CVE-2026-72816

A flaw was found in the go-chi/chi RealIP middleware. This vulnerability allows a remote attacker to perform IP spoofing by supplying arbitrary IP addresses in client-controlled headers. This can lead to bypassing IP-based access controls, evading rate limiting and geo-IP restrictions, and...

EUVD-2026-60580

A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed...

Linux Distros Unpatched Vulnerability : CVE-2026-72349

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: xtrateest: fix u64 truncation in xtrateestmt On links faster than 34 Gbps, where byte rate may exceed 2^32-1 4.3 GBps, the comparison result becomes...

CVE-2026-57485

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java injects the STIRLING-PDF-BACKEND-API-USER API...

CVE-2026-57485 Stirling-PDF: Internal Service Account API Key Disclosure via Pipeline Endpoint

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java injects the STIRLING-PDF-BACKEND-API-USER API...

EUVD-2026-60364

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java injects the STIRLING-PDF-BACKEND-API-USER API...

CVE-2026-57485

Stirling-PDF versions prior to 2.9.0 contain an API key disclosure vulnerability in the /api/v1/pipeline/handleData endpoint (PipelineProcessor.java). The endpoint injects the STIRLING-PDF-BACKEND-API-USER key into pipeline subrequests, which an authenticated ROLE_USER can retrieve via /api/v1/us...

CVE-2026-57485 Stirling-PDF: Internal Service Account API Key Disclosure via Pipeline Endpoint

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java injects the STIRLING-PDF-BACKEND-API-USER API...

CVE-2026-74878

opensslencrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server restart. Attackers can distribute authentication attempts across multiple server instances or retry immediately after a restart to bypass rate...

CVE-2026-74878 openssl_encrypt before 1.4.0 TOTP Rate Limiter Bypass

opensslencrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server restart. Attackers can distribute authentication attempts across multiple server instances or retry immediately after a restart to bypass rate...

EUVD-2026-60097

opensslencrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server restart. Attackers can distribute authentication attempts across multiple server instances or retry immediately after a restart to bypass rate...

CVE-2026-74878 openssl_encrypt before 1.4.0 TOTP Rate Limiter Bypass

opensslencrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server restart. Attackers can distribute authentication attempts across multiple server instances or retry immediately after a restart to bypass rate...

CVE-2026-74878

openssl_encrypt versions before 1.4.0 contain a TOTP brute-force rate limiter bypass in openssl_encrypt_server/modules/pepper/totp.py. The TOTPRateLimiter class stores attempt and lockout state in an in-memory defaultdict(list) as a class variable, meaning rate-limit state is not shared across wo...

EUVD-2026-60087

SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service Basic Auth implementation PublishServiceTransport.RoundTrip in kernel/server/proxy/publish.go. The Publish Service runs on a separate, unauthenticated-by-default listener default TCP port 6808 and...

CVE-2026-74868

SiYuan before 3.7.4 has an unthrottled brute-force flaw in PublishServiceTransport.RoundTrip() (kernel/server/proxy/publish.go), where the Publish Service (default TCP 6808) applies Basic Auth with no rate limiting, lockout, or backoff, letting unauthenticated remote attackers guess passwords aga...

SUSE CVE-2026-74463

In the Linux kernel, the following vulnerability has been resolved: i2c: jz4780: Cache host clock rate at probe to prevent CCF preparelock deadlock Fix a severe AB/BA deadlock between the Common Clock Framework CCF and the I2C adapter lock, which triggers when an I2C-controlled clock generator...

CVE-2026-73045

SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoint that allows unauthenticated attackers to brute-force per-notebook publish passwords. Attackers can submit unbounded password guesses without rate limiting ...

CVE-2026-73045

SiYuan before 3.7.4 has an improper restriction of excessive authentication attempts in the authFilePublishAccess endpoint, allowing unauthenticated attackers to brute-force per-notebook publish passwords with no rate limiting or CAPTCHA, potentially granting access to password-protected publishe...

CVE-2026-73045

SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoint that allows unauthenticated attackers to brute-force per-notebook publish passwords. Attackers can submit unbounded password guesses without rate limiting ...

EUVD-2026-59772

A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipulation results in improper restriction of excessive authentication attempts. The attack is possibl...