PT-2026-55060

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, when the %REQUESTED SERVER NAMEX:Y% is used in log format and host related options is specified, like HOST FIRST, SNI FIRST, it's possible to crash Envoy when the specified...

Linux Distros Unpatched Vulnerability : CVE-2026-40080

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Open Redirect through a substring check rather...

Security update for perl-libwww-perl (moderate)

openSUSE security update: security update for perl-libwww-perl ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21045-1 Rating: moderate References: bsc1265156 Cross-References: CVE-2026-8368 CVSS scores: CVE-2026-8368 SUSE : 5.3...

openid-connect Plugin Spear Phishing

The vulnerability of the openid-connect plugin for the Apache APISIX cloud API gateway is related to insufficient verification of data authenticity when processing identification headers. Exploiting this vulnerability could allow attackers to perform spear-phishing attacks remotely...

Security update for perl-Protocol-HTTP2 (important)

openSUSE security update: security update for perl-protocol-http2 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21125-1 Rating: important References: bsc1267857 Cross-References: CVE-2026-10725 CVSS scores: CVE-2026-10725 SUSE : 7.5...

Exploit for Authentication Bypass by Primary Weakness in Crushftp

CrushFTP 10.8.0 — CVE-2025-31161 Vulnerable Build Pre-built C...

kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the nftinner module. This vulnerability arises from an incorrect handling of IPv6 inner packet processing, where the transport header offset innerthoff becomes desynchronized from the Layer 4 protocol l4proto. A remot...

kernel: net/sched: act_pedit: extend the writable skb range per key

A flaw was found in the Linux kernel's traffic control packet editing pedit subsystem. In tcfpeditact, the copy-on-write COW range for skbensurewritable is computed once before iterating over edit keys, but the calculation does not account for runtime header offsets added by typed keys. This can...

kernel: net/sched: act_pedit: extend the writable skb range per key

A flaw was found in the Linux kernel's traffic control packet editing pedit subsystem. In tcfpeditact, the copy-on-write COW range for skbensurewritable is computed once before iterating over edit keys, but the calculation does not account for runtime header offsets added by typed keys. This can...

Use of Less Trusted Source

Overview libretranslate is a Free and Open Source Machine Translation API. Self-hosted, no limits, no ties to proprietary services. Affected versions of this package are vulnerable to Use of Less Trusted Source via the getremoteaddress function. An attacker can bypass per-IP rate limiting and flo...

CVE-2026-57942

LibreTranslate through 1.9.7, fixed in commit 397fd22, contains an IP spoofing vulnerability in the getremoteaddress function that allows unauthenticated attackers to spoof client IP addresses by injecting arbitrary values into the X-Forwarded-For header without trusted proxy validation. Attacker...

EUVD-2026-40160

LibreTranslate through 1.9.7, fixed in commit 397fd22, contains an IP spoofing vulnerability in the getremoteaddress function that allows unauthenticated attackers to spoof client IP addresses by injecting arbitrary values into the X-Forwarded-For header without trusted proxy validation. Attacker...

CVE-2026-57942

LibreTranslate (up to 1.9.7) contains an IP spoofing vulnerability in get_remote_address() that allows unauthenticated attackers to spoof client IPs via X-Forwarded-For values, bypassing per-IP rate limits and enabling unlimited API abuse. Fixed in commit 397fd22. Affected: LibreTranslate; remedi...

CVE-2026-57942 LibreTranslate - IP Spoofing via X-Forwarded-For Header

LibreTranslate through 1.9.7, fixed in commit 397fd22, contains an IP spoofing vulnerability in the getremoteaddress function that allows unauthenticated attackers to spoof client IP addresses by injecting arbitrary values into the X-Forwarded-For header without trusted proxy validation. Attacker...

CVE-2026-57942 LibreTranslate - IP Spoofing via X-Forwarded-For Header

LibreTranslate through 1.9.7, fixed in commit 397fd22, contains an IP spoofing vulnerability in the getremoteaddress function that allows unauthenticated attackers to spoof client IP addresses by injecting arbitrary values into the X-Forwarded-For header without trusted proxy validation. Attacker...

Malicious code in @bapiweb-ux/bapi-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b2c2c473c5876f94206c048f4899a289ff49e2dadae9f1c4e99b77f9404eae80 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6602 Malicious code in @bapiweb-ux/bapi-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b2c2c473c5876f94206c048f4899a289ff49e2dadae9f1c4e99b77f9404eae80 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @bapiweb-ux/bapi-header is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malware in @bapiweb-ux/bapi-header

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2026-12143

A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return CR, line feed LF, or double-quote " characters into the field argument of FormDataappend or the filename option. This allows th...