CVE-2026-75514

In BunkerWeb versions prior to 1.6.13, the blacklist, greylist, and antibot modules in blacklist.lua, greylist.lua, and antibot.lua trust PTR suffix matches in IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS without calling get_ips to verify the hostname resolves to the client IP. An attacker...

EUVD-2026-63542

BunkerWeb is an open-source, next-generation Web Application Firewall. Prior to 1.6.13, the blacklist, greylist, and antibot modules in src/common/core/blacklist/blacklist.lua, src/common/core/greylist/greylist.lua, and src/common/core/antibot/antibot.lua trust PTR suffix matches in IGNORERDNS,...