WeKan /metrics unconditionally trusts X-Forwarded-For, allowing whitelist IP spoofing (MetricsBleed)

WeKan /metrics Unconditionally Trusts X-Forwarded-For, Allowing Whitelist IP Spoofing MetricsBleed Vulnerability Overview WeKan's Prometheus /metrics endpoint restricts access via an IP whitelist only configured monitoring IPs are allowed. When determining the client's source IP, the code...

Vaultwarden unconditionally trusts the X-Real-IP header, enabling rate-limit bypass and audit IP spoofing

Vaultwarden Unconditional Trust in the X-Real-IP Request Header Leading to Rate-Limit Bypass and Audit IP Spoofing Overview Vaultwarden supports reading the client IP from a configurable HTTP request header IPHEADER, default X-Real-IP for rate limiting of login/2FA and the admin panel, as well as...

Vaultwarden icon endpoint SSRF via IP-literal hrefs

Vaultwarden icon Endpoint Server-Side Request Forgery SSRF Vulnerability Overview Vaultwarden's built-in icon service ICONSERVICE=internal automatically fetches, on the server side, the web pages and icon resources pointed to by vault entry URIs in order to display favicons for entries. The...

AZL-95783 CVE-2026-53791 affecting package rsync for versions less than 3.5.0-1

rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a...

CVE-2026-53791

rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a...

ALPINE-CVE-2026-53791

rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a...

MAL-2026-13935 Malicious code in datetime-fmt-xutil (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f916f6db3bec145472f71c43358b7e8056efb981041a3b4e9bffe8bbaec9997 The npm package's postinstall.js opens a TCP connection to the hardcoded IP 8.135.48.40 on port 4444 and pipes /bin/sh stdio through the socket,...

CVE-2026-70452 rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure

rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the ru...

CVE-2026-53791

rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a...

CVE-2026-53791 rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header

rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a...

EUVD-2026-58099

rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a...

CVE-2026-53791

rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a...

CVE-2026-53791

Technical details about CVE-2026-53791 are not publicly available in the provided documents. Monitor for updates from vendors and advisories.

CVE-2026-53791 rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header

rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a...

CVE-2026-53791 rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header

rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a...

CVE-2026-53791

rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a...

CLEANSTART-2026-HG20195 Security fixes in ip-masq-agent 2.12.0-r1

Package ip-masq-agent version 2.12.0-r1 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-33814...

ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

Important: Red Hat Security Advisory: nodejs:22 security update

An update for the nodejs:22 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2026-73629

CVE-2026-73629 affects Serendipity before 2.6.0. The issue is a server-side request forgery in the serendipity_url_allowed() filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using ...