38974 matches found
MetaCPAN Net::CIDR::Set security vulnerability
MetaCPAN Net::CIDR::Set is a library from the MetaCPAN Foundation. Versions of MetaCPAN Net::CIDR::Set prior to 0.24 contained a security vulnerability. This vulnerability stemmed from improper handling of leading zeros in IP CIDR addresses, which could lead to bypassing IP-based access controls...
EUVD-2025-208122
Improper session management in D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 ME1.00 allows attackers to execute a session hijacking attack via spoofing the IP address of an authenticated user...
CVE-2026-28295
A flaw was found in the FTP GVfs backend. A malicious FTP server can exploit this vulnerability by providing an arbitrary IP address and port in its passive mode PASV response. The client unconditionally trusts this information and attempts to connect to the specified endpoint, allowing the...
MAL-2026-1049 Malicious code in flycord (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 b2071af47a4b327550f5614253b291b893e0741e6f2ebe3b4378a4794696d211 When the user uses the provided library, this package silently reports basic information and the result of the user's action to a hardcoded, obfuscated URL...
CVE-2026-28295
CVE-2026-28295 affects the FTP GVfs backend. A flaw causes the client to unconditionally trust the PASV response from an FTP server, which may contain an arbitrary IP and port. The client then attempts to connect to that endpoint, enabling a malicious server to probe for open ports reachable from...
CVE-2026-28295
A flaw was found in the FTP GVfs backend. A malicious FTP server can exploit this vulnerability by providing an arbitrary IP address and port in its passive mode PASV response. The client unconditionally trusts this information and attempts to connect to the specified endpoint, allowing the...
kernel: Linux kernel: Denial of Service in ATM CLIP module via infinite recursion
A flaw was found in the Linux kernel's Asynchronous Transfer Mode ATM Classical IP CLIP module. A local user can trigger an infinite recursive call in the clippush function by repeatedly calling the ioctlATMARPMKIP system call. This vulnerability occurs when the socket is closed, leading to stack...
SUSE CVE-2026-27624
Coturn is a free open source implementation of TURN and STUN Server. Coturn is commonly configured to block loopback and internal ranges using "denied-peer-ip" and/or default loopback restrictions. CVE-2020-26262 addressed bypasses involving "0.0.0.0", "::1" and "::", but IPv4-mapped IPv6 is not...
Pouch security vulnerabilities
Pouch is a non-IP protocol developed by Golioth. Version 0.1.0 of Pouch contains a security vulnerability. This vulnerability stems from a heap-based buffer overflow issue during the processing of BLE GATT server certificates, which could lead to heap overflow and system crashes...
Linux Distros Unpatched Vulnerability : CVE-2026-27624
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Coturn is a free open source implementation of TURN and STUN Server. Coturn is commonly configured to block loopback and internal ranges using denied-peer-ip...
CVE-2025-71057: Improper Authentication
Improper session management in D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 ME1.00 allows attackers to execute a session hijacking attack via spoofing the IP address of an authenticated user...
PT-2026-22152
Name of the Vulnerable Software and Affected Versions D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 ME version 1.00 Description The device suffers from improper session management, which allows attackers to perform a session hijacking attack. This is achieved by spoofing the IP address of an...
D-Link DSL-124 security vulnerability
The D-Link DSL-124 is a wired modem-router integrated device produced by D-Link Corporation. The D-Link DSL-124 ME1.00 version contains a security vulnerability. This vulnerability stems from improper session management, which may allow attackers to execute session hijacking attacks by manipulati...
CVE-2025-71057
Improper session management in D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 ME1.00 allows attackers to execute a session hijacking attack via spoofing the IP address of an authenticated user...
CVE-2026-27808 Mailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API
Mailpit is an email testing tool and API for developers. Prior to version 1.29.2, the Link Check API /api/v1/message/ID/link-check is vulnerable to Server-Side Request Forgery SSRF. The server performs HTTP HEAD requests to every URL found in an email without validating target hosts or filtering...
EUVD-2026-8644
Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo...
Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo
Summary When using the AWS Lambda adapter hono/aws-lambda behind an Application Load Balancer ALB, the getConnInfo function incorrectly selected the first value from the X-Forwarded-For header. Because AWS ALB appends the real client IP address to the end of the X-Forwarded-For header, the first...
GHSA-XH87-MX6M-69F3 Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo
Summary When using the AWS Lambda adapter hono/aws-lambda behind an Application Load Balancer ALB, the getConnInfo function incorrectly selected the first value from the X-Forwarded-For header. Because AWS ALB appends the real client IP address to the end of the X-Forwarded-For header, the first...
User Impersonation
Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to User Impersonation via the getConnInfo function in the adapter/aws-lambda/conninfo.ts file. An attacker can gain unauthorized access to resources protected by IP-based access controls by...
CVE-2026-27700 Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo
Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter hono/aws-lambda behind an Application Load Balancer ALB, the getConnInfo function incorrectly selected the first value from the X-Forwarded-For...