openSUSE 16 Security Update : rustup (openSUSE-SU-2026:22016-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22016-1 advisory. - CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded bsc1243862. - CVE-2025-58160:...

AlmaLinux 9.2 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1739821812)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1739821812 advisory. - In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, due to a code logic error, filtering functions such as...

CVE-2026-82267 Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/variant handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries...

CVE-2026-82267 Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/variant handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries...

CVE-2026-82267

Komodo (through version 2.3.2) contains a logic flaw in the /execute and /execute/{variant} API handlers, where internal resource identifiers are disclosed and audit log entries are written before permission checks are evaluated. Authenticated users can exploit this by guessing resource names to ...

CVE-2026-82267 Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/variant handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries...

Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False

Summary The CertificateExport handler in lemur/certificates/views.py nests its entire ownership / CertificatePermission check inside an if plugin.requireskey: branch. When the selected export plugin advertises requireskey = False, the authorization check is skipped entirely and any authenticated...

PYSEC-2026-3673 Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False

Summary The CertificateExport handler in lemur/certificates/views.py nests its entire ownership / CertificatePermission check inside an if plugin.requireskey: branch. When the selected export plugin advertises requireskey = False, the authorization check is skipped entirely and any authenticated...

GHSA-4H97-P9WQ-CHQJ Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False

Summary The CertificateExport handler in lemur/certificates/views.py nests its entire ownership / CertificatePermission check inside an if plugin.requireskey: branch. When the selected export plugin advertises requireskey = False, the authorization check is skipped entirely and any authenticated...

Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False

Summary The CertificateExport handler in lemur/certificates/views.py nests its entire ownership / CertificatePermission check inside an if plugin.requireskey: branch. When the selected export plugin advertises requireskey = False, the authorization check is skipped entirely and any authenticated...

CVE-2026-72816

A flaw was found in the go-chi/chi RealIP middleware. This vulnerability allows a remote attacker to perform IP spoofing by supplying arbitrary IP addresses in client-controlled headers. This can lead to bypassing IP-based access controls, evading rate limiting and geo-IP restrictions, and...

PT-2026-80219

Summary The CertificateExport handler in lemur/certificates/views.py nests its entire ownership / CertificatePermission check inside an if plugin.requires key: branch. When the selected export plugin advertises requires key = False, the authorization check is skipped entirely and any authenticate...

UBUNTU-CVE-2026-72816

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...

CVE-2026-72816

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...

CVE-2026-72816 go-chi chi before 5.3.0 IP Spoofing via RealIP Middleware

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...

CVE-2026-72816 go-chi chi before 5.3.0 IP Spoofing via RealIP Middleware

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...

CVE-2026-72816

The CVE-2026-72816 affects go-chi/chi up to version 5.2.1, specifically the RealIP middleware (realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, X-Forwarded-For) and overwrites r.RemoteAddr without validating the origin of the request from a trusted pro...

Vaultwarden unconditionally trusts the X-Real-IP header, enabling rate-limit bypass and audit IP spoofing

Vaultwarden Unconditional Trust in the X-Real-IP Request Header Leading to Rate-Limit Bypass and Audit IP Spoofing Overview Vaultwarden supports reading the client IP from a configurable HTTP request header IPHEADER, default X-Real-IP for rate limiting of login/2FA and the admin panel, as well as...

github.com/go-chi/chi: go-chi/chi: IP Spoofing via RealIP Middleware allows bypassing access controls

A flaw was found in the go-chi/chi RealIP middleware. This vulnerability allows a remote attacker to perform IP spoofing by supplying arbitrary IP addresses in client-controlled headers. This can lead to bypassing IP-based access controls, evading rate limiting and geo-IP restrictions, and...

github.com/go-chi/chi: go-chi/chi: IP Spoofing via RealIP Middleware allows bypassing access controls

A flaw was found in the go-chi/chi RealIP middleware. This vulnerability allows a remote attacker to perform IP spoofing by supplying arbitrary IP addresses in client-controlled headers. This can lead to bypassing IP-based access controls, evading rate limiting and geo-IP restrictions, and...