Browsers ignore that header...

CVE-2025-4664

🔒 Vulnerability CVE-2025-4664 The CVE-2025-4664 vulnerability is a high-severity security flaw identified in the Loader component of Google Chrome, present in versions prior to 136.0.7103.113. This issue allows a remote attacker to leak cross-origin data via a specially crafted HTML page,...

CVE-2026-125729 Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it

Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it. The call method sets the policy in a response header named "content-security-protocol" instead of "Content-Security-Policy". Browsers ignore that header...

CVE-2026-125729

The Plack::Middleware::CSP library for Perl (versions before 0.03 ) is vulnerable to a configuration error where the call method sets the Content Security Policy under the incorrect header name "content-security-protocol" instead of "Content-Security-Policy" . Because browsers ignore the incorrec...