CVE-2026-24398

CVE-2026-24398 — Hono IPv4 address validation bypass : Prior to 4.11.7, IP Restriction Middleware fails to validate IPv4 octets in the src/utils/ipaddr.ts code paths, due to a permissive IPv4_REGEX and an unsafe convertIPv4ToBinary function. This allows crafting malformed IPs that can bypass IP-b...

Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing

Summary IP Restriction Middleware in Hono is vulnerable to an IP address validation bypass. The IPV4REGEX pattern and convertIPv4ToBinary function in src/utils/ipaddr.ts do not properly validate that IPv4 octet values are within the valid range of 0-255, allowing attackers to craft malformed IP...

GHSA-R354-F388-2FHH Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing

Summary IP Restriction Middleware in Hono is vulnerable to an IP address validation bypass. The IPV4REGEX pattern and convertIPv4ToBinary function in src/utils/ipaddr.ts do not properly validate that IPv4 octet values are within the valid range of 0-255, allowing attackers to craft malformed IP...

CVE-2026-24794

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in CardboardPowered cardboard src/main/java/org/cardboardpowered/impl/world modules. This vulnerability is associated with program files WorldImpl.Java. This issue affects cardboard: before 1.21.4...

CVE-2026-1465

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in anyrtcIO-Community anyRTC-RTMP-OpenSource thirdparty/faad2-2.7/libfaad modules. This vulnerability is associated with program files bits.C, syntax.C. This issue affects anyRTC-RTMP-OpenSource: before 1.0...

PT-2026-4917

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.11.7 Description The IP Restriction Middleware in Hono does not properly validate IPv4 addresses, allowing attackers to bypass IP-based access controls. The IPV4 REGEX pattern and convertIPv4ToBinary function in...

PT-2026-4861

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in anyrtcIO-Community anyRTC-RTMP-OpenSource third party/faad2-2.7/libfaad modules. This vulnerability is associated with program files bits.C, syntax.C. This issue affects anyRTC-RTMP-OpenSource: before 1.0...

PT-2026-4863

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in CardboardPowered cardboard src/main/java/org/cardboardpowered/impl/world modules. This vulnerability is associated with program files WorldImpl.Java. This issue affects cardboard: before 1.21.4...

PT-2026-4867

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in GaijinEntertainment DagorEngine prog/3rdPartyLibs/miniupnpc modules. This vulnerability is associated with program files upnpreplyparse.C. This issue affects DagorEngine: through dagor 2025 01 15...

PT-2026-21013

Name of the Vulnerable Software and Affected Versions Loki affected versions not specified Description An issue in the log aggregation and storage system exists due to improper restriction of the directory path name. By using double encoding to bypass validation of the namespace parameter for pat...

Fortinet Confirms Active FortiCloud SSO Bypass on Fully Patched FortiGate Firewalls

Fortinet has officially confirmed that it's working to completely plug a FortiCloud SSO authentication bypass vulnerability following reports of fresh exploitation activity on fully-patched firewalls. "In the last 24 hours, we have identified a number of cases where the exploit was to a device th...

PT-2026-4352

Name of the Vulnerable Software and Affected Versions Birebirsoft Software and Technology Solutions Sufirmam versions through 23012026 Description The software exhibits issues related to excessive authentication attempts and a weak password recovery mechanism. This allows for potential brute forc...

CVE-2025-68901

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in AivahThemes Anona anona allows Path Traversal.This issue affects Anona: from n/a through = 8.0...

ROS-20260122-73-0034

Vulnerability in apache-kafka related to security token assignment restriction errors. Exploitation of the vulnerability could allow an attacker to escalate privileges...

Orjson security vulnerabilities

orjson is a fast and accurate Python JSON library developed by ijl’s individual developers. Versions of orjson prior to 3.11.4 have security vulnerabilities, which stem from the orjson.dumps function not properly restricting recursion for deeply nested JSON documents...

PT-2026-4114

Name of the Vulnerable Software and Affected Versions HDForms versions through 1.6.1 Description A Path Traversal issue exists in HDForms. The issue involves improper limitation of a pathname to a restricted directory, potentially allowing unauthorized access to files and directories...

Azure Linux 3.0 Security Update: opa (CVE-2025-46569)

The version of opa installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-46569 advisory. - Open Policy Agent OPA is an open source, general-purpose policy engine. Prior to version 1.4.0, when run as a...

PT-2026-3939

Name of the Vulnerable Software and Affected Versions Tenda AX1803 version 1.0.0.1 Description A stack-based buffer overflow exists in the fromGetWifiGuestBasic function within the /goform/WifiGuestSet file of the Tenda AX1803. Manipulation of the guestWrlPwd, guestEn, guestSsid, hideSsid, and...

CVE-2025-58742

Insufficiently Protected Credentials, Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the Connection Settings dialog in Milner ImageDirector Capture on Windows allows Adversary in the Middle AiTM by modifying the 'Server' field to redirect client...

PT-2026-3876

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.1.17 Description The resolveSafeChildPath utility function in @backstage/backend-plugin-api did not properly validate symlink chains and dangling symlinks, leading to a path traversal issue. An attacker could bypa...